Computer wakes by itself, but wake source is unknown

Question

I have an interesting problem. I am using Windows 8.1 on my PC and I have WOL enabled from my BIOS and my LAN card settings and it works just fine.

But, since a couple of weeks back, my computer turns on by itself in the middle of the night.

Two nights ago, after it woke me up because of the noise, I removed the LAN cord and everything was well until the next morning when I powered the PC myself. I also thought it could be a peripheral, so from Device Manager I went through every device there (apart from the LAN card, which I need because of the WOL), disabling Allow device to wake the computer from "Power Management". Also, in the LAN settings, I checked and the network card can be wake the PC up just by using Magic Packet or Pattern Mach.

The problem persisted last night (it woke around 5am).

I started reading forums and saw the idea of looking what last turned on my PC, so I checked with powercfg -lastwake and it returned the following:

Wake History Count - 1
Wake History [0]
 Wake Source Count - 0

Because of the answer, I couldn't find a thing, therefore I checked the Windows logs, filtering them by Power Issues. I found the last wake my PC experienced, and the log was as it follows:

The system has returned from a low power state.
Sleep Time: ‎2014‎-‎05‎-‎08T23:38:33.848063300Z
Wake Time: ‎2014‎-‎05‎-‎09T01:56:48.134397800Z
    Wake Source: Unknown

This is the reason I have posted the issue here, even though there are many posts about this. I didn't want to repost, but I never found this same problem (with wake source unknown) in any post or forum.

I hope someone has an idea of what may be the problem.

Answer 1

Disable Windows 8 Automatic Maintenance.

By default, it will wake up your computer around midnight and run some optimization and cleanup tasks.

For reference see What is the "Automatic Maintenance"?

Answer 2

This took a while to track down, but here it is: with automatic updates turned off, obvious scheduled tasks disabled, and even a few services experimented with, Media Center turned out to be the culprit in my case. It's possible that others might run into different issues, so here's how to go about diagnosing this.

1. In an elevated command prompt, run powercfg /waketimers.  The /lastwake option wasn't useful at all, but /waketimers turned up the service that was waking up my machine:

   

   C:\WINDOWS\system32> powercfg /waketimers
   Timer set by [SERVICE] \Device\HarddiskVolume2\Windows\System32\svchost.exe (SystemEventsBroker) expires at 2:36:15 PM on 11/3/2015.
     Reason: Windows will execute 'NT TASK\Microsoft\Windows\Media Center\mcupdate_scheduled' scheduled task that requested waking the computer.
   

2. This did not show up under Services, but apparently it is a scheduler task... which you have to dig for a bit in the Task Scheduler UI.

   Go to Task Scheduler → Task Scheduler Library → Microsoft → Windows → Media Center to find it:

   

3. Right-click and disable with extreme prejudice:

   

Answer 3

Just ran in to a similar issue as well on a new Dell laptop running windows 10. The computer absolutely refused to go to sleep, waking up almost immediately after putting it to sleep from either a power button press or from the start menu. powercfg -lastwake produced the same result as in the question - something woke it up, but no information as to what woke it up. powercfg -waketimers showed nada. Event viewer also reported 'unknown', with no reference to sleep timers. Sleep timers also disabled completely in power settings. No USB devices. No wired network card. Wi-fi network card wakeup disabled. The command powercfg /devicequery wake_armed showed that nothing was enabled to wake the computer.

Eventually, I tried disabling "wake on magic packet" and "wake on pattern match" in the wi-fi card advanced settings. This appears to have finally worked and allowed the computer to sleep. Apparently the card was somehow waking up the computer even though that was supposed to be disabled on the power management tab.

Edit: So, it seems this worked for a while, but now the computer will go into periods where it will refuse to sleep AND refuse to shut down (wakes up/boots up about two seconds after sleeping/turning off). The only way to 'fix' that is to hard power off (hold power button until it turns off), which works for an indeterminate amount of time before the computer again refuses to sleep/shut down. I'm wondering if I may have hit either a hardware fault or an embedded power management controller firmware bug.

Answer 4

I know this is a very old question, but I've run into the same problem over and over again throughout the years, thought I fixed it each time, and each time figured out I did not. Since it still shows up in Google, I decided I'd share my fix for anyone who comes here later.

In issues like this, there's usually some scheduled tasks in Task Scheduler that are the culprit for waking the PC to run tasks that no one would normally consider necessary to wake up the PC and heat up your room all night long so you wake up sweaty.

I've found the way to search for all the ones that can wake your PC up. This is the answer I've been looking for for years.

So, Open up Powershell and run this command:

Get-ScheduledTask | where {$_.settings.waketorun}

Got this information from here.

Here's my results:

As you can see I had already found and disabled two of them previously. The other two I looked up the target exe files to make sure I wasn't disabling something that would cripple the system, and went ahead and disabled them in task scheduler. I also changed many settings inside them to make sure I wouldn't be affected by them much if the system re-enables them later, especially turning off "Wake the computer to run this task" (my PC has always found ways to re-enable tasks I disabled).

