Finding What Wakes Your Windows PC From Sleep

A Windows PC that wakes up seconds after it goes to sleep, or turns itself on in the middle of the night, usually has a wake source that Windows records. This post covers how to ask Windows what woke it, how to check wake timers and scheduled tasks, and how to limit which devices are allowed to wake the PC.

A recent ElevenForum thread had a PC that powered right back on after sleep because switching the trackball off with its slider moved it slightly. A mouse or trackball that moves while the PC is going to sleep can wake it.

Ask Windows what woke it

I'd run this in Terminal right after the PC wakes on its own.

powercfg /lastwake

The output lists the wake source from the last sleep. A device shows its name on the Friendly Name line, and a USB controller or a USB input device usually means a mouse, keyboard, or wireless receiver woke the PC. A wake timer shows as a timer with the process or service that set it.

That command only covers the last wake. The System log keeps a record of every wake with the sleep time, the wake time, and the wake source.

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Power-Troubleshooter'; Id=1} -MaxEvents 20 | Select-Object TimeCreated,Message

Match these entries to the times the PC turned itself on. Kernel-Power writes event 42 each time the PC starts to go to sleep, so list those entries for the same period and compare the two sets of times. A wake a few seconds after event 42 likely comes from input during sleep entry, such as the trackball in that thread. A wake at the same minute each night likely comes from a timer.

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'; Id=42} -MaxEvents 20 | Select-Object TimeCreated

When the Wake Source line says Unknown, check the wake timers and scheduled tasks in the next section.

On a PC that uses Modern Standby, powercfg /a lists Standby (S0 Low Power Idle) as an available state. Run powercfg /sleepstudy there as well. It writes an HTML report of the standby sessions from the last three days to the folder you ran the command from.

Check wake timers and scheduled tasks

A PC that wakes at the same time every night is usually waking for a timer. List the timers that are set now from an elevated Terminal.

powercfg /waketimers

Each entry names the process or task that set the timer and when it expires. Scheduled tasks can also wake the PC when their "Wake the computer to run this task" condition is ticked. This command lists every task with that setting.

Get-ScheduledTask | Where-Object { $_.Settings.WakeToRun } | Select-Object TaskPath,TaskName,State

Untick that condition on the Conditions tab of the task in Task Scheduler when the task doesn't need to wake the PC. To stop every timer from waking it, set Allow wake timers to Disable under Sleep in the advanced settings of the power plan.

Limit which devices can wake the PC

List every device that is allowed to wake the PC now.

powercfg /devicequery wake_armed

Run powercfg /devicequery wake_programmable to see every device whose wake setting you can change, including the ones that are off now. Turn wake off for a device with its name exactly as the list shows it.

powercfg /devicedisablewake "HID-compliant mouse"

The same setting is "Allow this device to wake the computer" on the Power Management tab of the device in Device Manager. Keep wake on for at least one device you use to wake the PC, or use the power button. For a network adapter, tick "Only allow a magic packet to wake the computer" on that tab to keep Wake-on-LAN working. Run powercfg /deviceenablewake with the same name to turn wake back on for a device.

When the PC hangs after a longer sleep

In another ElevenForum thread a laptop woke fine from a short sleep but hung with the power light on after about 10 minutes of sleep. Windows can move a PC from sleep into hibernate after a set time, so check that timer first.

powercfg /q SCHEME_CURRENT SUB_SLEEP HIBERNATEIDLE

The Current AC Power Setting Index and Current DC Power Setting Index lines are in seconds written in hex, so 0x00000258 is 10 minutes. When one of them matches the time the hang starts, turn hibernate after sleep off and test a longer sleep.

powercfg /change hibernate-timeout-ac 0
powercfg /change hibernate-timeout-dc 0

If the PC then wakes every time, the hang is likely in resuming from hibernate. Update the chipset and graphics drivers from the PC maker, or leave the timer off.

Where ET Ducky shows it

I build ET Ducky, and its Windows agent reads the kernel event stream through ETW on every managed PC. You can open a Live Session shell from the browser without the need for a VPN and run the powercfg and Get-WinEvent commands above on a PC that keeps waking.

You'd start a Live Session on the PC after it wakes on its own. The AI picks the ETW providers for each round of the investigation, and only counts-only summaries leave the PC while the raw kernel events stay on it. When several PCs in an office wake at night, a Multi-Agent Session across a PC that wakes and one that stays asleep compares the kernel events from both to find the outlier.