How to find what program is using SetThreadExecutionState to cause exit from Modern Standby?

My laptop has been exiting Modern Standby for unclear reasons. Network connectivity during standby is disabled and ability to wake from sleep is disabled for all devices in Device Manager.

Just had a situation where laptop was supposedly on sleep for 4 days, but it turns out it had exited standby 6 hours after entering. Event Viewer contained the following

2024-04-10 08:09:23 - Connectivity state in standby: Disconnected, Reason: Policy Setting
2024-04-10 14:08:29 - Connectivity state in standby: Connected, Reason: None
2024-04-10 14:08:32 - The system is exiting Modern Standby. Reason: SetThreadExecutionState.

Below are powercfg query results

powercfg /requests
DISPLAY:
None.

SYSTEM:
None.

AWAYMODE:
None.

EXECUTION:
None.

PERFBOOST:
None.

ACTIVELOCKSCREEN:
None.


powercfg /lastwake
Wake History Count - 0


powercfg sleepstudy for some reason doesn't show any meaningful data




Apparently some program is using SetThreadExecutionState and causing this. How to identify which?

This is all I know. Looks like you may of already done this though.

voldemarz said:

2024-04-10 14:08:29 - Connectivity state in standby: Connected

Click to expand...

That line seems, to me, to be the significant one.
Something must have the authority to change your type of S0 Modern standby state to connected standby.
I have never seen such a report before.
- Did Windows update start checking for updates?
- Did System maintenance start?



Denis

Try disabling network connectivity is modern standby first:


If that doesnt resolve:



Windows modern standby is awful. I would just disable it. Or do what I did and just use hibernate all the time to not deal with this problem. Hibernate is so fast now that is almost as quick as standby. And the laptop is actually off with everything saved as it is open.

andrew129260 said:

Try disabling network connectivity is modern standby first

Click to expand...

Andrew,

It already was. It's in the OP.

I used to hate S0 Modern standby ["S0ix"] as well but then I learnt to tame it.
Power consumption in S0 Modern standby and S3 Sleep - my post #85 - ElevenForum
Running scripts during S0 Modern standby - my post #86 - ElevenForum

Disabling S0 Modern standby - range of experiences - my post #8 - ElevenForum


All the best,
Denis

Try3 said:

Andrew,

It already was. It's in the OP.

Click to expand...

thanks, but based on the line

voldemarz said:

2024-04-10 14:08:29 - Connectivity state in standby: Connected

Click to expand...

I took that to mean it was not disabled properly. But maybe I am misunderstanding.

andrew129260 said:

maybe I am misunderstanding.

Click to expand...

And maybe you're not.
I have never before seen a report of that state being changed behind the user's back

voldemarz said:

2024-04-10 08:09:23 - Connectivity state in standby: Disconnected, Reason: Policy Setting
2024-04-10 14:08:29 - Connectivity state in standby: Connected, Reason: None

Click to expand...

and there's no resolution yet.
Changing to Connected standby might well be an undocumented capability of, say, Windows update but I would have thought lots of people would have reported about it if that was the case.
Investigations are made more difficult / impossible by Event viewer's insistence on referring to Connected standby all the time even when it's in Disconnected standby.


All the best,
Denis

Try3 said:

That line seems, to me, to be the significant one.
Something must have the authority to change your type of S0 Modern standby state to connected standby.
I have never seen such a report before.
- Did Windows update start checking for updates?
- Did System maintenance start?



Denis

Click to expand...

Oh.. Didn't get email notifications about thread updates, so I thought there was no activity.

Network connectivity is disabled during standby as visible also in event viewer logging "Reason: Policy Setting".

Windows Updates are configured via group policy "Configure Automatic Updates" to only notify. Download and install is only triggered by me.

Not sure about maintenance, don't see any signs of that. I have disabled \Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic scheduled task which tends to load PC when it is idling. What else maintenance related can I disable?

Wake timers are disabled btw.

@andrew129260 This machine doesn't support S3 sleep, so can't disable MS. Have tried and been cursing MS ever since.

I think this is caused some app that is using SetThreadExecutionState with ES_AWAYMODE_REQUIRED, e.g. by design.

This is what docs say:
Enables away mode. This value must be specified with ES_CONTINUOUS.
Away mode should be used only by media-recording and media-distribution applications that must perform critical background processing on desktop computers while the computer appears to be sleeping. See Remarks.

I don't have any media distro apps or anything similar installed and running in background.

voldemarz said:

I think this is caused some app that is using SetThreadExecutionState

Click to expand...

