Event Viewer won't tell me what's waking my computer

NJMorf · 24 Jun 2017

I've got a media centre PC which won't stay asleep for very long (typically no more than a couple of minutes). I've looked in the Event Viewer at the Power-Troubleshooter logs and the vast majority of the wake sources are "unknown" (with the rest being obvious things like the power button or IR remote). Is there any other way I can track down the cause?

Background:

I'm using the PC as network storage, but backups are controlled from the other PCs and only happen daily or at fairly wide intervals (nothing shorter than an hour, I think) and only when the other PCs are already booted up. Ideally, the media PC should only be awake when it's recording, when someone's watching TV or when one of the other PCs are backing up data (I've set a sleep timer of 10 minutes).

Most of the wake events are preceded in the logs by the system time being changed, e.g.:

25/06/2017 02:56:11 Microsoft-Windows-Kernel-Power "The system is entering sleep.

Sleep Reason: System Idle"
25/06/2017 02:58:46 Microsoft-Windows-Kernel-General The system time has changed to 2017-06-25T01:58:46.500000000Z from 2017-06-25T01:56:19.712571200Z.
25/06/2017 02:59:03 Microsoft-Windows-Power-Troubleshooter "The system has resumed from sleep.

Sleep Time: 2017-06-25T01:56:10.522558300Z
Wake Time: 2017-06-25T01:58:47.145028000Z

Wake Source: Unknown"

I assume that the system actually wakes up before the time is changed but for some reason it's logged the other way around. I'm also guessing that the time change is causing the system to wake up, rather than happening solely because it's woken up, but I've nothing to back that guess up.

I was having problems with the system clock getting significantly out of sync: at the time, I either couldn't find a way to change the standard weekly update to anything faster, or Win 7 was ignoring the attempted change, so I followed a guide I found to work around it. I've just disabled that tweak and attempted to change the frequency via the registry instead, but it's had no effect so far.

powercfg -lastwake typically returns no information.

I'm going to try disconnecting the media PC from the network to try and rule the network out as a cause, but in the meantime does anyone have any advice for tracking this down?

Thanks in advance.

NJMorf · 25 Jun 2017

After further investigation, I think that the time isn't actually being changed: I think that the system's just reporting that time has passed. The "from" time is fairly close to the time that the computer went to sleep, and the "to" time is similarly close to the waking time, so I think the log entry just records that the system has noticed the change in time, rather than that it's actually changing the system clock.

Having left the media PC disconnected from the network last night, the only wakeups were caused by Windows Media Center updating itself (primarily its program guide, I think). More tests are still needed.