I'm assuming from the format of this command that you should also be able to filter with any other setting from the tasks settings window you have in mind.

Answer 5

Find which task wake your PC by below command:

powercfg /waketimers

the result be somethings like this:

PS C:\WINDOWS\system32> powercfg /waketimers
Timer set by [SERVICE] \Device\HarddiskVolume2\Windows\System32\svchost.exe (SystemEventsBroker) expires at 05:24:34 AM on 08/05/2019.
  Reason: Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Backup Scan' scheduled task that requested waking the computer.

Then according to this article:

The first thing to try is an elevated cmd/powershell and do:

SCHTASKS /Change /TN "Microsoft\Windows\UpdateOrchestrator\Backup Scan" /DISABLE

If this gives you an access denied error, you'll need something like NSudo.

Run NSudo, and the cmd as SYSTEM with all privileges. You should then be able to run the aforementioned command.

However, this still doesn't solve the re-enabling issue; to fix that, do the following in the NSudo elevated cmd:

icacls "%WINDIR%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Backup Scan" /inheritance:r /deny "Everyone:F" /deny "SYSTEM:F" /deny "Local Service:F" /deny "Administrators:F"

(You might need to edit the command slightly to suit your setup/usernames/SIDs.)

Answer 6

Shortly after going into sleep mode, my Windows 7 computer would always wake up. I tried everything from checking power management settings, scheduled tasks, installed full updates (including BIOS), ran scans, reviewed logs, etc., all without success.

Then I cleaned my tower. When moving my tower slightly out, my display came back on. I realized I could wake my PC just by tapping the tower or even the desk.

I disassembled my tower, unplugging a few plugs and GTX card, cleaned everything with compressed air, and then hooked everything back up again with more organized wiring. I reconnected the external wiring, and now it sleeps fine.

If you receive a "wake source: unknown" in the Windows logs and if your computer wakes up when you tap your tower, it might be some external source that is keeping the PC awake.

Answer 7

Based on @Adam Lear answer https://superuser.com/a/995222/71226 I did the following

1. Run an ELEVATED command prompt to execute:

   powercfg /waketimers

   Timer set by [SERVICE] \Device\HarddiskVolume2\Windows\System32\svchost.exe (SystemEventsBroker) expires at 17:26:17 on 19/11/2016. Reason: Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot' scheduled task that requested waking the computer.

   2. Go to

Control Panel\All Control Panel Items\Administrative Tools

Task Scheduler > Task Scheduler Library > Microsoft > Windows > UpdateOrchestrator

3. I left-clicked in all the list entries, and below had focused the Conditions Tab. I've noticed the Reboot entry has the checkbox Wake the computer to run this task checked.

4. I double-clicked the Reboot, focused the Conditions Tab, then unchecked the checkbox Wake the computer to run this task and finally clicked OK.

Not sure if it solves the problem; I am just hoping the computer will not wake at 3:00 am again!

UPDATE: Computer did not wake me up again at 3:00 am!

UPDATE 2: I followed the link on my comments below and now it reallly seems to be solved! :)

Answer 8

Same problem happened to me. I tried pretty much all the suggestions above and ones from other websites. The cause was not waketimers, network, or HID devices accidentally waking the computer. It turned out to be the USB ports at the back of my computer. I had my wireless mouse/keyboard USB dongle plugged into a slot on at the back of my computer. The computer would wake every 30seconds to a minute after going to sleep. I moved the adapter to the front ports and now the computer does not automatically wake after going to sleep. Hope this information helps someone.

Answer 9

After upgrading system software, the computer wakes up and I tried all the above suggestions. Here is what worked for me.
Windows 7.

Control Panel>
Network and Sharing Center>
Change Adapter Setting
Right click on Local Area Connection, and select Properties
Configure button
Advanced Tab
Then disable Wake on Magic Packet, Wake on pattern match, 
Select None for Wake-On-Lan Capabilities

Answer 10

Use PowerShell (needs Administrator):

PS> Get-WinEvent -Providername Microsoft-Windows-Power-Troubleshooter -MaxEvents 5 | Format-List TimeCreated,Message

You'll get a list of reasons why the computer woke up:

TimeCreated : 04/10/2019 01:00:33
Message     : The system has returned from a low power state.

              Sleep Time: ‎2019‎-‎10‎-‎03T16:27:16.796954700Z
              Wake Time: ‎2019‎-‎10‎-‎03T23:00:33.255687300Z

              Wake Source: Timer - Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Universal Orchestrator Start' scheduled task that requested waking the computer.

TimeCreated : 03/10/2019 09:19:33
Message     : The system has returned from a low power state.

