How to find what program is using SetThreadExecutionState to cause exit from Modern Standby?

voldemarz · Apr 24, 2024

Yeah, I know that machine is not "really" sleeping during Modern Standby, just in various low power states. All this execution of task during sleep is so broken, making it pointless on laptops. It basically remains idle and often draining 5% per hour. There should be a way to disable all this smartness.

So, the laptop again did this thing with waking and doing something with the lid closed. The first thing it did after waking was some Office related task.

Just went ahead and disabled that, the one mentioned in previous post and 2 other updates related office tasks.

\Microsoft\Office\Office Automatic Updates 2.0
\Microsoft\Office\Office ClickToRun Service Monitor
\Microsoft\Office\Office Feature Updates
\Microsoft\Office\Office Feature Updates Logon

Also went ahead and disabled all tasks which had "wake to run" enabled.

\Microsoft\Windows\InstallService\WakeUpAndScanForUpdates
\Microsoft\Windows\InstallService\WakeUpAndContinueUpdates
\Microsoft\Windows\SharedPC\Account Cleanup
\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical
\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical

voldemarz · Apr 24, 2024

Feels like the laptop didn't like me creating the thread and started being even more annoying with MS. Now it just doesn't go to sleep. Screen goes black, but fans remain running, and it is responding to pings. Clearly awake.

Try3 · Apr 24, 2024

voldemarz said:
Screen goes black

So you are in S0ix.

voldemarz said:
fans remain running

Yes, they do their job as normal.

voldemarz said:
it is responding to pings

Yes, as it ought to with Connected standby.

voldemarz said:
Clearly awake

No such concept applies.
S0ix is an idle condition not a sleep state.

You can see records of transitions between power states in Event viewer if you want.
You can check transitions between power-sleep states using the built-in utility Event viewer [eventvwr.msc] by setting up an Event viewer, Custom view that lists them.
You can import the Power - S0ix-S3Sleep-Hibernate transitions Custom view I use to monitor transitions between S0 Modern standby [S0ix], S3 Sleep & Hibernate.
This Custom view definition works in both Win10 & Win11 and in both S3 Sleep computers & S0 Modern standby computers.

Here is the [zipped] definition for an Event viewer, Custom view that captures power-sleep state transitions.
Event viewer, Custom view definitions are exported as & hence imported from xml files.
Zipped Custom view definition attached - Power - S0ix-S3Sleep-Hibernate transitions.zip
You can unzip it then, before importing it, read the Power - S0ix-S3Sleep-Hibernate transitions.xml file in Notepad or, for a better presentation of its contents, by right-clicking and opening in a browser.

To import it:
1 Unzip the file
2 Open Event viewer, click on Import Custom view [on the right-hand side],
3 Browse to and select the xml file then Open,
4 Change the name if you want to then OK,
5 You can see the records, in Event viewer's left-hand pane, within the group Custom views. It often takes a few seconds to populate the results.
6 Whenever I investigate something using Event viewer, I always write down the time shown by the computer's clock when I see that something happen [before even looking at Event viewer] so I can always be sure what it is that I'm looking at in Event viewer later on. This becomes increasingly important the more test runs are involved in whatever it is that I'm investigating.

Display Turn Off in Power Options Causing USB Disconnection-power-s0ix-s3sleep-hibernate-transitions.png

Note 1 Distinguishing between resuming from S3 Sleep & Hibernation
When reviewing power state transitions, note that S3 Sleep & Hibernation events can only be distinguished, in a computer that has both, by looking at the Details tab of the resume EventID 1 for Hiber* entries that are greater than 0; resuming from S3 Sleep would show Hiber* entries that have the value 0
Resume from Hibernate, Details tab

Resume from S3 Sleep, Details tab

Note 2 Incorrectly labelled S0 Modern standby events
On a similarly confusing note, S0 Modern standby event records are misleadingly labelled as relating to S0 Connected standby whichever state is in force - Connected/Disconnected standby.
I appreciate that you are working on an S3 Sleep computer at the moment.

Note 3 Sharing Event viewer, Custom view definitions between computers
You can generally export an Event viewer, Custom view definition on one computer and import it on another.
The only exception I know of is that Administrative events Custom view you can see at the top of my first diagram. If I deliberately created a Custom view that included hardware-specific properties then that would also be an exception.
- That Administrative events view definition lists all events so can be useful if I want to see everything in chronological order.
- That Administrative events view definition contains hardware-specific properties that differ between computers. They can also differ if hardware is swapped on a single computer.
- That Administrative events view definition is not filterable. If you try filtering it, the filter options are all greyed out. This really hinders investigations.
When I want to set up a filterable version of it on a new computer and again when I change hardware, I create a filterable version of it by:-
3.1 Deleting any previous filterable version I had created.
3.2 Right-clicking on the Administrative events Custom view then Exporting it.
3.3 Renaming the xml file to something like Administrative events - Filterable.
3.4 Importing the Administrative events - Filterable xml file and using the xml file name as the Custom view name.
That imported version enables Event viewer's Filter Current Custom View control on the right-hand side of its window.
I last changed mine when I changed WiFi adapter and started using a USB LAN adapter at about the same time. I do not know if either of them makes any difference to the results shown in that view but there would have been nothing to warn me of potentially significant events being missing during an investigation if I had not re-created the filterable view.

Best of luck,
Denis

Try3 · Apr 24, 2024

I have had an S0ix computer for six years.
I only learnt to work with S0ix decently just under a year ago - see

Try3 said:
Power consumption in S0 Modern standby and S3 Sleep - my post #85 - ElevenForum
Running scripts during S0 Modern standby - my post #86 - ElevenForum

Denis

voldemarz · Apr 24, 2024

Try3 said:
Yes, as it ought to with Connected standby.

But it should be disabled.

Try3 said:
No such concept applies.
S0ix is an idle condition not a sleep state.

User facing name is "sleep", so that's how I am calling it. S0ix it too techy and Modern Standby is an insult to the word "modern". Basically want it to behave as dumb suspend-to-RAM.

Try3 said:
Here is the [zipped] definition for an Event viewer, Custom view that captures power-sleep state transitions.
Event viewer, Custom view definitions are exported as & hence imported from xml files.
Power - S0ix-S3Sleep-Hibernate transitions.zip

Am signed it, but can't access. I am know it's a different forum.

Try3 · Apr 24, 2024

voldemarz said:
it should be disabled.

In that case, you seem to have a Windows defect.
SFC and/or Repair install might help but I'm just speculating.

Denis

Try3 · Apr 24, 2024

voldemarz said:
Basically want it to behave as dumb suspend-to-RAM

It is not a suspend at all.
The computer remains on.

Denis

Try3 · Apr 24, 2024

voldemarz said:
Am signed it, but can't access. I am know it's a different forum.

Attached.

Denis

voldemarz · Apr 24, 2024

Try3 said:
In that case, you seem to have a Windows defect.
SFC and/or Repair install might help but I'm just speculating.

Denis

Or it is one of many Microsoft bugs

Try3 said:
It is not a suspend at all.
The computer remains on.

Denis

You debating over semantics. I am saying I want to behave like dumb suspend-to-RAM without any smartness, hence disabled network connectivity, wake timers etc.