I don't really have time to write an article on this, but here is a more complete implementation. I have tested on Windows 2000 only, so it may not work on 98/ME. Also, this has not been tested with MDI children or parents.

Most times, you need to know if you are closing because the user selects "Close" from the menu, or whether it is some sort of system thing. The previous implementation does not take into account shutting down the computer. In this instance, where I am cancelling and hiding if it is user input, this would abort the shutdown! You'd never be able to shutdown your computer normally as long as your .NET program is running.

private enum ClosingSource
{
    Unknown         = -1, //We've never seen this one before!!!
    Code            = 0,  //Shutdown from a call to this.Close();
    TaskManager     = 1,  //Shutdown from the task manager. 
    SystemShutdown  = 2,  //Windows is shutting down, or user logging out.
    FormControlMenu = 3   //User selected by clicking "X" in form, or from
                          //    the control menu.
}

private ClosingSource GetClosingSource(StackTrace stack)
{
    StackFrame frame7 = stack.GetFrame(7);
    if(frame7.GetMethod().Name == "SendMessage")
        return ClosingSource.Code;
    else if(frame7.GetMethod().Name == "DispatchMessageW")
        return ClosingSource.TaskManager;
    else if(frame7.GetMethod().Name == "CallWindowProc")
    {
        //At frame 7, a close due to system shutdown still looks
        //like a user-selected shutdown, so we have to check the
        //next change, which is at stack position 14.
        StackFrame frame14 = stack.GetFrame(14);
        if(frame14.GetMethod().Name == "WndProc")
            return ClosingSource.SystemShutdown;
        else if(frame14.GetMethod().Name == "WmSysCommand")
            return ClosingSource.FormControlMenu;
    }
			
    return ClosingSource.Unknown;
}

private void EventLog_Closing(object sender, System.ComponentModel.CancelEventArgs e)
{
    StackTrace stack = new StackTrace(true);

    ClosingSource source = GetClosingSource(stack);

    if(source == ClosingSource.FormControlMenu)
    {
        e.Cancel = true;
        this.Hide();
    }
}

I don't like the stack-based solution for "QueryUnload" --> "Closing" much. It depends on a lot of underlying code that I don't have any control over not changing over time. However, I have yet to find a better method, or even another method that works. One of the few instances where .NET functionality is not a superset of VB6.