Windows 10 randomly wakes up from hibernate with source unkown

I'm sorry. Should have mentioned that I had performed the queries you ask.

But here they are:

C:\WINDOWS\system32>powercfg /waketimers
There are no active wake timers in the system.

C:\WINDOWS\system32>powercfg /lastwake
Wake History Count - 1
Wake History [0]
  Wake Source Count - 0

C:\WINDOWS\system32>powercfg /devicequery wake_armed
NONE

C:\WINDOWS\system32>

I have added the event log from the last hibernation at 11:06:05 (

The system is entering sleep.

Sleep Reason: Application API)

till the just after the wake up (by source unknown) some 41 minutes later ( I was out at that time).

Power-Troubleshooter (

The system has returned from a low power state.

Sleep Time: ‎2015‎-‎09‎-‎26T09:06:03.979558300Z
Wake Time: ‎2015‎-‎09‎-‎26T09:47:42.934835100Z

Wake Source: Unknown)

Information 2015-09-26 12:00:00 EventLog 6013 None
Warning 2015-09-26 11:47:59 DNS Client Events 1014 (1014)
Information 2015-09-26 11:47:48 Power-Troubleshooter 1 None
Information 2015-09-26 11:47:44 BTHUSB 18 None
Information 2015-09-26 11:47:42 Kernel-Boot 27 None
Information 2015-09-26 11:47:42 Kernel-Boot 25 None
Information 2015-09-26 11:47:42 Kernel-Boot 32 None
Information 2015-09-26 11:47:42 Kernel-Boot 18 None
Information 2015-09-26 11:47:42 Kernel-Boot 30 None
Information 2015-09-26 11:47:42 MEIx64 2 None
Information 2015-09-26 11:47:42 Kernel-General 1 None
Information 2015-09-26 11:47:42 BROWSER 8033 None
Information 2015-09-26 11:06:05 Kernel-Power 42 (64)

To continue the tail:

Information 2015-09-29 09:57:51 Kernel-General 1 None
Information 2015-09-29 01:43:14 Kernel-Power 42 (64)
Information 2015-09-29 01:43:12 Power-Troubleshooter 1 None
Information 2015-09-29 01:43:07 BTHUSB 18 None
Information 2015-09-29 01:43:06 Kernel-Power 131 (33)
Information 2015-09-29 01:43:06 MEIx64 2 None
Information 2015-09-29 01:43:06 Kernel-General 1 None
Information 2015-09-29 01:43:06 BROWSER 8033 None
Information 2015-09-29 01:13:05 Kernel-Power 42 (64)
Error 2015-09-29 00:55:20 DistributedCOM 10010 None
Information 2015-09-29 00:43:04 Kernel-General 16 None
Information 2015-09-29 00:42:45 Power-Troubleshooter 1 None
Information 2015-09-29 00:42:41 BTHUSB 18 None
Information 2015-09-29 00:42:39 Kernel-Boot 27 None
Information 2015-09-29 00:42:39 Kernel-Boot 25 None
Information 2015-09-29 00:42:39 Kernel-Boot 32 None
Information 2015-09-29 00:42:39 Kernel-Boot 18 None
Information 2015-09-29 00:42:39 Kernel-Boot 30 None
Information 2015-09-29 00:42:39 MEIx64 2 None
Information 2015-09-29 00:42:39 Kernel-General 1 None
Information 2015-09-29 00:42:39 BROWSER 8033 None
Information 2015-09-28 18:54:40 Kernel-Power 42 (64)


I turned the PC off at (  2015-09-28 18:54:40 Kernel-Power Sleep Reason: Application API)
Then almost 6 hours later it woke up and and did a Kernel_General at 2015-09-29 00:43:04  an action with this:
"The access history in hive \??\C:\Users\Peter\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat was cleared updating 28 keys and creating 4 modified pages."

Then at 2015-09-29 01:43:14 Kernel-Power Sleep Reason: Hibernate from Sleep

I turned it on again at 2015-09-29 09:57:51.

I have set a sleep time of 30 minutes and hibernate of 30 minutes.

In my struggle to find the reason for these unpredictably wake-ups from hibernate I found in the event log
under Applications and Services Logs the Microsoft-Windows-Wcmsvc/Operational an entry with a time stamp coinciding with the wake up.
"
A Power change was processed. 

 Reason: A resume was triggered by user input"
Event-ID 1005
Now at that time I was fast asleep and all devices have the wake up disabled also in the BIOS. The only allowed 'input' is the power button which I (and to my knowledge nobody else) am having the sole possible access to ( and I did not activate it). Spooky!

Why is this not recorded as any other event? What/(who) set the trigger/event?

Also happening just seconds later Microsoft-Windows-WMI-Activity/Operational reports a number of events (error and information) IDs 5858 and 5857 like:
"Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = STUE-PC; User = NT AUTHORITY\SYSTEM; ClientProcessId = 1692; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\CIMV2 : ASSOCIATORS OF {Win32_Directory.Name='10.1.8.24Locale'} WHERE AssocClass = Win32_SubDirectory ResultRole = PartComponent; ResultCode = 0x80041002; PossibleCause = Unknown"

and
"WmiPerfClass provider started with result code 0x0. HostProcess = wmiprvse.exe; ProcessID = 1132; ProviderPath = C:\Windows\System32\wbem\WmiPerfClass.dll"

Turn off fast-start

In Win10, when you push the shutdown button, Win10 does not completely shut down it goes into a hibernated state loading things into memory so when you push start the pc comes to life faster

The only way a win10 completely shuts down is when the "restart" button is chosen BUT it just shuts the machine down for a few seconds and restarts it again

Win10 is so nosey, it feels the need to phone home at all hours in the day and night  to submit its information to the mothership.

not only that, but, putting your Laptop in a bag is VERY DANGEROUS , it will cook in its own juices due to fast start not truly shutting the machine off and you may wind up with a conglomerated lump of plastic and metal if the battery doesnt go dead very fast

Start/control panel/ power options

click "choose what the power button does" on left menu

then click "change settings that are currently unavailable" at top of page

uncheck " turn on fast startup" in the menu at bottom of page

reboot

Also...if you have turned off hibernation, fast start will be turned off also

...........dozerguy

Thanks will investigate the "turn on fast startup".

