question

HansvanderAa-7773 avatar image
0 Votes"
HansvanderAa-7773 asked Spigolo-3573 answered

system boots unexpected

Every evening at 22:00 a backup is made, after the backup the following command is issued : "shutdown /f /s". So the system is down.
In one night every 2 weeks at 3:00 the system is booted. Unattended
What could be the reason of the boot?

windows-10-general
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Spigolo-3573 avatar image
0 Votes"
Spigolo-3573 answered

@HansvanderAa-7773

Blockquote

De geplande taak NT TASK\2BrightSparks\SyncBackProx64\AAWRK01-Hans\SyncBackPro PLEX_DATA wordt uitgevoerd, waarmee het inschakelen van de computer wordt aangevraagd.

Blockquote

We have the culprit here

Check with SyncBackPro options and remove the task.
This one should be found also on Scheduled Tasks.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Spigolo-3573 avatar image
0 Votes"
Spigolo-3573 answered

Hi @HansvanderAa-7773

I suppose there's a scheduled task which starts every two weeks and which can boot the system.
Check Event Viewer in this timeframe to find out which one.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HansvanderAa-7773 avatar image
0 Votes"
HansvanderAa-7773 answered

@Spigolo-3573 There is no scheduled task which starts every two weeks at 3:00, the system is down. There is nothing registered in the Event Viewer.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Spigolo-3573 avatar image
0 Votes"
Spigolo-3573 answered

@HansvanderAa-7773

I surely believe you but something is awaking the system.
Maybe a network Magic Packet. Disable Wake on Lan from BIOS just in case.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HansvanderAa-7773 avatar image
0 Votes"
HansvanderAa-7773 answered

I will disable wake on lan and wait two weeks for the results

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MollyLu-MSFT avatar image
0 Votes"
MollyLu-MSFT answered MollyLu-MSFT edited

Hi,

Welcome to Microsoft Q&A.
Is there BSOD and dump file generated under C:\Windows\memory.dmp?
Is there event id 6008 or 1001 in event viewer? What's the detailed information?

Best regards,
Molly


If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HansvanderAa-7773 avatar image
0 Votes"
HansvanderAa-7773 answered MollyLu-MSFT commented

@MollyLu-MSFT no BSOD, no memory.dmp and no events (6008 or 1001)


· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi,

Thanks for your information, if so, you can just disable wake on lan and keep monitoring.

Best regards,
Molly

0 Votes 0 ·
HansvanderAa-7773 avatar image
0 Votes"
HansvanderAa-7773 answered

Again, last night the system boots !!!
wake on lan is disabled
no event 6008 or 1001

has someone an iedea?

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Spigolo-3573 avatar image
0 Votes"
Spigolo-3573 answered

@HansvanderAa-7773

Open a Command Prompt (admin) and type these 3 commands:

powercfg -lastwake
powercfg -waketimers
powercfg -devicequery wake_armed

Report the results.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

HansvanderAa-7773 avatar image
0 Votes"
HansvanderAa-7773 answered

PS C:\WINDOWS\system32> powercfg -lastwake
Wake History Count - 0
PS C:\WINDOWS\system32> powercfg -waketimers
Timer set by [SERVICE] \Device\HarddiskVolume2\Windows\System32\svchost.exe (SystemEventsBroker) expires at 11:59:30 on 2020-11-01.
Reason: De geplande taak NT TASK\2BrightSparks\SyncBackProx64\AAWRK01-Hans\SyncBackPro PLEX_DATA wordt uitgevoerd, waarmee het inschakelen van de computer wordt aangevraagd.

Timer set by [SERVICE] \Device\HarddiskVolume2\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe (EaseUS Agent) expires at 10:59:00 on 2020-11-08.

Timer set by [SERVICE] \Device\HarddiskVolume2\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe (EaseUS Agent) expires at 21:59:00 on 2020-11-01.

Timer set by [PROCESS] \Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe expires at 21:59:00 on 2020-11-01.
PS C:\WINDOWS\system32> powercfg -devicequery wake_armed
Realtek PCIe GbE Family Controller
HID-toetsenbordapparaat
HID-muis

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.