Insomniac Computers

[freelancer91]

Both my desktop and my laptop are insomniacs. I have wake on lan configured on the desktop, but I only want the machine to wake up when I send the magic packet. I have set it that way in the network adapter settings, and still it will turn on at random times. I have checked the BIOS to make sure that nothing is causing it to turn on there. I have checked the power settings to make sure that the wake timer turned off. I have gone into Windows Media Center to make sure that it will not wake up my computer to update constantly.

I then decided top go into command prompt on both computers to see what is causing them to wake up. I typed in "powercfg -lastwake" on both computers and it said that the last wake on my desktop was caused by the USB root hub. I went into the device manager and checked all of the USB root hubs to make sure that the device was allowed to turn off to save power. I did not see any of them with the setting that allows the device to wake the computer on.

On my laptop it said that the last wake was caused by the power button. the only problem with this is that the event viewer says that it woke up at 4 in the morning while I was fast asleep. The event viewer confirmed what powercfg had said. The laptop is closed and nothing could cause the power button to become depressed while it is closed. What is causing my laptop to turn on?

As for the desktop, I am waiting to see if changing the USB root hub settings will have any effect.

Does anyone have any other possibilities was to what might be causing my computers to wake up?

 

[harpua]

Well one thing you could check if you haven't already is, in device manager, network adapter, properties, power management, make sure the box, allow this device to wake the computer is unchecked.

Also, sometimes Windows Update will wake the computer. Changing the default time Win Update runs to during the daytime may help with that.

 

[freelancer91]

Ok I think I figured it out on my desktop. It was a matter of going into the mouse and keyboard device settings and disabling their ability to wake my computer. For some reason, even though they were receiving no input, they were still sending a wake signal to the computer. It hasn't turned on since then. As for the laptop, I will look into it.

 

[H2SO4]

Ok I think I figured it out on my desktop. It was a matter of going into the mouse and keyboard device settings and disabling their ability to wake my computer. For some reason, even though they were receiving no input, they were still sending a wake signal to the computer. It hasn't turned on since then. As for the laptop, I will look into it.

At least one of the "boilerplate" driver code samples (which demonstrates how to manage power transition events in a driver) uses the power button as the "source" of the wakeup event. Third-party device driver manufacturers sometimes don't realise they should change that source when building their own drivers. The unfortunate result is that the information is not always accurate.

===========================================
And a story which might make you feel better about your own predicament...

Very Large Corporation "X" brings in specialised help to fix their problem - hundreds or even thousands of their clients (winXP at the time) regularly stay awake during the night for reasons unknown. Management is worried about the massive power bills, and their in-house security team has gone even more grey because it's in their suspicious nature to assume the entire head office has been pwned by Kyrgyzstani 13 year-olds.

What's really giving the security guys conniptions is the correlation between the events which keep the machines awake. Virtually the entire building worth of PCs registers something within a minute of each other (XP had rudimentary logging in this area), though not all at the precise same second, leading to fears of some sort of worm-like software behaviour which is looked for with logging, packet sniffers, perfmon process logs... and there's nothing there.

So eventually it comes down to trains of the "choo choo" variety. At night, the heaviest of heavy freight trains ply routes which take them through the underground complex below the building. The sustained vibrations are enough to cause some or all of the mice to register movement. The quick-and-dirty solution was a memo to all staff reminding them to turn their (all optical) mice upside down before they leave for the day.

 

[freelancer91]

I'm wondering if that was like what was causing it with the desktop. I noticed that one time it turned on exactly at the same time as the refrigerator in our dorm room clicked on. Whenever that happens, it makes a sorta loud clacking sound and then the thing starts whirring. I thought that the mouse would only cause the computer to turn on when it was clicked though. I don't know. Either way, the desktop has stopped doing it now.

As for the laptop, is there any way to figure out which program I have might be doing this? The laptop is not connected to the internet at the time so it is not a packet form an outside source causing it (I don't even think my laptops NIC supports that kind of thing anyway).

 

[H2SO4]

As for the laptop, is there any way to figure out which program I have might be doing this? The laptop is not connected to the internet at the time so it is not a packet form an outside source causing it (I don't even think my laptops NIC supports that kind of thing anyway).

It's software, so anything is possible, but it's a b**** to do in-depth logging of the OS mechanisms for wakefulness and power transitions.

What you said about the desktop and the fridge made me think about power fluctuations though - perhaps the link is not mechanical.

