Hibernate is disabled, hiberfil.sys gets recreated at each boot

21

9

I have Windows 7 running on a small (40GB) partition, with 4GB ram. This means that the hiberfil.sys file created by Hibernate takes up a significant portion of the available diskspace. I would like to remove it.

I am aware that I can disable Hibernate and remove hiberfil.sys by entering powercfg -h off in an elevated command prompt. This works -- the file is immediately removed, and after doing so, the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled key is (correctly) set to 0.

However, the next time I reboot the PC, hiberfil.sys returns from the dead, Hibernate is reenabled, and that registry key has returned to 1.

I'm pretty much at my wits' end with this. Almost everything I can find online related to removing the hiberfil.sys file simply suggests using powercfg to turn off hibernation, and that appears to work for just about everyone. But it just keeps coming back for me! (Like a vampire, sucking up my disk space.) I did find one other thread from someone who seems to have had the same issue, but none of the suggestions there worked for the original poster (or for me). Still, I have tried everything listed there, including:

  • Disabling hybrid sleep

  • Disabling Hibernate through the command prompt, through the Power Options GUI, and through both (in both orders)

  • Manually changing the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled key

  • Pretty much everything else I can think of!

I do want to reiterate that I have no problem removing the file -- that works great. It just comes back after every reboot. I'm about ready to throw in the towel and just run a script on login to disable Hibernate each time, even though that seems like a crazily hacky "solution" . . . but I was hoping someone here could suggest something else, first.

Corey White

Posted 2010-05-14T06:54:13.957

Reputation: 211

You must have some security software monitoring and protecting the registry. – Moab – 2010-12-05T03:08:48.150

1Given how long this question has been sitting there, and since this might be a prevalent issue, I have put a bounty on this question. – bwDraco – 2011-04-09T01:30:25.543

You don't happen to have custom boot software installed that would do this, would you? – user541686 – 2011-04-09T01:59:30.807

Answers

18

My Windows 7x64 install is on an SSD partition on a Mac laptop. I've disabled with powercfg /h off (elevated) and ms fixit's disable hibernate, as well as the setting registry key HibernateEnable value to 0. Hiberfil.sys is deleted only until reboot. When I boot native hiberfil.sys is always re-created, but when I boot inside OS X and VMware Fusion, the hibernation stays disabled, as it should.

Tom Wijsman's suggestion of ProcessMonitor with boot logging helped me find that vmtoolsd.exe (from VMware) was re-enabling the registry key during the native boot. I tried to change the permissions in regedit, but they did not stop the value change to 1. I thought about creating a small hiberfil.sys, but I think that would ave been overwritten.

As a 99% solution, I changed the HiberFileSizePercent value to decimal 1, which makes the hiberfil.sys only 80MB on an 8GB RAM machine. I suppose I could try .001 or less, but 80MB is not much.

greenfellow

Posted 2010-05-14T06:54:13.957

Reputation: 181

1Thank you - I'm on a Macbook with Bootcamp and VMWare Fusion too, you probably saved me hours. – DanB – 2012-03-13T11:46:30.320

13

You can easily troubleshoot this with Process Monitor.

Start it and enable Boot Logging in the Options menu, restart your computer and start Process Monitor.

Then, let it stop capturing and then search for HibernateEnabled and check what changed the value.


For more advanced insights, this can also be done with XBootMgr from the Windows Performance Toolkit.

Installation Instructions - On/Off Transition Performance Analysis Document

Tamara Wijsman

Posted 2010-05-14T06:54:13.957

Reputation: 54 163

This method solved my problem. Thanks! (My problem is about the Wake-On-LAN, details here: https://superuser.com/questions/1405082/how-to-permanently-disable-hibernation-on-windows-10)

– smwikipedia – 2019-02-13T03:42:49.817

3As your answer has the most potential for solving the problem, I have decided to award the bounty to you. – bwDraco – 2011-04-12T15:05:35.267

6

If you're using boot camp and vmware fusion:

Find the file

%programfiles%\VMware\VMware Tools\plugins\vmsvc\disableGuestHibernate.dll

and delete it or move it.

