How to find what program is using SetThreadExecutionState to cause exit from Modern Standby?


voldemarz

Member
Local time
6:32 AM
Posts
13
OS
Windwos 11 Pro
My laptop has been exiting Modern Standby for unclear reasons. Network connectivity during standby is disabled and ability to wake from sleep is disabled for all devices in Device Manager.

Just had a situation where laptop was supposedly on sleep for 4 days, but it turns out it had exited standby 6 hours after entering. Event Viewer contained the following

2024-04-10 08:09:23 - Connectivity state in standby: Disconnected, Reason: Policy Setting
2024-04-10 14:08:29 - Connectivity state in standby: Connected, Reason: None
2024-04-10 14:08:32 - The system is exiting Modern Standby. Reason: SetThreadExecutionState.

Below are powercfg query results

powercfg /requests
DISPLAY:
None.

SYSTEM:
None.

AWAYMODE:
None.

EXECUTION:
None.

PERFBOOST:
None.

ACTIVELOCKSCREEN:
None.


powercfg /lastwake
Wake History Count - 0


powercfg sleepstudy for some reason doesn't show any meaningful data

1713131499144.png


Apparently some program is using SetThreadExecutionState and causing this. How to identify which?
 

My Computer

System One

  • OS
    Windwos 11 Pro

This is all I know. Looks like you may of already done this though.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro 23H2 Build: 22631.3593
    Computer type
    PC/Desktop
    Manufacturer/Model
    Sin-built
    CPU
    Intel(R) Core(TM) i7-4770K CPU @ 3.50GHz (4th Gen?)
    Motherboard
    ASUS ROG Maximus VI Formula
    Memory
    32.0 GB of I forget and the box is in storage.
    Graphics Card(s)
    Gigabyte nVidia GeForce GTX 1660 Super OC 6GB
    Sound Card
    Onboard
    Monitor(s) Displays
    4 x LG 23MP75 1 x 24" LG M38H 1 x 32" LF6300 TV Monitor 1 x Wacom Pro 22" Tablet
    Screen Resolution
    All over the place
    Hard Drives
    2 x WD something Something 8TB HDD's / 2 x WD something Something 4TB HDD's / 1 x EVO 1TB SSD / 2 x QVO 1TB SSD's / 1 x EVO 250 GB SSD / 2 x QVO 1TB (External Hub) / 1 x EVO 1TB (Portable Backup Case)
    PSU
    Silverstone 1500
    Case
    NZXT Phantom 820 Full-Tower Case
    Cooling
    Noctua NH-D15 Elite Class Dual Tower CPU Cooler / 6 x EziDIY 120mm / 2 x Corsair 140mm somethings / 1 x 140mm Thermaltake something / 2 x 200mm Corsair.
    Keyboard
    Corsair K95 / Logitech diNovo Edge Wireless
    Mouse
    Logitech G402 / G502 / Mx Masters / MX Air Cordless
    Internet Speed
    100/40Mbps
    Browser
    All sorts
    Antivirus
    Kaspersky Premium
    Other Info
    I’m on a horse.
  • Operating System
    Windows 11 Pro 22621.2215
    Computer type
    Laptop
    Manufacturer/Model
    LENOVO Yoga 7i EVO OLED 14" Touchscreen i5 12 Core 16GB/512GB
    CPU
    Intel Core 12th Gen i5-1240P Processor (1.7 - 4.4GHz)
    Memory
    16GB LPDDR5 RAM
    Graphics card(s)
    Graphics processor is an Intel Iris Xe
    Sound Card
    optimized with Dolby Atmos®
    Screen Resolution
    QHD 2880 x 1800 OLED
    Hard Drives
    M.2 512GB
    Other Info
    …still on a horse.
2024-04-10 14:08:29 - Connectivity state in standby: Connected
That line seems, to me, to be the significant one.
Something must have the authority to change your type of S0 Modern standby state to connected standby.
I have never seen such a report before.
- Did Windows update start checking for updates?
- Did System maintenance start?



Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
Try disabling network connectivity is modern standby first:


If that doesnt resolve:



Windows modern standby is awful. I would just disable it. Or do what I did and just use hibernate all the time to not deal with this problem. Hibernate is so fast now that is almost as quick as standby. And the laptop is actually off with everything saved as it is open.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell G15 5525
    CPU
    Ryzen 7 6800H
    Memory
    32 GB DDR5 4800mhz
    Graphics Card(s)
    RTX 3050 4GB Vram
    Screen Resolution
    1920 x 1080
    Hard Drives
    2TB Solidigm™ P41 Plus nvme
    Internet Speed
    800mbps down, 20 up
  • Operating System
    Windows 11
    Computer type
    Tablet
    Manufacturer/Model
    Lenovo ideapad flex 14API 2 in 1
    CPU
    Ryzen 5 3500u
    Motherboard
    LENOVO LNVNB161216 (FP5)
    Memory
    12GB DDR4
    Graphics card(s)
    AMD Radeon Vega 8 Graphics
    Hard Drives
    256 GB Samsung ssd nvme

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447

My Computers

System One System Two

  • OS
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Dell G15 5525
    CPU
    Ryzen 7 6800H
    Memory
    32 GB DDR5 4800mhz
    Graphics Card(s)
    RTX 3050 4GB Vram
    Screen Resolution
    1920 x 1080
    Hard Drives
    2TB Solidigm™ P41 Plus nvme
    Internet Speed
    800mbps down, 20 up
  • Operating System
    Windows 11
    Computer type
    Tablet
    Manufacturer/Model
    Lenovo ideapad flex 14API 2 in 1
    CPU
    Ryzen 5 3500u
    Motherboard
    LENOVO LNVNB161216 (FP5)
    Memory
    12GB DDR4
    Graphics card(s)
    AMD Radeon Vega 8 Graphics
    Hard Drives
    256 GB Samsung ssd nvme
maybe I am misunderstanding.
And maybe you're not.
I have never before seen a report of that state being changed behind the user's back
2024-04-10 08:09:23 - Connectivity state in standby: Disconnected, Reason: Policy Setting
2024-04-10 14:08:29 - Connectivity state in standby: Connected, Reason: None
and there's no resolution yet.
Changing to Connected standby might well be an undocumented capability of, say, Windows update but I would have thought lots of people would have reported about it if that was the case.
Investigations are made more difficult / impossible by Event viewer's insistence on referring to Connected standby all the time even when it's in Disconnected standby.


All the best,
Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
That line seems, to me, to be the significant one.
Something must have the authority to change your type of S0 Modern standby state to connected standby.
I have never seen such a report before.
- Did Windows update start checking for updates?
- Did System maintenance start?



Denis

Oh.. Didn't get email notifications about thread updates, so I thought there was no activity.

Network connectivity is disabled during standby as visible also in event viewer logging "Reason: Policy Setting".

Windows Updates are configured via group policy "Configure Automatic Updates" to only notify. Download and install is only triggered by me.

Not sure about maintenance, don't see any signs of that. I have disabled \Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic scheduled task which tends to load PC when it is idling. What else maintenance related can I disable?

Wake timers are disabled btw.

@andrew129260 This machine doesn't support S3 sleep, so can't disable MS. Have tried and been cursing MS ever since.
 

My Computer

System One

  • OS
    Windwos 11 Pro
I think this is caused some app that is using SetThreadExecutionState with ES_AWAYMODE_REQUIRED, e.g. by design.

This is what docs say:
Enables away mode. This value must be specified with ES_CONTINUOUS.
Away mode should be used only by media-recording and media-distribution applications that must perform critical background processing on desktop computers while the computer appears to be sleeping. See Remarks.

I don't have any media distro apps or anything similar installed and running in background.
 

My Computer

System One

  • OS
    Windwos 11 Pro

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
Windows Updates are configured via group policy "Configure Automatic Updates" to only notify. Download and install is only triggered by me.

Not sure about maintenance, don't see any signs of that. I have disabled \Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic scheduled task which tends to load PC when it is idling. What else maintenance related can I disable?

What I asked was whether anything had started at the time your Disconnected state was changed to Connected.
I think it will only be by identifying what caused that change that you'll be able to resolve the incident.


All the best,
Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
The change to Connected standby is being logged before that SetThreadExecutionState event.

I imagine this so because exit from MS is always logged as the first thing. Then you continue looking what happened next to cause it.