The change to Connected standby is being logged before that SetThreadExecutionState event.

voldemarz said:

Network connectivity is disabled during standby as visible also in event viewer logging "Reason: Policy Setting".

Click to expand...

Which event viewer record is that?
Log, Source, EventID


Denis

voldemarz said:

Windows Updates are configured via group policy "Configure Automatic Updates" to only notify. Download and install is only triggered by me.

Not sure about maintenance, don't see any signs of that. I have disabled \Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic scheduled task which tends to load PC when it is idling. What else maintenance related can I disable?

Click to expand...

What I asked was whether anything had started at the time your Disconnected state was changed to Connected.
I think it will only be by identifying what caused that change that you'll be able to resolve the incident.


All the best,
Denis

Try3 said:

The change to Connected standby is being logged before that SetThreadExecutionState event.

Click to expand...

I imagine this so because exit from MS is always logged as the first thing. Then you continue looking what happened next to cause it.

Try3 said:

Which event viewer record is that?
Log, Source, EventID


Denis

Click to expand...

Log: System
Source: Kernel-Power
EventID: 172

This wake event seems to happen about 6 hours after putting laptop to sleep. Today got these events:

2024-04-24 09:27:23 - Connectivity state in standby: Connected, Reason: None
2024-04-24 09:27:28 - Connectivity state in standby: Disconnected, Reason: Policy Setting
2024-04-24 09:27:28 - Connectivity state in standby: Connected, Reason: None
2024-04-24 09:27:28 - The system is exiting Modern Standby. Reason: SetThreadExecutionState.
2024-04-24 09:27:28 - The system session has transitioned from 9 to 10. Reason ScMonitorPower. BootId: 127

The laptop lid was close the whole time.

To troubleshoot MS issues, I have set up WPR to start a trace a when entering sleep and complete when signing in. However, I haven't been able to find anything useful there. If anyone is familiar with Windows Performance Analyzes, could take a look at one from today - Access via Synology

Try3 said:

What I asked was whether anything had started at the time your Disconnected state was changed to Connected.
I think it will only be by identifying what caused that change that you'll be able to resolve the incident.


All the best,
Denis

Click to expand...

Looking at EventViewer, nothing jumps out as the cause. Here are events from today from Application log.


2024-04-24 09:27:23 - Winlogon - 1002 - The shell stopped unexpectedly and explorer.exe was restarted.

2024-04-24 09:27:32 - Security-SPP - 16394 - Offline downlevel migration succeeded.

2024-04-24 09:27:33 - DSAService - 2003 - <DSAExceptionEvent xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="Intel | Data Center Solutions, IoT, and PC Innovation"><OS><Description>Windows 10 Pro</Description><Version>6.3</Version><Build>22631</Build><Release>2009</Release><EpmId>windows-11-23h2-64</EpmId></OS><DSAVersion>24.1.13.10</DSAVersion><Module>DSAServiceCore.dll</Module><ClassName>DSAServiceCore.Controllers.Session.PopulateSessionController</ClassName><MethodName>SetOemSupportDetails</MethodName><ExceptionType>UnknownOem</ExceptionType><Message>TUXEDO/NB02</Message></DSAExceptionEvent>

2024-04-24 09:27:37 - gupdate - 0 - The operation completed successfully.

2024-04-24 09:28:09 - Security-SPP - 16384 - Successfully scheduled Software Protection service for re-start at 2124-03-31T06:28:09Z. Reason: RulesEngine.

Have you looked at the Task scheduler opening screen Task status section to see if any TS Task times match?

You might prefer the chronological presentation of the same data by NirSoft Task Scheduler Viewer


Denis

Try3 said:

Have you looked at the Task scheduler opening screen Task status section to see if any TS Task times match?

You might prefer the chronological presentation of the same data by NirSoft Task Scheduler Viewer


Denis

Click to expand...

Mine wpr_start task may be the cause. it executed slightly after exit from MS and it had wake to run enabled for some reason. Disabled that.

The trigger for the task was Kernel-Power EventID 506 (The system is entering Modern Standby).




Not sure why would it execute at that time given that there was no event 506 around the time. Looking at the task settings also don't see what could have triggered this delayed execution.






Let's see what happens with "wake to run" disabled.

voldemarz said:

Log: System
Source: Kernel-Power
EventID: 172

Click to expand...