Does the laptop do the same thing if you let it sit for a while at a completely different location and plugged into a different powerpoint? Heck, does it happen even when it's not plugged in at all - completely air-gapped from ethernet, wireless NIC deactivated, and just sleeping on a full battery?

 

[freelancer91]

The laptop does it in the middle of the night. I have it plugged into a surge protector (not the same one as the fridge) and it turns on.

Here is the event log from right before it turned off my laptop last night until right after it turned on this morning.

Log Name: System
Source: Microsoft-Windows-Power-Troubleshooter
Date: 9/21/2009 5:37:52 AM
Event ID: 1
Task Category: None
Level: Information
Keywords:
User: LOCAL SERVICE
Computer: MilleniumFalcon
Description:
The system has resumed from sleep.

Sleep Time: ‎2009‎-‎09‎-‎21T04:37:37.769800000Z
Wake Time: ‎2009‎-‎09‎-‎21T10:37:42.638800000Z

Wake Source: Power Button
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{CDC05E28-C449-49C6-B9D2-88CF761644DF}" />
<EventID>1</EventID>
<Version>1</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:52.482400000Z" />
<EventRecordID>12006</EventRecordID>
<Correlation ActivityID="{3D06B95B-59A5-43D1-85CA-E433CC2B4225}" />
<Execution ProcessID="1708" ThreadID="6776" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="SleepTime">2009-09-21T04:37:37.769800000Z</Data>
<Data Name="WakeTime">2009-09-21T10:37:42.638800000Z</Data>
<Data Name="SleepDuration">4457</Data>
<Data Name="WakeDuration">1125</Data>
<Data Name="DriverInitDuration">533</Data>
<Data Name="BiosInitDuration">959</Data>
<Data Name="HiberWriteDuration">0</Data>
<Data Name="HiberReadDuration">0</Data>
<Data Name="HiberPagesWritten">0</Data>
<Data Name="Attributes">18464</Data>
<Data Name="TargetState">4</Data>
<Data Name="EffectiveState">4</Data>
<Data Name="WakeSourceType">1</Data>
<Data Name="WakeSourceTextLength">0</Data>
<Data Name="WakeSourceText">
</Data>
<Data Name="WakeTimerOwnerLength">0</Data>
<Data Name="WakeTimerContextLength">0</Data>
<Data Name="WakeTimerOwner">
</Data>
<Data Name="WakeTimerContext">
</Data>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/21/2009 5:37:51 AM
Event ID: 7040
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: MilleniumFalcon
Description:
The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7040</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:51.562000000Z" />
<EventRecordID>12005</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="6176" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="param1">Background Intelligent Transfer Service</Data>
<Data Name="param2">demand start</Data>
<Data Name="param3">auto start</Data>
<Data Name="param4">BITS</Data>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/21/2009 5:37:43 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The DNS Client service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:43.044400000Z" />
<EventRecordID>12004</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="6176" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">DNS Client</Data>
<Data Name="param2">running</Data>
<Binary>44006E007300630061006300680065002F0034000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/21/2009 5:37:42 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The DNS Client service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:42.997600000Z" />
<EventRecordID>12003</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="1028" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">DNS Client</Data>
<Data Name="param2">stopped</Data>
<Binary>44006E007300630061006300680065002F0031000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/21/2009 5:37:42 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The Windows Image Acquisition (WIA) service entered the running state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:42.342400000Z" />
<EventRecordID>12002</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="6900" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Windows Image Acquisition (WIA)</Data>
<Data Name="param2">running</Data>
<Binary>7300740069007300760063002F0034000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/21/2009 5:37:42 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The Multimedia Class Scheduler service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:42.077200000Z" />
<EventRecordID>12001</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="6420" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Multimedia Class Scheduler</Data>
<Data Name="param2">stopped</Data>
<Binary>4D004D004300530053002F0031000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/21/2009 5:37:42 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The Application Experience service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:42.014800000Z" />
<EventRecordID>12000</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="6876" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Application Experience</Data>
<Data Name="param2">stopped</Data>
<Binary>410065004C006F006F006B00750070005300760063002F0031000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-Kernel-General
Date: 9/21/2009 5:37:41 AM
Event ID: 1
Task Category: None
Level: Information
Keywords: Time
User: N/A
Computer: MilleniumFalcon
Description:
The system time has changed to ‎2009‎-‎09‎-‎21T10:37:41.500000000Z from ‎2009‎-‎09‎-‎21T04:37:42.231400000Z.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-General" Guid="{A68CA8B7-004F-D7B6-A698-07E2DE0F1F5D}" />
<EventID>1</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2009-09-21T10:37:41.500000000Z" />
<EventRecordID>11999</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="48" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="NewTime">2009-09-21T10:37:41.500000000Z</Data>
<Data Name="OldTime">2009-09-21T04:37:42.231400000Z</Data>
</EventData>
</Event>