Which event viewer record is that?
Log, Source, EventID


Denis

Log: System
Source: Kernel-Power
EventID: 172

This wake event seems to happen about 6 hours after putting laptop to sleep. Today got these events:

2024-04-24 09:27:23 - Connectivity state in standby: Connected, Reason: None
2024-04-24 09:27:28 - Connectivity state in standby: Disconnected, Reason: Policy Setting
2024-04-24 09:27:28 - Connectivity state in standby: Connected, Reason: None
2024-04-24 09:27:28 - The system is exiting Modern Standby. Reason: SetThreadExecutionState.
2024-04-24 09:27:28 - The system session has transitioned from 9 to 10. Reason ScMonitorPower. BootId: 127

The laptop lid was close the whole time.

To troubleshoot MS issues, I have set up WPR to start a trace a when entering sleep and complete when signing in. However, I haven't been able to find anything useful there. If anyone is familiar with Windows Performance Analyzes, could take a look at one from today - Access via Synology
 

My Computer

System One

  • OS
    Windwos 11 Pro
What I asked was whether anything had started at the time your Disconnected state was changed to Connected.
I think it will only be by identifying what caused that change that you'll be able to resolve the incident.


All the best,
Denis

Looking at EventViewer, nothing jumps out as the cause. Here are events from today from Application log.


2024-04-24 09:27:23 - Winlogon - 1002 - The shell stopped unexpectedly and explorer.exe was restarted.

2024-04-24 09:27:32 - Security-SPP - 16394 - Offline downlevel migration succeeded.

2024-04-24 09:27:33 - DSAService - 2003 - <DSAExceptionEvent xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="Intel | Data Center Solutions, IoT, and PC Innovation"><OS><Description>Windows 10 Pro</Description><Version>6.3</Version><Build>22631</Build><Release>2009</Release><EpmId>windows-11-23h2-64</EpmId></OS><DSAVersion>24.1.13.10</DSAVersion><Module>DSAServiceCore.dll</Module><ClassName>DSAServiceCore.Controllers.Session.PopulateSessionController</ClassName><MethodName>SetOemSupportDetails</MethodName><ExceptionType>UnknownOem</ExceptionType><Message>TUXEDO/NB02</Message></DSAExceptionEvent>

2024-04-24 09:27:37 - gupdate - 0 - The operation completed successfully.

2024-04-24 09:28:09 - Security-SPP - 16384 - Successfully scheduled Software Protection service for re-start at 2124-03-31T06:28:09Z. Reason: RulesEngine.
 

My Computer

System One

  • OS
    Windwos 11 Pro
Have you looked at the Task scheduler opening screen Task status section to see if any TS Task times match?
TS, task status pane.png
You might prefer the chronological presentation of the same data by NirSoft Task Scheduler Viewer


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
Have you looked at the Task scheduler opening screen Task status section to see if any TS Task times match?

You might prefer the chronological presentation of the same data by NirSoft Task Scheduler Viewer


Denis

Mine wpr_start task may be the cause. it executed slightly after exit from MS and it had wake to run enabled for some reason. Disabled that.

The trigger for the task was Kernel-Power EventID 506 (The system is entering Modern Standby).


1713955200320.png

Not sure why would it execute at that time given that there was no event 506 around the time. Looking at the task settings also don't see what could have triggered this delayed execution.

1713955751038.png

1713955727303.png


Let's see what happens with "wake to run" disabled.
 

Attachments

  • 1713955423978.png
    1713955423978.png
    15.1 KB · Views: 1

My Computer

System One

  • OS
    Windwos 11 Pro
Log: System
Source: Kernel-Power
EventID: 172

My S0ix computers also show changes between Disconnected & Connected standby even though I have not changed anything myself. I keep them set to Connected standby.
Entries are not made when entering or exiting S0ix. I don't know what triggers the entries being made.
Even if I had been experimenting on those dates but had forgotten about it [2 weeks ago on one computer, two months on another] some of the changed entries are only a couple of seconds apart so I would not have had time to change the settings, run PowerCfg -a to check the new setting then blank the display to put it into S0ix.
There's no match with Task scheduler records.
There's no match with entering or exiting S0ix: Log - System, Source -Kernel-Power, EventIDs 506 & 507. {My entries for exiting S0ix have the Reason: mouse or "50".

The Reason: for being in Disconnected standby is always NIC compliance.
The Reason: for being in Connected standby is always None.