My machine is a small desktop.

In the Start menu the Power entry did not have the 'hibernate' option which I added (through settings).

I expected the Hibernate to be 'as it used to be' but something is happening 'behind the curtains'.

I use the Power->hibernate and then power button to cycle system off and on.

The "turn on fast startup" is unchecked.

I know I'm not the only one having this problem of unpredictable wake up from hibernation even though all scheduled tasks and devices have 'allow wake up' disabled.
So  who is activating the wake up and why? 
Wcmsvc ( Microsoft-Windows-Wcmsvc/Operational) seems to believe it to be "Reason: A resume was triggered by user input", but I know for a fact, that I did not initiate it (being either away or fast asleep).

Any clues?

Hi Peter,

Welcome to Microsoft Community and thank you for your interest in Windows.

I suggest you to follow the below methods and check if it helps.

Method 1: Use the hardware troubleshooter to fix the issue.

The Hardware Troubleshooter is an automated tool which will check the hardware connected to the computer for any known issues with it and provides the details and on how to fix them. Follow these steps and run the troubleshooter. Follow these steps:

1. Press Windows key to get the Start menu.
2. Type Troubleshooting in the search box right up corner and hit enter.
3. Click on Troubleshooting tab.
4. Click on view all option on the upper left corner.
5. Select the power options from the list.
6. Click Next to run the power Troubleshooter.

Method 2: Also I suggest you to create a new power plan and check if it helps.

1. Go to control panel and then click on power options.
2. Then click on create new power plan.
3. Change the power plan accordingly and check.

Hope this information was helpful and do let us know if you need further assistance. We will be glad to assist.

Hi

Thanks

1. There is no search box in right up corner when you get start menu, but there is a magnifying glass right to the Windows icon in the task bar, so I'll use that ;-)

2. That gives me Control Panel -> All Control Panel Items -> Troubleshooting (not a tab)

3. I click on  'View all' and select 'Power' and get: 'No changes or updates were necessary'

   and from the report I get 'Issue not present' for all potential issues that were checked.

4. So I conclude that no new power plan (or changed power plan) is necessary.

So thanks for you help but I'm not wiser. :-(

Last night just after having shut down (or hibernating the system) it woke up again.

I did not notice as I was off to bed, but as it can be seen, it chose to wake up approximately 11 min after.

From the event log 1 sec before: (Windows Logs -> System)

The browser has forced an election on network \Device\NetBT_Tcpip_{1D132B55-11F2-4ADD-9BFC-B7FA15789232} because a master browser was stopped.

Log Name:      System
Source:        BROWSER
Date:          2015-10-07 23:59:45
Event ID:      8033
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Stue-PC
Description:
The browser has forced an election on network \Device\NetBT_Tcpip_{1D132B55-11F2-4ADD-9BFC-B7FA15789232} because a master browser was stopped.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="BROWSER" />
    <EventID Qualifiers="16384">8033</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-10-07T21:59:45.000000000Z" />
    <EventRecordID>4327</EventRecordID>
    <Channel>System</Channel>
    <Computer>Stue-PC</Computer>
    <Security />
  </System>
  <EventData>
    <Data>\Device\NetBT_Tcpip_{1D132B55-11F2-4ADD-9BFC-B7FA15789232}</Data>
  </EventData>
</Event>

Then the only log entry that gives a reason ( but I did not trigger it ;-) ):

Log Name:      Microsoft-Windows-Wcmsvc/Operational
Source:        Microsoft-Windows-Wcmsvc
Date:          2015-10-07 23:59:46
Event ID:      1005
Task Category: None
Level:         Information
Keywords:      (32)
User:          LOCAL SERVICE
Computer:      Stue-PC
Description:
A Power change was processed. 

 Reason: A resume was triggered by user input
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wcmsvc" Guid="{67D07935-283A-4791-8F8D-FA9117F3E6F2}" />
    <EventID>1005</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000020</Keywords>
    <TimeCreated SystemTime="2015-10-07T21:59:46.185819100Z" />
    <EventRecordID>690</EventRecordID>
    <Correlation />
    <Execution ProcessID="540" ThreadID="4692" />
    <Channel>Microsoft-Windows-Wcmsvc/Operational</Channel>
    <Computer>Stue-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="Reason">7</Data>
  </EventData>
</Event>

Log Name:      Microsoft-Windows-Wcmsvc/Operational
Source:        Microsoft-Windows-Wcmsvc
Date:          2015-10-07 23:48:24
Event ID:      1005
Task Category: None
Level:         Information
Keywords:      (32)
User:          LOCAL SERVICE
Computer:      Stue-PC
Description:
A Power change was processed. 

 Reason: System is suspending operation
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wcmsvc" Guid="{67D07935-283A-4791-8F8D-FA9117F3E6F2}" />
    <EventID>1005</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000020</Keywords>
    <TimeCreated SystemTime="2015-10-07T21:48:24.727047600Z" />
    <EventRecordID>689</EventRecordID>
    <Correlation />
    <Execution ProcessID="540" ThreadID="6156" />
    <Channel>Microsoft-Windows-Wcmsvc/Operational</Channel>
    <Computer>Stue-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="Reason">4</Data>
  </EventData>
</Event>