              Sleep Time: ‎2019‎-‎10‎-‎02T22:57:06.677577300Z
              Wake Time: ‎2019‎-‎10‎-‎03T07:19:32.331075700Z

              Wake Source: Device -USB Composite Device

// etc...

Answer 11

I had the same problem: computer woke up every night/morning. I could solve my problem following these steps:

I checked with powercfg (cmd as administrator), but it didn't point me to the cause:

C:\Windows\system32>powercfg -lastwake
Wake History Count - 1
Wake History [0]
  Wake Source Count - 1
  Wake Source [0]
    Type: Fixed Feature
    Power Button

C:\Windows\system32>powercfg -waketimers
Timer set by [SERVICE] \Device\HarddiskVolume4\Windows\System32\svchost.exe (SystemEventsBroker) expires at 14:27:19 on 29/11/2019.
  Reason: Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Backup Scan' scheduled task that requested waking the computer.

C:\Windows\system32>powercfg -requests
DISPLAY:
None.

SYSTEM:
None.

AWAYMODE:
None.

EXECUTION:
None.

PERFBOOST:
None.

ACTIVELOCKSCREEN:
None.


C:\Windows\system32>powercfg -devicequery wake_armed
HID-compliant mouse

So I tried Get-ScheduledTask (powershell as administator):

PS C:\Windows\system32> Get-ScheduledTask | where {$_.settings.waketorun}

TaskPath                                       TaskName                          State
--------                                       --------                          -----
\Microsoft\Windows\.NET Framework\             .NET Framework NGEN v4.0.30319... Disabled
\Microsoft\Windows\.NET Framework\             .NET Framework NGEN v4.0.30319... Disabled
\Microsoft\Windows\InstallService\             WakeUpAndContinueUpdates          Disabled
\Microsoft\Windows\InstallService\             WakeUpAndScanForUpdates           Disabled
\Microsoft\Windows\SharedPC\                   Account Cleanup                   Disabled
\Microsoft\Windows\UpdateOrchestrator\         Backup Scan                       Ready
\Microsoft\Windows\UpdateOrchestrator\         Reboot                            Ready
\Microsoft\Windows\UpdateOrchestrator\         Reboot_AC                         Disabled
\Microsoft\Windows\UpdateOrchestrator\         Universal Orchestrator Start      Ready

But that didn't made me any wiser either.

So I checked with the Get-WinEvent command to filter out the Microsoft-Windows-Power-Troubleshooter events (only relevant results shown):

PS C:\Windows\system32> Get-WinEvent -Providername Microsoft-Windows-Power-Troubleshooter -MaxEvents 5 | Format-List TimeCreated,Message


TimeCreated : 15/11/2019 7:32:41
Message     : The system has returned from a low power state.

              Sleep Time: ‎2019‎-‎11‎-‎14T21:08:03.532918500Z
              Wake Time: ‎2019‎-‎11‎-‎15T06:32:41.357766500Z

              Wake Source: Unknown


TimeCreated : 14/11/2019 7:29:39
Message     : The system has returned from a low power state.

              Sleep Time: ‎2019‎-‎11‎-‎13T20:17:29.836771000Z
              Wake Time: ‎2019‎-‎11‎-‎14T06:29:38.367280500Z

              Wake Source: Unknown

I noticed every day at around 7:30 a power-up event from an unknown source. So I decided to check in the application eventlog (event viewer/windows logs/application) what happened at around that time and found an information event from source gupdate just after that time:

The description for Event ID 0 from source gupdate cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.
The following information was included with the event: 
Service stopped

The service gupdate refers to the Google Update Service (GoogleUpdate.exe). I also checked TaskScheduler for related Google Update tasks, but their schedule times didn't match the time above.

Anyhow, I disabled Google Update Service to test if I didn't get the unknown wakeup events anymore.

So my problem is solved, but I am still left with some questions:

• Why does Google Update Service needs to wakeup my pc from sleep?
• Why at 7:30 in the morning? How can I change the hour?
• How can I instruct Google Update Service to not wakeup my pc?

Answer 12

Work around Do everything you can and as long as the computer actually powers off for hibernation (if not, there is a reg switch you can check*) PULL THE PLUG / BATTERY.

To resume, Plug it back in - if it starts by itself or waits for the power button, you're golden.

If you forget to replug it - some LED's may still flash from the clock battery or some other embedded power. Remember to check the plug first thing if lights flash weird.

• edit the registry Key hkey_local_machine\software\Microsoft\Windows NT\CurrentVersion\WinLogon and modify PowerdownAfterShutdown and change it to 1

Source: Windows 10 wakes randomly from hibernate - Microsoft Community https://answers.microsoft.com/en-us/insider/forum/insider_wintp-insider_perf/windows-10-wakes-randomly-from-hibernate/247e69c3-cc7a-40db-b34e-43d8d60e6947?auth=1

Also sometimes having a boot-device plugged in during reboot or wake-up can also cause temporary cog-dis (any USB memory device, or a cell phone.)