Finally, disable hibernation once and for all by opening an administrator elevated command prompt and running:

powercfg -h off

The disableGuestHibernate plugin loads when vmware tools loads. If vmware tools loads while running in a vm, it will disable hibernation (since vmware has its own suspend system making hibernation redundant.) But if vmware tools loads outside of a vm (i.e. you use boot camp to boot into windows instead) it will re-enable hibernation if its disabled.

themaninblack

Posted 2010-05-14T06:54:13.957

Reputation: 61

This fixed it for me as well. Upvote! – MortenRøgenes – 2014-11-14T08:48:43.597

This is a great answer and well detailed. If I could give it 10 upvotes, I would! – Rijk – 2013-04-16T17:06:41.560

By the way: simply renaming it does not work, you really have to remove the dll. – Rijk – 2013-04-16T17:13:45.173

4

You could try to turn hibernate on and off again. In cmd "Run as Administrator" do :

powercfg.exe /hibernate on
powercfg.exe /hibernate off
del c:\hiberfil.sys

If you are using a laptop, then after turning hibernate on and before turning it off, do also the following :

  1. Ensure that hybrid sleep is disabled.
  2. Power Options → Change plan settings → Change advanced power settings, expand Sleep and change the value of "On battery" and "Plugged in" to 0 minutes.

image

harrymc

Posted 2010-05-14T06:54:13.957

Reputation: 306 093

2

I had the same problem. Tried:

powercfg –H OFF

Set HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled

Set Control Panel\All Control Panel Items\Power Options\Edit Plan Settings for Never for all power options.

And the file kept coming back to life. The advice of using process monitor did the trick for me. The system I use has "Pointsec for PC" installed, and the prot_srv.exe process kept resetting this value. Given this PC is locked down with this software, there is not much I can do.

TryingToHelp

Posted 2010-05-14T06:54:13.957

Reputation: 21

1

As oKtosiTe said, I tried this sneaky approach since nothing else worked for me. ProcessMonitor simply showed that entry in registry is created by powercfg.exe itself.

I cannot simply disable/rename or remove it.

Probably due to Group Policies which are all over my laptop (company laptop -> company super stupid security policies!).

So I did run command, hiberfile.sys disappeared for couple of seconds, copied file named hiberfile.sys from other place (created in editor and 1 KB in size) and change it's permissions to read only (properties of the file).

Did the magic!

So in short:

  1. Run in cmd powercfg -h off
  2. Copy prepared hiberfile.sys
  3. Properties -> read-only

Done!

Note: without changing permission file grow back to about 6GB in my case.

hiberfile.sys only 1KB now

yrk

Posted 2010-05-14T06:54:13.957

Reputation: 11

1

Same thing here!

Out of frustration, I even configured the local policy such that it would run a cmd on machine startup that would run the powercfg line, but even that's not good enough!

This is really frustrating since I'm running Win7 Ultimate on a 60 GB partition.

In my next experiment I shall toy with the HiberFileSizePercent registry key under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power

and see if that might force it to (re-)create a smaller file at least.

Frank

Posted 2010-05-14T06:54:13.957

Reputation: 11

+1 - This is probably a good idea. I have come across this same solution while helping another user with his unrelated hibernations issues. – SgtOJ – 2010-12-05T02:09:12.927

I never did end up solving this. I ran a login script for a while, but it was flaky, and eventually I just ended up buying a bigger drive and leaving the hiberfil.sys file in place. I wish you the best of luck, and I'll follow this thread. If you are successful, please post back! – Corey White – 2010-12-05T04:05:54.973

You could also delete hiberfil.sys after disabling hibernation, and then create a directory called hiberfil.sys. You can't have a file and a directory in the same directory with the same name, so Windows will not be able to create a file called hiberfil.sys. Of course, MS might have accounted for that and it might create another file (hiberfi2.sys?) or it might complain loudly about it. – Bacon Bits – 2011-04-09T02:15:52.880

@BaconBits: biziclop said this doesn't work; Windows replaces the folder with the hiberfil.sys file. – bwDraco – 2011-04-09T02:59:36.183

1

Not a solution, but a workaround that worked for me:

I had only 900MB of free space on my C drive and wanted to get rid of the hiberfil.sys file, which took more than 6GB. So I removed it with powercfg -h. But it just kept coming back after about 10 seconds or something. I think it has something to do with PointSec because that was mentioned earlier here.

