Computer wakes itself up from sleep every hour event log help

Toggle sidebar Toggle sidebar
G

grizdom

Honorable
Jun 29, 2012
92
0
10,630
ok guys i have been having this issue that at first i thought was a hardware issue but its not everytime i put my computer to sleep it wakes up after an hour or so, i have disabled all network adapters from waking up the computer i have disabled all programs and my mouse from waking up the pc i have checked over and over on the task scheduler to see if anything wakes the the computer up from sleep and have yet to find anything .

now the strange part is here when i click on the cmd and type in powercfg lastwake nothing shows up like it wont tell me what woke up my computer

but when i go to to event viewer the same program keeps loging on my pc no matter what itll look something like this

logoff, then logon logon Special logon

and then it will turn on i will past the information from the even viewer below please someone tell me what is causing my pc to wake from sleep

logoff
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2012-11-19T03:49:50.051181500Z" />
<EventRecordID>145870</EventRecordID>
<Correlation />
<Execution ProcessID="660" ThreadID="804" />
<Channel>Security</Channel>
<Computer>Oracle</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetUserSid">S-1-5-21-2489624149-3720922633-3612376223-1000</Data>
<Data Name="TargetUserName">Malael</Data>
<Data Name="TargetDomainName">Oracle</Data>
<Data Name="TargetLogonId">0x5bad695</Data>
<Data Name="LogonType">7</Data>
</EventData>
</Event>

logon
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4624</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12544</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2012-11-19T03:57:52.831857900Z" />
<EventRecordID>145871</EventRecordID>
<Correlation />
<Execution ProcessID="660" ThreadID="1976" />
<Channel>Security</Channel>
<Computer>Oracle</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">ORACLE$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="TargetUserSid">S-1-5-18</Data>
<Data Name="TargetUserName">SYSTEM</Data>
<Data Name="TargetDomainName">NT AUTHORITY</Data>
<Data Name="TargetLogonId">0x3e7</Data>
<Data Name="LogonType">5</Data>
<Data Name="LogonProcessName">Advapi</Data>
<Data Name="AuthenticationPackageName">Negotiate</Data>
<Data Name="WorkstationName" />
<Data Name="LogonGuid">{00000000-0000-0000-0000-000000000000}</Data>
<Data Name="TransmittedServices">-</Data>
<Data Name="LmPackageName">-</Data>
<Data Name="KeyLength">0</Data>
<Data Name="ProcessId">0x280</Data>
<Data Name="ProcessName">C:\Windows\System32\services.exe</Data>
<Data Name="IpAddress">-</Data>
<Data Name="IpPort">-</Data>
</EventData>
</Event>

Special logon
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4672</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12548</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2012-11-19T03:57:52.831857900Z" />
<EventRecordID>145872</EventRecordID>
<Correlation />
<Execution ProcessID="660" ThreadID="1976" />
<Channel>Security</Channel>
<Computer>Oracle</Computer>
<Security />
</System>
- <EventData>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">SYSTEM</Data>
<Data Name="SubjectDomainName">NT AUTHORITY</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="PrivilegeList">SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege</Data>
</EventData>
</Event>

 
Sort by date Sort by votes


logontype 5 is a service attempting to create a logon to the machine.
ORACLE$ is the username.

logontype 7 is unlock attempt to unlock the workstation
username =Malael domain=Oracle

guess: Someone setup oracle server service with the wrong username/password for the service? or has it changed? Second one kind of looks like someone entered in the wrong password to unlock a idle machine.

-was the machine even asleep?
check:

powercfg.exe /energy (look at the html report if /lastwake was not helpful)

in windows power shell
Get-ScheduledTask
Will dump the entire list of scheduled task, you will not have to hunt to find them.
 
Upvote 0 Downvote
this is the link to the power report "file:///C:/Users/Malael/energy-report.html"

Oracle is my computers name Malael is my username, the first report that i post from the event viewer is me logging off, the other two are what comes immediately after the pc logs on by itself.

and i keep reading your post and have no idea what it is that you are saying?

im trying to figure out why is it that my pc keeps waking up when i have everything disabled i even have the option in the power to not wake on scheduled events =/
 
Upvote 0 Downvote
i just put my computer to sleep and it turned back on in less than 5 mins, i checked on event viewer and this is the first thing to come on

