Question One Network PC Now Keeps "Ghost Booting." Is it Synology?

[Terry]

I have recently added both a Synology DS1019+ and a new PC to my network. I am now experiencing my older computer spontaneously booting up from a totally shut down state. WOL is disabled in this machine's BIOS.
Could Synology be causing this and, if so, how do I stop it from happening?

 

[jeyare]

CLI (fastrack):

powercfg -waketimers

You can get information like this

Timer set by [SERVICE] \Device\HarddiskVolume5\Windows\System32\svchost.exe (Sys
temEventsBroker) expires at 3:25:17 on 15.6.2020.
  Reason: Windows will execute 'NT TASK\Microsoft\Windows\TaskScheduler\Regular
Maintenance' scheduled task that requested waking the computer.

Detailed info you can get from your Win Event viewer:
1. Select “Windows log” - from left folder pane
2. Select “System”
3. Find Date and time range of expected computer Woke up (or use filter from right pane or Create Custom view )
then you will see in:
A. Level column - (mostly) Information level
B. Source column - (mostly) Power troubleshooter, sometimes Kernel power (use filter for both sources)
then you can read in General/Details pane information searched = source of the computer wake up

Then system can show you information like this:

The system has returned from a low power state.

Sleep Time: ‎2020‎-‎06‎-‎11T18:46:07.507252500Z
Wake Time: ‎2020‎-‎06‎-‎12T01:57:21.223876400Z

Wake Source: Timer - Windows will execute 'NT TASK\Microsoft\Windows\TaskScheduler\Regular Maintenance' scheduled task that requested waking the computer.

Then you will find an answer for your question.

 

[jeyare]

btw, when you need to know how many Scheduled task do you have (or your OS/SW/firmware configured itself) opened you can use command from CLI with export to CSV file.

schtasks /query /v /fo CSV > tasks.csv

the file you will find in folder:
C:\Windows\system32\

now it's the time for a cleaning your OS

 

[Terry]

CLI (fastrack):

powercfg -waketimers

You can get information like this

Timer set by [SERVICE] \Device\HarddiskVolume5\Windows\System32\svchost.exe (Sys
temEventsBroker) expires at 3:25:17 on 15.6.2020.
  Reason: Windows will execute 'NT TASK\Microsoft\Windows\TaskScheduler\Regular
Maintenance' scheduled task that requested waking the computer.

Detailed info you can get from your Win Event viewer:
1. Select “Windows log” - from left folder pane
2. Select “System”
3. Find Date and time range of expected computer Woke up (or use filter from right pane or Create Custom view )
then you will see in:
A. Level column - (mostly) Information level
B. Source column - (mostly) Power troubleshooter, sometimes Kernel power (use filter for both sources)
then you can read in General/Details pane information searched = source of the computer wake up

Then system can show you information like this:

The system has returned from a low power state.

Sleep Time: ‎2020‎-‎06‎-‎11T18:46:07.507252500Z
Wake Time: ‎2020‎-‎06‎-‎12T01:57:21.223876400Z

Wake Source: Timer - Windows will execute 'NT TASK\Microsoft\Windows\TaskScheduler\Regular Maintenance' scheduled task that requested waking the computer.

Then you will find an answer for your question.

Many thanks, Jeyare, but I am in over my head. I got so far as the attached Event Viewer screen shot but am not competent to interpret what it is telling me. In the interim, I have set Wake on Pattern Match for the network to disabled in Device Manager. Hoping that works. Time will tell.
Apparently, whatever I am experiencing is unrelated to the recently installed Synology 1019+?

 

[jeyare]

reason of your Wake up needs to be evaluate in the computer site first.

you need send here a screenshot from the CLI result = powercfg command
then again (strictly as was requested by me)
Find/Filter
then
Source column - (mostly) Power troubleshooter .... as was recommended
then make a screenshot

 

[Terry]

Still stumbling about here . . .
Seems the system is waking from a shutdown state (not "sleeping" or "hibernating) to do Windows updates? I have never had this happen before?
Hope the following screenshots are what you requested . . .

 

[Telos]

@Terry I suggest you take this to tenforums.com to get a broader experience base w/Windows.

You're certainly welcome here in any case.

 

[jeyare]

Thx for the screenshot from Event viewer (just one details from 3 records found and requested by me).
Help - as you can see in the Details pane, there is clickable submenu “+System” ... hidden in the screenshot and “+EventData” chosen by you only in the screenshot.

From the “powercfg” command screenshot:
You have scheduled two wake ups
1. Defined by regular Windows Backup task - this is OS native task. You can switch off this task.

2. Defined by regular system part task - Start menu experience host - this is OS native task. You can switch off this task.

For the undefined wake, you can use this command (in time of wake up):

powercfg -lastwake

it will show you the event source e.g. if the wake up was initialized by your NIC or by your hidden SW components.

Last:
- it’s possible that you have WOL events defined by your OS/SW components only
- then you need clean this “mess” by Task scheduler
- there is only possible way for WOL event from the NAS side requested - Syno Active backup scheduled task.

 

[jeyare]

when you can lay with the "cleaning" you can also use in Power Shell:

Get-ScheduledTask | where {$_.settings.waketorun}

When you are not experienced with the action - how to clean unwanted Win Task cleaning, you can use this guide

 

[Terry]

Thank you both, jeyare and Telos. I think I am on the right track now. I have disabled wake timers and the machine has remained silent since I did so. If it does not "take" and the next update just re-enables them, I will have to go further and follow the guide jeyare has linked to.
Again, thank-you both.
-Terry-