Windows – Laptop randomly waking up = Hibernate / Low Battery

A (Windows 7) laptop has been annoying me since the day we got it. When it is put to sleep (the lid closed), it seems to intermittently wake up randomly during the night (i.e., 10pm, 1:30am, 7am, etc.) There are plenty of people experiencing this, but I have done several tests and made numerous observations to provide as much information here as possible to diagnose the problem.

When the laptop wakes up in the middle of the night, several telling observations can be made:

• It stays on for approximately 20-50 seconds (more than a few, less than a lot)
• The screen remains off (completely, not just the back-light)
• The hard-drive is thrashed the whole time (HD LED is nearly solid)
• The DVD drive spins up and whirs loudly for ~5-10 seconds if there is a disc in it
• Windows is active (the PnP bing-bong noise is played if a drive/keyboard/etc. was removed or plugged in after the system was put to sleep)
• (Unconfirmed: pressing a key—if enabled—won’t turn it on next time; must use the power-button)
• The next time the system is turned on, there is no indication of the previous, random activity (using powercfg -lastwake returns a Wake History and Wake Source Count of 0)

Other observations include:

• Does not seem to happen when Windows is shut down or hibernated, only when put to sleep (e.g., lid closed)
• There are countless tasks in the Task Scheduler in Windows 7, but a quick scan seems to indicate that none are responsible (though I have enabled the history to keep track)
• (I keep trying to catch it to press a key to get the screen to show to see what is happening, but it always seems to happen at an inopportune moment and shuts down before I get the chance)

• As Mark suggested, I checked the Event Log and found a set of events that are the best clue yet:

  6:51:37pm The system is entering sleep.
            Sleep Reason: Button or Lid
  6:51:42am The system time has changed to ‎2012‎-‎08‎-‎21T10:51:42.500000000Z from ‎2012‎-‎08‎-‎20T22:51:39.080510600Z.
  6:51:42am-6:51:47am Six services were stopped…
  6:51:47am The system has resumed from sleep.
            Sleep Time: ‎2012‎-‎08‎-‎21T10:51:46.021150600Z
            Wake Time: ‎2012‎-‎08‎-‎21T10:51:44.010053500Z
            Wake Source: S4 Doze to Hibernate
  6:51:55am The system is entering sleep.
            Sleep Reason: Hibernate from Sleep
  

What it’s not:

• Windows update : WU is set to only check, not download and do so at noon (not randomly)
• Wake-on-LAN : WoL and Magic-Packet are both disabled in Device Manager, there is no option in the BIOS, and cable-modem is turned off at night
• Devices : All keyboards, mice, NICs are set to not wake the system (powercfg -devicequery wake_armed returns an empty list)
• Malware : This is a new system with up-to-date Windows updates and active MSSE with the latest defs, plus careful browsing with the latest Chrome and no files that are even the least bit questionable

I have two theories as to what it could be:

1. Hybrid sleep

   In Windows Vista and up, hybrid sleep lets the system first sleep (suspend to RAM), then after some time, flush the memory to disk to hibernate. This may make sense in that the laptop is sleeping, and then eventually switches to hibernation, so it wakes up to flush the memory to disk.

   This could work since instead of going straight into Windwos, the BIOS POSTs and Windows “Resumes”. However, it should transition from sleep to hibernation at the same time, not randomly. Moreover, this particular laptop does not have hybrid sleep enabled.

   Can anyone confirm how (at a low level) if hybrid sleep works like this?

2. Low battery

   When a laptop’s battery is too low, Windows automatically hibernates (of course Windows does this before the battery is too low so that it has enough power left to perform the hibernation). When it does this, the hard-drive thrashes for a few dozen seconds and then shuts down. This seems to match the behavior of the laptop when it wakes up randomly, especially since the battery can reach the drained-point at a seemingly random time.

   The problem with this theory is that when the system is turned on after having awaken randomly, it does not print the message about Windows having shut down due to a low battery like it does whenever it hibernates due to a low battery while it is running.

   Further, it implies that Windows is active and processing (to some extent) while it is sleeping or even when it should already be off/hibernating.

   Can anyone confirm if Windows is active and monitoring battery levels while “off”?

Based on the events, it looks like updating the system time is normal whenever the system turns on, so it’s not that, but it is clearly transitioning from sleep to hibernation at twelve hours after it went to sleep. This is baffling for three reasons:

• The current setting is to hibernate after three hours on battery and six hours when plugged in for the Balanced and Power Saver plans (four hours and not at all with the High Performance plan). The Power Saver plan is in effect and it was unplugged this morning when it happened
• Hybrid-sleep is disabled in every power plan
• powercfg has no record of it happening

Does anyone know why Windows would wake up randomly and exhibit the above symptoms or why the power plan settings seem to be incorrect?

There are a lot of people experiencing laptops (of all makes and models) randomly turning on in the middle of the night. Unfortunately most of them get the same set of responses which rarely seem to fix the issue.

Some notable ones include:

• This question that seems to be the same issue with a couple of the observations I have made above.
• This question seems to have the same issue, but with Linux.
• This question lead me to turn off the keyboards/mice in case the touchpad sensitivity is set too low, but it still does it.
• This thread points at sleep-timers, but they are already disabled.