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2012-11-19T06:15:12.052657600Z" />
<EventRecordID>11710</EventRecordID>
<Correlation />
<Execution ProcessID="640" ThreadID="2740" />
<Channel>System</Channel>
<Computer>Oracle</Computer>
<Security />
</System>
- <EventData>
<Data Name="param1">Multimedia Class Scheduler</Data>
<Data Name="param2">stopped</Data>
<Binary>4D004D004300530053002F0031000000</Binary>
</EventData>
</Event>

this one has power in the source name idk if it might be more helpfull
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{CDC05E28-C449-49C6-B9D2-88CF761644DF}" />
<EventID>1</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2012-11-19T06:07:12.668238400Z" />
<EventRecordID>11703</EventRecordID>
<Correlation ActivityID="{31DFA777-D080-473E-916F-66BAD751CC5D}" />
<Execution ProcessID="1472" ThreadID="3600" />
<Channel>System</Channel>
<Computer>Oracle</Computer>
<Security UserID="S-1-5-19" />
</System>
- <EventData>
<Data Name="SleepTime">2012-11-19T05:57:17.865359500Z</Data>
<Data Name="WakeTime">2012-11-19T06:07:09.935082100Z</Data>
<Data Name="SleepDuration">12060</Data>
<Data Name="WakeDuration">1433</Data>
<Data Name="DriverInitDuration">1103</Data>
<Data Name="BiosInitDuration">627</Data>
<Data Name="HiberWriteDuration">8015</Data>
<Data Name="HiberReadDuration">0</Data>
<Data Name="HiberPagesWritten">92934</Data>
<Data Name="Attributes">16641</Data>
<Data Name="TargetState">4</Data>
<Data Name="EffectiveState">5</Data>
<Data Name="WakeSourceType">0</Data>
<Data Name="WakeSourceTextLength">0</Data>
<Data Name="WakeSourceText" />
<Data Name="WakeTimerOwnerLength">0</Data>
<Data Name="WakeTimerContextLength">0</Data>
<Data Name="WakeTimerOwner" />
<Data Name="WakeTimerContext" />
</EventData>
</Event>
 
Upvote 0 Downvote
-try starting a command shell (cmd.exe) in admin mode
run
powercfg.exe -devicequery wake_armed
this should dump the currently possible hardware wake methods
then you can try to disable devices wake function using powercfg.exe

for example: if the list has
Logitech HID-compliant Cordless Mouse
you could run
powercfg.exe -devicedisablewake "Logitech HID-compliant Cordless Mouse"
just put the item in quotes.
and do it for anything on the list you don't want to wake the computer.
this should work for items that don't have proper properties settings in control panel.


-if the device wake will not turn on or off sometimes you have to get a better driver.

- Sorry, about Get-ScheduledTask it is included by default in windows 8 powershell. It must have been in a command applet for windows7.
- take a look at your energy-report.html using your browser. It will indicated common problems. like computer not going to sleep because media center is on waiting to share media. Or old drivers that refuse to enter sleep mode
- here are some other things to check
- Network adapter settings, could have WOL wake on LAN set and no magic packet requirement.
- Network printer trying to talk to your computer and wakes it up via WOL
- Service like media center streaming blocks sleep mode.
- task scheduled, even the normal tasks like diagnostic, and update tasks that missed running can wake your computer.
- Sporadic events on USB can wake your computer, stuck keyboard, I have seen a
Bluetooth headphone wake my computer when I walked in range with of my Bluetooth USB receiver.
- I have seen a low battery in a USB device wake a computer (the connection disconnects for a moment, and reconnects and that reconnection wakes the computer)


best to look at the reports from various powercfg.exe options
powercfg.exe /energy
powercfg.exe /lastwake
powercfg.exe /requests
sometimes help.

if all else fails you just have to start to disable wake on your power aware devices until you find what wakes your computer. Or, unplug them until you figure out what is the cause.
unplug network cable to show it is not a WOL event,
unplug all external USB devices to show it is not a USB event

sometime a computer will have BIOS setting to wake the computer, be sure to turn these off unless you know want to them (keyboard space to wake for example is the one I use, I turn all the other BIOS wake settings off)
I turn off waking up via FAX, and RTC (real time clock), PCI bus, ...

your WakeSourceType was 0 that would give a clue but I don't know what the types for that are.
 
Upvote 0 Downvote
i figured it out it could be one of two things actually, i set my computer for programs to ask for permission before doing anything, and then i went into bios and and disable the usb "stay powered on during sleep option" EuP thing.

i believe it was either a program running in the background out of the hundreds i have that wasnt coming up in anything and that now that it needs permission it cant do what it wants to do.

or it was just the usb still having power during sleep that caused my comp to randomly boot either way those two simple changes stopped my pc from waking from sleep mode atleast for 4 hours i have yet to try it for a full day. i will post back up if the problem continues
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom