Solved System Reboots After Morning Startup

The cause of the morning crash is precisely Fast Startup in Windows. Because of this, the morning startup is technically a "wake from kernel hibernation." At this point, the WD NVMe drive driver recovers faster than the Intel PTT (TPM 2.0) security chip can process the encryption keys, which triggers Failure Reason 4 and the subsequent automatic reboot.

Disable Fast Startup in Windows. Have you tried it?
And more. Try shutting down your PC tonight while holding down the Shift key (hold Shift and click "Shut Down" in the Start menu). This will perform a clean shutdown. If the crash doesn't occur tomorrow morning, disabling Fast Startup will solve the problem.

Lavik: did the shift/shutdown this evening. Didn’t know about it and I can see the difference. Will do a boot tomorrow morning and launch no apps. Will wait for the WD update to run before doing anything with the system.

@Jamis: why does this only happen in the morning.

* Cold boot vs. reboot: When you first turn on your PC in the morning, the system goes through a full initialization from scratch (Cold Boot). During this process, the Microsoft Pluton secure coprocessor or TPM 2.0 module initializes simultaneously with the SSD controller (WD NVMe). If the power timings or initialization phases don't match at this point, a conflict occurs, and the Pluton firmware returns a Failure Reason 4 error (usually indicating a response timeout or device initialization failure).

* Fast Startup state: Windows has Fast Startup enabled by default. When you turn off your PC overnight, the system doesn't completely shut down, but saves the kernel and drivers to a system file (kernel hibernation). In the morning, Windows attempts to quickly restore this state, which often results in the secure components (Pluton/TPM) and the drive drivers becoming out of sync.

* Subsequent reboots: When the system crashes to a blue screen (BSOD) or reboots automatically, a so-called "warm boot" occurs. Power is not removed from the components; they are already initialized at the hardware level and are active. Therefore, a subsequent attempt to load the Pluton firmware is successful.

Don't know what is going on, but here's the scenario from the last two days
8/8 - Shutdown w/ shift key.

8/9 - 8:14A Cold boot from power off.
8:28A WD update
10:53A unchecked the Fast Startup option.
11:13A WU/WD update. w/no errors.
11:15A shutdown from Start options.
11:57A Cold boot w/fast start up still off.
9:48P Shutdown from Start options.

8/10 - 8:122 Cold boot from power off.
10:12A WU/WD update.
11:02A Bug Check and auto restart.
Still going to let this ride until 26H2 and hoping something changes.

This problem repeats no matter how the system is shut down and always occurs after a WD update. The bug check mini dumps always point to the Pluton/TPM connection issue. Seems like the MS and the HP Envy firmware don’t match up, so this issue will have to continue until one of the companies corrects the timing problem. My normal operation will be to shutdown with the shift key pressed, not run any apps after cold start boot until the system reboots from the bug check, after which the system runs normally. Closing this thread.

@Jamis , i didn't pay attention. And in vain.
That platform requires an AMD Ryzen CPU or Qualcomm Snapdragon, or a series 2 Intel core (Arrow Lake) CPU. Your system uses a series Alder Lake CPU, so it won't support Pluton.

Lavik said:

@Jamis , i didn't pay attention. And in vain.
That platform requires an AMD Ryzen CPU or Qualcomm Snapdragon, or a series 2 Intel core (Arrow Lake) CPU. Your system uses a series Alder Lake CPU, so it won't support Pluton.

Microsoft Pluton security processor

Learn more about Microsoft Pluton security processor

learn.microsoft.com

Click to expand...

And yet, Windows Defender tries to connect with the unsupported code/hardware, which has worked perfectly since March of 2023. I had read the MS article you linked before. I guess we wait for MS to correct the problem. Thanks for the explanation.

@Jamis Disable the Ghost Cryptographic Provider via Registry
Since the system is looking for a non-existent hardware component, you can force Windows to stop initializing the Microsoft Pluton Cryptographic Provider module.

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Providers
3. Look for the key (folder) named Microsoft Pluton Cryptographic Provider.
4. To safely disable it without deleting it entirely, right-click the folder, select Rename, and add a suffix to its name (e.g., rename it to Microsoft Pluton Cryptographic Provider_BAK).
5. Restart your PC.

The BSOD error 0139 continues. The system is cold booted in the morning, Windows Defender update runs some time afterwards, and a short time after that update finishes, the BSOD happens. After restart, the system runs normally even with multiple WD updates during the day. I finally had time to look at the mini-dumps and they all point to Npfs.sys crashing and causing the BSOD. I ran sfc /scannow with no errors found. Ran dism /online /Cleanup-Image /restoreHealth and it ran to successful completion. chkdsk C: /f /r ran to completion with no issues. The system did a BSOD this morning like normal. I hope the 26H2 update fixes this issue. it's a bit of an annoyance having to sigh on twice each day.

open task manager and on the left click 'startup'

please disable anything/everything that has been added to the 'startup' menu
then see if the system stays on at boot without the restart happening.

you can then enable one by one the programs in the startup menu
this is to see if one of them is causing this restart problem.

best of luck Steve ..

Nice try. Disabled all tasks and the BSOD occured as before. It appears Npfs.sys is corrupted and I will wait until W11 is updated by 26H2 to see if it gets replaced then.