Is there a way to find out what put computer into sleep mode?

I know that there's a good powercfg command line call that can tell what last woke up computer from sleep:

powercfg /lastwake

what I need is a reverse -- command/software to tell me what was the last process that put computer into automatic sleep?

PS. I've done all the usual checks in the power settings and such. None were found. The system in question has some running service/process that puts it into automatic sleep after a predictable amount of time. I just need to find which one it is.

dc2000 said:

I know that there's a good powercfg command line call that can tell what last woke up computer from sleep:

powercfg /lastwake

what I need is a reverse -- command/software to tell me what was the last process that put computer into automatic sleep?

PS. I've done all the usual checks in the power settings and such. None were found. The system in question has some running service/process that puts it into automatic sleep after a predictable amount of time. I just need to find which one it is.

Well the place to start is in your Windows System log--look for Kernel-Power. Here's my last:

Code:

Log Name:      System
Source:        Microsoft-Windows-Kernel-Power
Date:          2/7/2016 6:54:13 AM
Event ID:      42
Task Category: (64)
Level:         Information
Keywords:      (4)
User:          N/A
Computer:      Latitude
Description:
The system is entering sleep.

Sleep Reason: System Idle

You may have to examine the events around this one as well to help you understand what happened.

Thanks. That's a good start. If I go to Event Viewer -> Windows Logs -> System and then set a filter on "Kernel-Power" I get these:

The system is entering sleep.

Sleep Reason: Application API

and then if I go to Details and set XML view, I get this:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>42</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>64</Task>
<Opcode>0</Opcode>
<Keywords>0x8000400000000004</Keywords>
<TimeCreated SystemTime="2016-02-06T02:02:03.935384200Z" />
<EventRecordID>33360</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="2344" />
<Channel>System</Channel>
<Computer>DESKTOP-69AQNQQ</Computer>
<Security />
</System>
- <EventData>
<Data Name="TargetState">2</Data>
<Data Name="EffectiveState">2</Data>
<Data Name="Reason">4</Data>
<Data Name="Flags">0</Data>
</EventData>
</Event>

The problem is that ProcessID="4" is always identified as SYSTEM. So that doesn't help much.

dc2000 said:

The problem is that ProcessID="4" is always identified as SYSTEM. So that doesn't help much.

You're right, I looked at this PC and 4 is simply "System".

You said sleep occurs "after a predictable amount of time". I can only suggest that you look at the Event Logs to see if this specific timing points you at an activity.

Since Event Viewer has numerous Windows logs in it, I have found it useful to create a Custom View selecting all Event Levels and and also checking "By log" both "Windows Logs" and also "Application and Service Logs" and limiting Logged to e.g. the last hour. Then it's of a manageable length.

I think too that once the Custom View has been created you can select Properties on the right and fine-tune the params as you see fit.

Thanks for the suggestion.

Change the power settings to put the computer to sleep...
...then change them back - as desired.

If that fails to prevent sleep, see if you can find the offending app via:
Troubleshoot Application Conflicts by Performing a Clean Startup