I conclude that this EventID is not what it seems to be.

So I've been no help to you.
Does viewing Events chronologically using NirSoft FullEventLogView [not NirSoft MyEventViewer] show up any time matches?




Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
I've only just seen your post #15.

You do not show the Trigger page in that task definition.
What is the wpr_start task? What is its Action?
I think you'll find it useful to enable task history [shown on the right-hand side of the TS window].

Personally, I'd suspect that Office task.
MS have never published a list of which of its utilities can rouse a computer from S0ix but they have mentioned Windows update as being one so I don't find it surprising that Office utilities would also have that ability.


Denis
 
Last edited:

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
That Office task description is
This task monitors the state of your Microsoft Office ClickToRunSvc and sends crash and error logs to Microsoft.
So I think it might be what is rousing your computer from S0ix.
The task does not have, or need, the Wake the computer property because rousing from S0ix is not the same.


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447
I've only just seen your post #15.

You do not show the Trigger page in that task definition.
What is the wpr_start task? What is its Action?
I think you'll find it useful to enable task history [shown on the right-hand side of the TS window].

Personally, I'd suspect that Office task.
MS have never published a list of which of its utilities can rouse a computer from S0ix but they have mentioned Windows update as being one so I don't find it surprising that Office utilities would also have that ability.


Denis
wpr_start executes a batch script which contains "wpr -start Power"

Will try disabling Office task if laptop wakes after 6 hours of sleep. Just tackling one by one. Enabled all task history.

Tried looking with FullEventLogView.. There is a lot of stuff, but most of it of from Security Auditing. Weirdly much. What is also weird is that there are events logged at 8:52 today, about half an hour before machine exited MS.

1713961142686.png


A little offtopic:
Had put laptop to sleep. A while later noticed it is warm. Pinged from another machine. It was responding. Connected vie remote desktop connection. Here are events I saw from Kernel-Power source.

2024-04-24 13:55:56 - 566 - The system session has transitioned from 10 to 11. Reason FullWake BootId: 127

2024-04-24 13:55:56 - 506 - The system is entering Modern Standby. Reason: Screen Off Request.

2024-04-24 14:51:48 - 507 - The system is exiting Modern Standby. Reason: User Input.

2024-04-24 14:51:48 - 566 - The system session has transitioned from 11 to 13. Reason Lid. BootId: 127


The last two events seem to be caused by remote desktop connection. Weird that it mentions lid which was closed at the time. "powercfg /lastwake" reports not reason for wake. This whole Modern Standby crap is so dumb, a major waste of time.
 

Attachments

  • 1713960315758.png
    1713960315758.png
    17.4 KB · Views: 1
  • 1713961056214.png
    1713961056214.png
    89.4 KB · Views: 1

My Computer

System One

  • OS
    Windwos 11 Pro
Had put laptop to sleep
There are different stages of S0ix [S0 Modern standby], different levels of idleness or inactivity.
If you use Power options, Sleep after or Start, Power, Sleep then it sends the computer into a later phase of S0ix which will prevent user-desired Task scheduler tasks from running.
So I never use those. I avoid them in order to keep it in a lighter S0ix phase that allows me to run things from TS. I've never seen any adverse effects. It does not even seem to make any difference to power consumption.

Will try disabling Office task if laptop wakes after 6 hours of sleep
That will be interesting.
I cannot replicate your test because my only Office 2021 computer is a desktop without S0ix. My other computers, including my S0ix computers, use Office 2007 [because I dislike all the "improvements"made since that version].

What is also weird is that there are events logged at 8:52 today, about half an hour before machine exited MS.
Things do run in S0ix. The problem is getting things we want to run. MS has provided for its own things already.
I start all my scripts run by TS with a dummy key press [a SendKeys function] that rouses my screen and thereby exists S0ix.
When the display is off, the computer is in S0ix. When the display is on, the computer is not in S0ix.

2024-04-24 13:55:56 - 566
I don't know what that Event is.
I cannot see any mention of the lid. It mentions BootId.

"powercfg /lastwake" reports not reason for wake
Rousing from S0ix is not waking. Only rousing from S3 Sleep or Hibernation is "waking".


Denis
 

My Computer

System One

  • OS
    Windows 11 Home x64 Version 23H2 Build 22631.3447

Latest Support Threads

Back
Top Bottom