My S0ix computers also show changes between Disconnected & Connected standby even though I have not changed anything myself. I keep them set to Connected standby.
Entries are not made when entering or exiting S0ix. I don't know what triggers the entries being made.
Even if I had been experimenting on those dates but had forgotten about it [2 weeks ago on one computer, two months on another] some of the changed entries are only a couple of seconds apart so I would not have had time to change the settings, run PowerCfg -a to check the new setting then blank the display to put it into S0ix.
There's no match with Task scheduler records.
There's no match with entering or exiting S0ix: Log - System, Source -Kernel-Power, EventIDs 506 & 507. {My entries for exiting S0ix have the Reason: mouse or "50".

The Reason: for being in Disconnected standby is always NIC compliance.
The Reason: for being in Connected standby is always None.

I conclude that this EventID is not what it seems to be.

So I've been no help to you.
Does viewing Events chronologically using NirSoft FullEventLogView [not NirSoft MyEventViewer] show up any time matches?




Denis

I've only just seen your post #15.

You do not show the Trigger page in that task definition.
What is the wpr_start task? What is its Action?
I think you'll find it useful to enable task history [shown on the right-hand side of the TS window].

Personally, I'd suspect that Office task.
MS have never published a list of which of its utilities can rouse a computer from S0ix but they have mentioned Windows update as being one so I don't find it surprising that Office utilities would also have that ability.


Denis

That Office task description is
This task monitors the state of your Microsoft Office ClickToRunSvc and sends crash and error logs to Microsoft.
So I think it might be what is rousing your computer from S0ix.
The task does not have, or need, the Wake the computer property because rousing from S0ix is not the same.


Denis

Try3 said:

I've only just seen your post #15.

You do not show the Trigger page in that task definition.
What is the wpr_start task? What is its Action?
I think you'll find it useful to enable task history [shown on the right-hand side of the TS window].

Personally, I'd suspect that Office task.
MS have never published a list of which of its utilities can rouse a computer from S0ix but they have mentioned Windows update as being one so I don't find it surprising that Office utilities would also have that ability.


Denis

Click to expand...

wpr_start executes a batch script which contains "wpr -start Power"

Will try disabling Office task if laptop wakes after 6 hours of sleep. Just tackling one by one. Enabled all task history.

Tried looking with FullEventLogView.. There is a lot of stuff, but most of it of from Security Auditing. Weirdly much. What is also weird is that there are events logged at 8:52 today, about half an hour before machine exited MS.




A little offtopic:
Had put laptop to sleep. A while later noticed it is warm. Pinged from another machine. It was responding. Connected vie remote desktop connection. Here are events I saw from Kernel-Power source.

2024-04-24 13:55:56 - 566 - The system session has transitioned from 10 to 11. Reason FullWake BootId: 127

2024-04-24 13:55:56 - 506 - The system is entering Modern Standby. Reason: Screen Off Request.

2024-04-24 14:51:48 - 507 - The system is exiting Modern Standby. Reason: User Input.

2024-04-24 14:51:48 - 566 - The system session has transitioned from 11 to 13. Reason Lid. BootId: 127


The last two events seem to be caused by remote desktop connection. Weird that it mentions lid which was closed at the time. "powercfg /lastwake" reports not reason for wake. This whole Modern Standby crap is so dumb, a major waste of time.

voldemarz said:

Had put laptop to sleep

Click to expand...

There are different stages of S0ix [S0 Modern standby], different levels of idleness or inactivity.
If you use Power options, Sleep after or Start, Power, Sleep then it sends the computer into a later phase of S0ix which will prevent user-desired Task scheduler tasks from running.
So I never use those. I avoid them in order to keep it in a lighter S0ix phase that allows me to run things from TS. I've never seen any adverse effects. It does not even seem to make any difference to power consumption.

voldemarz said:

Will try disabling Office task if laptop wakes after 6 hours of sleep

Click to expand...

That will be interesting.
I cannot replicate your test because my only Office 2021 computer is a desktop without S0ix. My other computers, including my S0ix computers, use Office 2007 [because I dislike all the "improvements"made since that version].

voldemarz said:

What is also weird is that there are events logged at 8:52 today, about half an hour before machine exited MS.

Click to expand...

Things do run in S0ix. The problem is getting things we want to run. MS has provided for its own things already.
I start all my scripts run by TS with a dummy key press [a SendKeys function] that rouses my screen and thereby exists S0ix.
When the display is off, the computer is in S0ix. When the display is on, the computer is not in S0ix.

voldemarz said:

2024-04-24 13:55:56 - 566

Click to expand...

I don't know what that Event is.
I cannot see any mention of the lid. It mentions BootId.

voldemarz said:

"powercfg /lastwake" reports not reason for wake

Click to expand...

Rousing from S0ix is not waking. Only rousing from S3 Sleep or Hibernation is "waking".


Denis