This structure returns notifications about system state, sponsor processes, dependent processes, and shutdown notifications. The dwNotifyType field determines the meaning of the other fields.
typedef struct _tag_event_info {
    DWORD dwNotifyType;
    DWORD dwLocation;
    DWORD dwProcessId;
} EVENTINFO;
dwNotifyType 
TERMINATE | 
This process is being terminated. The process must immediately clean up and exit. | 
RTIO_CONSOLE_CLOSED | 
The console window has been closed by the user (see Miscellaneous Configuration panel for details). | 
DEPENDENT_REGISTERED | 
A dependent registered against this sponsor process. | 
DEPENDENT_UNREGISTERED | 
A dependent unregistered against this sponsor process. | 
DEPENDENT_TERMINATED | 
A dependent of this sponsor process terminated without unregistering itself. | 
SPONSOR_UNREGISTERED | 
This sponsor process unregistered itself. | 
SPONSOR_TERMINATED | 
The sponsor of this dependent process terminated. | 
RT_CLIENT_DOWN | 
The real-time client is now offline. | 
NT_HOST_DOWN | 
The Windows host is now offline. | 
RT_CLIENT_UP | 
The real-time client is now active. | 
NT_HOST_UP | 
The Windows host is now active. | 
NT_BLUESCREEN | 
The local Windows host had a bluescreen error. When a bluescreen occurs, Windows is not allowed to run so that RT applications can continue. If you would like Windows to continue shutting down, you can use the RtContinueWindowsShutdown API. | 
NT_HOST_SHUTDOWN_PENDING | 
The Windows host shutdown is imminent. You can block Windows shutdown by calling RtShutdownBlockReasonCreate. Once you have finished cleanup, you can call RtShutdownBlockReasonDestroy. | 
KERNEL_SHUTDOWN_PENDING | 
This message is sent before a node is stopped. There is a configurable delay (default 500 ms) before the KERNEL_STOPPING message is sent and the node is stopped. | 
KERNEL_STOPPING | 
The kernel will stop shortly. | 
NT_HOST_HIBERNATE | 
The Windows Host is going into a hibernate state and the kernel will be stopped. | 
NT_HOST_STANDBY | 
The Windows Host is going into a standby state and the kernel will be stopped. | 
dwLocation 
dwProcessId