How do I find out which one of those pesky programs keeps waking my machine from sleep?

Question

Every night I put my Windows 7 machine into sleep mode, and every morning I wake up and the thing is running.

How I can find out which process is waking the thing up?

I've already looked at the Event Log and for the past two days the answer seems to be the "Windows Image Acquisition (WIA) service entered the running state."

What can I do about this?

Answer 1

Found it!

Windows 7 64-bit Ultimate has this built in!

I went to Control Panel -> View By: Category -> System and Security -> View Performance Information, and at the top on the right programs are listed that might be interrupting sleep mode.

After shutting off the programs listed, my computer no longer wakes up from sleep mode.

Answer 2

An excellent overview about this topic can be found at http://www.howtogeek.com/122954/how-to-prevent-your-computer-from-waking-up-accidentally/, specifically

powercfg -lastwake 
powercfg -devicequery wake_armed 
powercfg -waketimers

Answer 3

here is a useful link regarding it's dependencies:

Dependencies

What service Windows Image Acquisition (WIA) needs to function properly:

Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
DCOM Server Process Launcher (S, HB, HP, P, U, E)
RPC Endpoint Mapper (S, HB, HP, P, U, E)
Shell Hardware Detection (S, HB, HP, P, U, E)
Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
DCOM Server Process Launcher (S, HB, HP, P, U, E)
RPC Endpoint Mapper (S, HB, HP, P, U, E)

What other service require Windows Image Acquisition (WIA) to function properly: None (S, HB, HP, P, U, E)

Which doesn't really help diagnose what's causing it, but at least shows nothing else should be calling it (ie no dependencies).

There are several security vulnerabilites which Microsoft have patched with it, so make sure you've got all security updates... Failing that i would be inclined to stop the service one night and see if it has restarted itself before the morning then check/change it's startup properties (mine is running here and set to automatic by default). Then again i like breaking things lol ;)

Answer 4

The event log isn't necessarily reliable to determine what woke up the computer. When the computer wakes up, many things may start running, resulting in entries in the log. If you are having difficulties with keeping it sleeping, it may be a good idea to check a couple things:

First, I found that if I have files being shared over the network, sometimes it may cause the computer to wake seemingly randomly. You need to check your sleep settings under advanced power options. Under the advanced settings tree, check the "When Sharing Media" entry, and make sure it is set to "Allow the computer to sleep". "Away mode" is a semi-sleep mode that still allows access to shared files and resources. Also go through the other settings and make sure that things aren't allowed to wake the computer up.

If that isn't helpful, also run powercfg /requests in a command shell running as an administrator. If there are things that are preventing the computer from remaining in sleep mode, this will reveal them. Even simple, seemingly innocuous things can do this. I found that leaving the Line In audio jack set to enable "listening" (so I can play my Xbox through the computer speakers) prevents the computer from entering sleep mode.