Log Name: System
Source: Microsoft-Windows-Kernel-Power
Date: 9/20/2009 11:37:39 PM
Event ID: 42
Task Category: (64)
Level: Information
Keywords: (4)
User: N/A
Computer: MilleniumFalcon
Description:
The system is entering sleep.

Sleep Reason: Button or Lid
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
<EventID>42</EventID>
<Version>2</Version>
<Level>4</Level>
<Task>64</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000004</Keywords>
<TimeCreated SystemTime="2009-09-21T04:37:39.470200000Z" />
<EventRecordID>11998</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="48" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetState">4</Data>
<Data Name="EffectiveState">4</Data>
<Data Name="Reason">0</Data>
<Data Name="Flags">4</Data>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/20/2009 11:37:39 PM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The Windows Image Acquisition (WIA) service entered the paused state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T04:37:39.033400000Z" />
<EventRecordID>11997</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="4672" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Windows Image Acquisition (WIA)</Data>
<Data Name="param2">paused</Data>
<Binary>7300740069007300760063002F0037000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/20/2009 11:37:11 PM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MilleniumFalcon
Description:
The Computer Browser service entered the stopped state.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T04:37:11.093800000Z" />
<EventRecordID>11996</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="4672" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Computer Browser</Data>
<Data Name="param2">stopped</Data>
<Binary>420072006F0077007300650072002F0031000000</Binary>
</EventData>
</Event>

Log Name: System
Source: Service Control Manager
Date: 9/20/2009 11:37:11 PM
Event ID: 7042
Task Category: None
Level: Information
Keywords: Classic
User: SYSTEM
Computer: MilleniumFalcon
Description:
The Computer Browser service was successfully sent a stop control.

The reason specified was: 0x40030011 [Operating System: Network Connectivity (Planned)]

Comment: None
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7042</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2009-09-21T04:37:11.093800000Z" />
<EventRecordID>11995</EventRecordID>
<Correlation />
<Execution ProcessID="592" ThreadID="6876" />
<Channel>System</Channel>
<Computer>MilleniumFalcon</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="param1">Computer Browser</Data>
<Data Name="param2">stop</Data>
<Data Name="param3">0x40030011</Data>
<Data Name="param4">Operating System: Network Connectivity (Planned)</Data>
<Data Name="param5">None</Data>
</EventData>
</Event>

 

[foxballz]

freelancer91

I also have the same problem you are having with my Dell Studio (14z) laptop. It wakes up on its own randomly (last time was 3AM). I checked the event viewer too and it was the same useless info about the power button. I have the NIC's ability to wake the device turned off as well as USB. It happens when the lid is closed and it is only running on battery which results in my coming back to the computer to find it dead.

Did you make any progress diagnosing this?

Perhaps it is a Dell Studio "feature"?

-Aaron

Dell Studio 14Z, Win7 Home Premium

 

[jfar]

Just a thought, but Windows Automatic Update is set to run at 3 in the morning on my machine,
maybe that is what is waking up your machine also.

 

[freelancer91]

For my desktop, the cause of the problem ended up being the mouse and keyboard. For whatever reason, they were spontaneously waking the system without me telling it to. Just go into device manager and check those devices to see if wake is enabled on them. The weird part is that I have since rebuilt my machine (both of them) and the problem has never reoccurred.

 

[foxballz]

Yes it does look like WinUpdate checks at 3AM but there is no way to configure this other then turn it off. As far as I can tell I have only been suffering this insomniac problem for the last couple weeks but I can't think of anything I have installed or tweaked that could have cause it. I have had WinUpdate on automatic check for months.

Does anyone know how I can tell what is waking the computer? Even if I stay up all night I probably wouldn't be able to tell.

-Aaron

 

[Frostmourne]

Ensure your network adaptor is set in device manager to not wake up the PC, and then disable the option to wake with the keyboard in the BIOS. Then watch the mouse.