Then I disabled hibernation, and then quickly copied a 1GB file over to the C drive. Now it doesn't come back and I have still 6GB of space left. I guess it's still trying to enable hibernation and finds that there is no longer enough space for that. And next time I run out of space on the C drive, I can still delete the 1GB file..

Roberg

Posted 2010-05-14T06:54:13.957

Reputation: 111

0

Credit goes to @Tom Wijsman.

My specific problem is about the Wake-On-LAN blocked by hibernation, details here: How to permanently disable hibernation on Windows 10?

I followed his method and get the boot log.

In my case, it is the vmtoolsd.exe that kept setting below registry value to 1, which totally beat the powercfg /h off.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\HibernateEnabled

The vmtoolsd.exe belongs to VMware Tools.

After I uninstall it, the hiberfil.sys was never re-created.

smwikipedia

Posted 2010-05-14T06:54:13.957

Reputation: 464

0

Maybe manually recreate it after the removal and set permissions to disallow the system to modify the file? I know, it's a long shot.

Could this be caused by a restore partition or similar?

oKtosiTe

Posted 2010-05-14T06:54:13.957

Reputation: 7 949

0

I have a workaround that seems to work just fine for me (though, maybe not everyone). From what I've gathered, vmtoolsd.exe disables hibernation when booting under VMware and then re-enables it (regardless of previous state) when booting natively. Since VMware Tools aren't necessary when running native (Boot Camp), I made a batch file containing the following:

@echo off

if "%NUMBER_OF_PROCESSORS%" == "1" goto :enable
goto :end

:enable
net start "VMware Tools"

:end

I set the VMware Tools service to Manual (rather than Automatic) and created a task in Task Scheduler. The task is set up as follows:

  • Run whether the user is logged in or not
  • Run with highest privileges
  • Hidden (may not be necessary)
  • Triggers: at system startup
  • Actions: the batch file above
  • Uncheck everything in Conditions/Settings (may not be necessary)

NOTE: since I rely on the NUMBER_OF_PROCESSORS to differ from when booted natively, this will only work if you do not have the virtual machine given the same number of processors (logical, not physical) on your Mac.

Also, the batch file can be simplified to:

@if "%NUMBER_OF_PROCESSORS%" == "1" net start "VMware Tools"

I had a few things in the batch file for debugging/testing and just kept it.

Brandon Crawford

Posted 2010-05-14T06:54:13.957

Reputation: 1

ot, but having an equality check and 2 overlapping gotos like that hurts my aesthetic senses when you could just have a not-equal and 1 goto. – underscore_d – 2015-08-08T22:33:45.793

-1

Half answer:

On Windows XP, this was an easy and permanent solution:

  1. delete hiberfil.sys with this command (with admin rights): powercfg -h off

  2. create a folder called "hiberfil.sys" at C:\

Unfortunately, Win7 is "smarter" than XP, and kills this folder, ignoring any ownership/permission combination I tried. But sometimes my hiberfil.sys folder survived a single restart without being replaced. It is also interesting that the system seemed to regenerate the original file after a few seconds the the window of C:\ appeared on the desktop.

And thank you for my first downvote :)

user188421

Posted 2010-05-14T06:54:13.957

Reputation: 129

That might not be such a bad idea - you could set its permissions so that not even System could delete it (without first changing its permissions). Of course, win7 might simply refuse to boot. – Hugh Allen – 2011-04-09T08:51:25.613

@Hugh: It's possible that the hibernation code, being part of the kernel, would just ignore ACLs. – user1686 – 2011-04-09T12:39:43.293