Pick the check that matches what you saw

  1. It just woke up

    powercfg /lastwake

    Read the source Windows recorded for the latest wake before putting the PC back to sleep.

  2. It woke earlier

    Event Viewer → Windows Logs → System → Event ID 1

    Match the event to the time you noticed the wake, even if someone has woken the PC again since.

  3. It never slept

    powercfg /requests

    Check for apps or drivers currently asking Windows to keep the PC or display awake.

  4. Screen off, battery down

    powercfg /a → SleepStudy on S0

    Check whether the laptop uses Modern Standby, then inspect the idle session and its energy use.

Capture the last wake before changing any settings

Open Windows Terminal as administrator and run the first line below. Use the other two commands to check current permissions and timers if you need more clues. Microsoft documents what each Powercfg command reports.

powercfg /lastwake
powercfg /devicequery wake_armed
powercfg /waketimers

Write down the approximate wake time, whether the charger was connected, and the source as Windows named it. If /lastwake gives you a generic USB controller or filter driver, keep the name as a clue. Several physical devices can sit behind a controller, and the result may stop at the driver rather than identifying the input that triggered it.

Real Powercfg output displayed in Windows Notepad. Lastwake reports an ELAN I2C filter driver, wake_armed returns NONE, and powercfg /a shows S0 Low Power Idle.

Captured on one Windows 11 laptop. The hardware instance identifier was omitted from the transcript.

On the laptop shown here, /lastwake gave a device source and named the ELAN I2C Filter Driver. The separate wake_armed query returned NONE. Those results can coexist: one command reports a recorded event, while the other lists devices currently configured to wake the system. This capture leaves the physical input that triggered the wake unresolved. It gives you a reason to read the historical record before toggling settings.

Find an older wake in Event Viewer

  1. Open Event Viewer from Start. Expand Windows Logs and select System.
  2. Choose Filter Current Log. Select Power-Troubleshooter as the source and enter 1 in the event ID field.
  3. Open the entry closest to the time you wrote down. In General, compare the sleep time, wake time and wake source. If you see Unknown, keep the timestamp and continue investigating with a controlled test.

On the same laptop, the System log contained three recent entries from the Microsoft-Windows-Power-Troubleshooter provider with event ID 1 and a wake-source field. A log can tell you what was recorded for a specific time even after the latest wake has changed. If no entry matches, keep the cause open. On a Modern Standby laptop with the screen off throughout, use SleepStudy for the idle interval.

Change one thing and try to reproduce the wake

If a device is implicated: when the suspected device is an external mouse, unplug that one device for the next comparable sleep period. Keep the charger and other peripherals in the same state. If the wake returns only after you reconnect the mouse, you have a stronger reason to change its wake permission. Keep a way to wake the PC, such as the power button.

If the wake happens at a repeatable time: run powercfg /waketimers before that time. The list is a snapshot of active timers, so a timer that fired earlier may have disappeared. If the command names a scheduled task, compare its time with the System log. Then open the matching task in Task Scheduler → Conditions and look for Wake the computer to run this task. For a task you own and can safely defer, test changing that single option. Preserve unattended jobs you rely on.

If the PC never slept: run powercfg /requests while the symptom is happening. If it names an app you can close safely, close it and run the command again. Then test sleep once more. An empty list means the command found no active request at that moment. It leaves earlier activity and other causes open.

Check Modern Standby when the screen stayed off

Run powercfg /a. If it lists Standby (S0 Low Power Idle), open an elevated PowerShell tab and create a local SleepStudy report.

$report = Join-Path $env:TEMP 'pmd-sleepstudy.html'
powercfg /sleepstudy /output $report
if ($LASTEXITCODE -eq 0) { Invoke-Item $report }

Find the session covering the interval when the laptop sat idle. Check the Screen Off and Sleep sections, the energy change and the activity listed for that session. Compare the battery run with another run under the same conditions. A different power source or a disconnected dock can change the comparison. A busy component in the report gives you something to test even if the display never lit up. Microsoft explains the SleepStudy session breakdown and how to read it.

After each test, record the time, the single thing you changed and whether the symptom repeated. That small record lets you undo an ineffective change and compare the next result with the original wake.