PC wakes from sleep by itself? Find the source

Save the wake before it gets replaced

The last-wake record describes the most recent transition out of sleep. Another sleep-and-wake cycle can replace it, so collect the evidence soon after the unexpected wake.

• the exact time you put the PC to sleep and the time you found it awake
• whether the display lit up, the fans ran, the keyboard lit, or only the battery dropped
• whether the PC was on AC power or battery
• whether the lid was open or closed and whether a dock or external monitor was connected
• connected USB, Bluetooth, network, audio, and input devices
• recent Windows, driver, firmware, app, docking, router, or peripheral changes
• whether the wake happened immediately, at a repeatable time, or after input or nearby movement

A processor can wake during Modern Standby without turning on the display. “The battery dropped overnight” and “the screen came on at 2:13 a.m.” are not the same observation.

Collect four read-only powercfg results

Open Windows Terminal as administrator, run each command separately, and save the full output. These checks inspect the current power configuration; they do not disable a device or timer.

1. powercfg /lastwake — reports information about the most recent transition out of sleep.
2. powercfg /waketimers — lists active timers that are currently allowed to wake the system.
3. powercfg /devicequery wake_armed — lists devices configured to wake the PC.
4. powercfg /a — shows which sleep states the PC supports, including whether it uses S0 low-power idle, commonly called Modern Standby.

Review the output before sharing it. Device names, task paths, account names, network adapters, and computer details can reveal more than you intend. Keep the original text privately and redact a support copy when needed.

Do not overread one command

/lastwake can be useful, generic, empty, or stale. A named device is a lead, not proof that the device is defective. A wake timer can exist without matching the time of your incident. And wake_armed means a device has permission to wake the system, not that it performed the last wake.

Correlate at least three things: the observed time and behavior, the command output, and a repeatable change in the same conditions. If they do not line up, preserve the uncertainty.

Match the wake to its pattern

The PC wakes immediately after you choose Sleep

Look first at the last-wake result and recently connected input, USB, dock, and network devices. A stuck key, sensitive mouse, docking transition, lid event, or device reconnect can create an immediate wake. Put the PC to sleep once with the same setup and keep your hands away. Then repeat with one nonessential external device safely disconnected. Do not disconnect storage while it is active.

It wakes at the same clock time

Compare the incident time with powercfg /waketimers. Microsoft documents scheduled maintenance as one possible timed wake. Windows Update, backup software, maintenance, or another approved task may have a legitimate reason to run. Record the timer owner and scheduled time before changing anything. Do not disable all wake timers or Windows Update to silence one event.

A mouse, keyboard, controller, or dock seems involved

Check whether the exact device appears in wake_armed and whether touching or reconnecting it reproduces the wake. If the evidence repeatedly points to one nonessential device, Windows supports disabling wake permission for that named device with powercfg /devicedisablewake "exact device name". Keep the reversal: powercfg /deviceenablewake "exact device name".

Use the device name exactly as Windows reports it. Do not mass-disable USB controllers, keyboards, Bluetooth, HID devices, or the entire dock. That can break normal wake, accessibility, input, and support behavior.

It wakes after the lid, monitor, or dock changes

Record the lid position, dock model, display connections, power source, and whether the event occurs while docking, undocking, or switching AC power. Test one stable arrangement twice. Do not update firmware or remove a dock driver until the pattern is reproducible and the device maker’s current instructions apply to the exact model.

It wakes when you approach

Some supported Windows 11 PCs expose Presence Sensing settings, including an option to wake when you approach and, on some systems, an external-display variation. Check Settings only if your PC actually shows those controls. Turn off one approach-wake option as a reversible test, then repeat the same distance and room conditions. Absence of the setting means this is not your branch.

Networking or remote access is the lead

A network adapter may be armed to wake the PC, and Modern Standby supports several communication and remote-access wake paths. Compare Wi-Fi versus Ethernet, docked versus undocked, and AC versus battery without weakening the network. Do not disable the firewall, security software, router protections, remote-management policy, or every network adapter. On a managed PC, send the adapter, time, wake output, and network context to the administrator.

Modern Standby changes what “awake” means

Traditional sleep and Modern Standby are different power models. powercfg /a tells you what the current PC supports. In Modern Standby, the processor may wake briefly for a timer, input, lid, network communication, Windows Update, an app, audio, a connector, or a power or thermal event while the display stays off.

Microsoft also notes that behavior can differ on AC power and battery. Starting with Windows 11 24H2, Windows can disable most wake sources when it detects excessive Modern Standby battery drain. Treat that as conditional system behavior, not proof that Windows “fixed” or “broke” one device.

If the main problem is battery loss with no observed display wake, record the overnight power drop and sleep model. Do not force an unsupported conversion between Modern Standby and traditional S3 sleep through registry or firmware tricks.

Keep updates and scheduled work in context

If the wake follows a recent update or a repeatable maintenance window, check Windows Update history and the timer owner. A pending restart, update installation, or maintenance task can be relevant, but timing alone does not prove causation. If Windows Update itself is stalled, use the separate Windows 11 update guide and keep the wake evidence attached.

A Wi-Fi disconnect, network reconnect, and unexpected wake can also share an adapter without having the same cause. The Wi-Fi disconnect guide helps classify that network pattern. Do not combine a wake investigation, adapter reset, driver replacement, and router change in one session.

Run one reversible confirmation test

1. Write a plain hypothesis: “The USB mouse wakes the PC immediately,” or “The maintenance timer matches the 2:13 a.m. wake.”
2. Save the baseline commands and exact conditions.
3. Change only the confirmed permission or condition. Keep the command or setting needed to reverse it.
4. Repeat the same sleep test at least twice when practical.
5. Restore the setting if the wake continues or normal use is disrupted.

A clean failed test is still useful. It removes one lead without erasing the original evidence.

Build a clean support handoff

• Windows edition, version, build, and PC model
• sleep and wake timestamps and whether the display turned on
• AC or battery, lid, dock, monitor, and connected-device state
• the four powercfg outputs
• recent updates, driver, firmware, app, or hardware changes
• the repeated pattern and the result of each one-change test
• whether the PC is personal or managed

That record helps the next person distinguish a permission, schedule, device, network, platform, firmware, or hardware path without starting over.

Where OmniMend fits

OmniMend for Windows can help keep the sleep and wake timeline, supported sleep states, last-wake result, timers, armed devices, connected peripherals, and recent changes together. It does not disable wake sources automatically, change firmware or policy, convert the sleep model, or guarantee which source caused a wake.

Browse the OmniMend help article library for related Windows evidence guides, or see OmniMend help for product guidance. Use the smallest supported confirmation test and keep the reversal.