<?xml version="1.0" encoding="utf-8" standalone="yes"?>Articles from November 2026 on PowerShell.org - Welcome Automaters!https://powershell.org/articles/2026/11/Recent content in Articles from November 2026 on PowerShell.org - Welcome Automaters!Hugoen-usFind What Wakes a Windows PC With Get-WinEventhttps://powershell.org/articles/2026/11/find-what-wakes-a-windows-pc-with-get-winevent/https://powershell.org/articles/2026/11/find-what-wakes-a-windows-pc-with-get-winevent/Tue, 03 Nov 2026 00:00:00 +0000<p>A PC that turns itself on at night leaves a record in the System log every time it does. Windows writes one event when the PC goes to sleep and another when it wakes up. The wake event names the device or timer that woke it.</p> <p>This article builds <code>Get-SleepWakeHistory</code>, a function that reads those two events with <code>Get-WinEvent</code>, pairs each sleep with its corresponding wake, and returns one row per sleep with how long the PC slept, why it went to sleep, and what woke it. It then lists the two things Windows allows to wake a PC on its own, scheduled tasks with &ldquo;Wake the computer to run this task&rdquo; turned on and devices that are armed to wake it.</p><![CDATA[

A PC that turns itself on at night leaves a record in the System log every time it does. Windows writes one event when the PC goes to sleep and another when it wakes up. The wake event names the device or timer that woke it.

This article buildsGet-SleepWakeHistory, a function that reads those two events withGet-WinEvent, pairs each sleep with its corresponding wake, and returns one row per sleep with how long the PC slept, why it went to sleep, and what woke it. It then lists the two things Windows allows to wake a PC on its own, scheduled tasks with “Wake the computer to run this task” turned on and devices that are armed to wake it.

Everything here was run with Windows PowerShell 5.1 and PowerShell 7.6 on Windows 11 builds 26200 and 26300.

The two events

1234567
$e = (Get-WinEvent -ListProvider Microsoft-Windows-Power-Troubleshooter).Events | Where-Object Id-eq1 | Sort-Object Version | Select-Object -Last1'Version ' +$e.Version([xml]$e.Template).template.data.name -join', '
12
Version 3SleepTime, WakeTime, SleepDuration, WakeDuration, DriverInitDuration, BiosInitDuration, HiberWriteDuration, HiberReadDuration, HiberPagesWritten, Attributes, TargetState, EffectiveState, WakeSourceType, WakeSourceTextLength, WakeSourceText, WakeTimerOwnerLength, WakeTimerContextLength, NoMultiStageResumeReason, WakeTimerOwner, WakeTimerContext, CheckpointDuration

 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99100101102103104105106107108109
functionGet-SleepWakeHistory {<# .SYNOPSIS Lists each sleep and wake on a Windows PC with the sleep reason and the wake source. .DESCRIPTION Reads Kernel-Power event 42 (entering sleep) and Power-Troubleshooter event 1 (resumed from sleep) from the System log, pairs each wake with its corresponding sleep event, and returns one object per sleep. .PARAMETER Days How many days back to read. .PARAMETER ComputerName The computer to read. Reading a remote computer's log needs the Remote Event Log Management firewall rules enabled on that computer. .EXAMPLE Get-SleepWakeHistory -Days 14 | Format-Table -AutoSize .EXAMPLE Get-SleepWakeHistory | Where-Object WakeSource -notmatch 'Power Button' #> [CmdletBinding()] [OutputType([pscustomobject])]param( [ValidateRange(1,365)] [int]$Days =7, [string]$ComputerName =$env:COMPUTERNAME )# Reason codes on Kernel-Power event 42.$sleepReasons =@{0 ='Button or lid'2 ='Battery'4 ='Application API'6 ='Hibernate from sleep (fixed timeout)'7 ='System idle'13 ='Hibernate from sleep (standby battery budget exceeded)' }# Turns an event's EventData into a hashtable keyed by field name.$readData = {param($Record)$data =@{}foreach ($fieldin ([xml]$Record.ToXml()).Event.EventData.Data) {$data[$field.Name] =$field.'#text' }$data }$since = (Get-Date).AddDays(-$Days)$filter =@(@{ LogName ='System'; ProviderName ='Microsoft-Windows-Kernel-Power'; Id =42; StartTime =$since }@{ LogName ='System'; ProviderName ='Microsoft-Windows-Power-Troubleshooter'; Id =1; StartTime =$since } )try {$events = Get-WinEvent -FilterHashtable$filter -ComputerName$ComputerName -ErrorAction Stop }catch {if ($_.FullyQualifiedErrorId-like'NoMatchingEventsFound*') { Write-Verbose"No sleep or wake events on$ComputerName in the last$Days days."return }throw }$sleeps =@($events | Where-Object Id-eq42 | Sort-Object TimeCreated)$wakes =@($events | Where-Object Id-eq1 | Sort-Object TimeCreated)foreach ($wakein$wakes) {$w = &$readData$wake$sleptAt = [datetimeoffset]::Parse($w.SleepTime).LocalDateTime$wokeAt = [datetimeoffset]::Parse($w.WakeTime).LocalDateTime# Event 42 is written within seconds of the SleepTime that event 1 records, so take the closest one.$entry =$sleeps | Where-Object {$_.TimeCreated-ge$sleptAt.AddMinutes(-2)-and$_.TimeCreated-le$sleptAt.AddMinutes(1) } | Sort-Object { [math]::Abs(($_.TimeCreated -$sleptAt).TotalSeconds) } | Select-Object -First1$reason ='No event 42 found'if ($entry) {$raw = (&$readData$entry).Reasonif ($null-eq$raw) {$reason ='Unknown' }else {$code = [int]$raw$reason =if ($sleepReasons.ContainsKey($code)) {$sleepReasons[$code] }else {"Code$code" } } }$source =$w.WakeSourceTextif ([string]::IsNullOrWhiteSpace($source)) {$source ='Unknown' } [pscustomobject]@{ ComputerName =$ComputerName Slept =$sleptAt Woke =$wokeAt Asleep = [datetimeoffset]::Parse($w.WakeTime) - [datetimeoffset]::Parse($w.SleepTime) SleepReason =$reason WakeSource =$source WakeTimer =$w.WakeTimerOwner } }}

1
Get-SleepWakeHistory

 1 2 3 4 5 6 7 8 9101112131415
ComputerName : LAPTOPSlept : 10/30/2026 11:46:51 AMWoke : 10/31/2026 7:30:54 PMAsleep : 1.07:44:03.2633699SleepReason : Hibernate from sleep (standby battery budget exceeded)WakeSource : UnknownWakeTimer :ComputerName : LAPTOPSlept : 11/1/2026 4:55:49 PMWoke : 11/2/2026 7:11:14 AMAsleep : 14:15:25.4508261SleepReason : BatteryWakeSource : UnknownWakeTimer :

1234567
ComputerName : LAPTOPSlept : 11/3/2026 7:59:43 AMWoke : 11/3/2026 8:03:24 AMAsleep : 00:03:40.8647018SleepReason : Application APIWakeSource : Windows will execute 'NT TASK\WakeTest' scheduled task that requested waking the computer.WakeTimer : \Device\HarddiskVolume3\Windows\System32\svchost.exe

1234567
ComputerName : DESKTOPSlept : 11/3/2026 7:28:41 AMWoke : 11/3/2026 7:28:55 AMAsleep : 00:00:14.4626736SleepReason : Application APIWakeSource : PCI Express Root PortWakeTimer :

123456789
Wake History Count - 1Wake History [0] Wake Source Count - 1 Wake Source [0] Type: Device Instance Path: PCI\VEN_1022&DEV_14DB&SUBSYS_14531022&REV_00\3&11583659&0&11 Friendly Name: Description: PCI Express Root Port Manufacturer: (Standard system devices)

123
Get-ScheduledTask | Where-Object {$_.Settings.WakeToRun } | Select-Object TaskPath, TaskName, State
12345678
TaskPath TaskName State-------- -------- -----\Microsoft\Windows\.NET Framework\ .NET Framework NGEN v4.0.30319 64 Critical Disabled\Microsoft\Windows\.NET Framework\ .NET Framework NGEN v4.0.30319 Critical Disabled\Microsoft\Windows\InstallService\ WakeUpAndContinueUpdates Disabled\Microsoft\Windows\InstallService\ WakeUpAndScanForUpdates Disabled\Microsoft\Windows\SharedPC\ Account Cleanup Disabled\Microsoft\Windows\UpdateOrchestrator\ Schedule Wake To Work Disabled

1
There are no active wake timers in the system.

123456
$action = New-ScheduledTaskAction -Execute'cmd.exe' -Argument'/c echo woke >> C:\Windows\Temp\WakeTest.txt'$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(4)$settings = New-ScheduledTaskSettingsSet -WakeToRunRegister-ScheduledTask -TaskName'WakeTest' -Action$action -Trigger$trigger -Settings$settings -User'SYSTEM'powercfg /waketimers
12
Timer set by [SERVICE] \Device\HarddiskVolume3\Windows\System32\svchost.exe (SystemEventsBroker) expires at 7:31:25 AM on 11/3/2026. Reason: Windows will execute 'NT TASK\WakeTest' scheduled task that requested waking the computer.

1
powercfg /devicequery wake_armed
123456789
HID-compliant mouseRealtek USB GbE Family ControllerUSB4 Root Router (1.0)HID Keyboard Device (004)Realtek 8922AE WiFi 7 PCI-E NICRealtek Gaming 2.5GbE Family ControllerHID-compliant mouse (004)HID Keyboard Device (009)HID Keyboard Device (012)

12345
$task = Get-ScheduledTask -TaskName'WakeTest'$task.Settings.WakeToRun =$false$task | Set-ScheduledTask | Out-Null(Get-ScheduledTask -TaskName'WakeTest').Settings.WakeToRun
1
False

123
$device ='Realtek 8922AE WiFi 7 PCI-E NIC'powercfg /devicedisablewake$device(powercfg /devicequery wake_armed)-contains$device
1
False

 1 2 3 4 5 6 7 8 910
Get-WinEvent -FilterHashtable@{ LogName ='System' ProviderName ='Microsoft-Windows-Kernel-Power' Id =507 StartTime = (Get-Date).AddDays(-7)} | ForEach-Object { ($_.Message -split [Environment]::NewLine | Where-Object {$_-match'^Reason' }) -join'' } | Group-Object | Sort-Object Count -Descending | Select-Object Count, Name
123456789
Count Name----- ---- 19 Reason: Power Button. 14 Reason: 16777220. 5 Reason: Austerity Battery Drain Budget Exceeded. 3 Reason: AC/DC Display Burst Suppressed. 2 Reason: Resume from Hibernate. 1 Reason: AC/DC Display Burst. 1 Reason: Sleep, Hibernate, or Shutdown.

1
powercfg /q SCHEME_CURRENT SUB_SLEEP RTCWAKE
12
 Current AC Power Setting Index: 0x00000002 Current DC Power Setting Index: 0x00000000

12
(Get-ScheduledTask -TaskName'WakeTest').Settings | Select-Object WakeToRun, DisallowStartIfOnBatteries, StopIfGoingOnBatteries