avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • August 23, 2019, 03:25 PM
  • Proudly celebrating 13 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.

Messages - Asudem [ switch to compact view ]

Pages: [1] 2 3 4 5 6next


Alright, so... I've decided something: If I don't move my mouse, I don't want the screen to turn on!

After failing to figure out how to use RegisterPowerSettingNotification to figure out if my display was on or off, I found that Windows API Code Pack can also do this. So, I whipped up a small little C# program for myself:

Code: C# [Select]
  1. using System;
  2. using System.Runtime.InteropServices;
  3. using System.Drawing;
  4. using System.Windows.Forms;
  5. using Microsoft.WindowsAPICodePack.ApplicationServices;
  7. namespace ReSleeper
  8. {
  9.     public partial class Form1 : Form
  10.     {
  11.         Point point = new Point();
  12.         const int HWND_BROADCAST = 0xffff, WM_SYSCOMMAND = 0x0112, SC_MONITORPOWER = 0xF170;
  14.         public Form1()
  15.         {
  16.             InitializeComponent();
  17.         }
  19.         public class Display
  20.         {
  21.             [DllImport(@"User32", CharSet = CharSet.Auto)]
  22.             private static extern IntPtr PostMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, IntPtr lParam);
  24.             public static void PowerOff()
  25.             {
  26.                 PostMessage(
  27.                    (IntPtr)HWND_BROADCAST, // HWND_BROADCAST
  28.                    WM_SYSCOMMAND,         // WM_SYSCOMMAND
  29.                    (IntPtr)SC_MONITORPOWER, // SC_MONITORPOWER
  30.                    (IntPtr)0x0002  // POWER_OFF
  31.                 );
  32.             }
  33.          }
  35.         private void button1_Click(object sender, EventArgs e)
  36.         {
  37.             point = Cursor.Position;
  38.             Display.PowerOff();
  39.             PowerManager.IsMonitorOnChanged += PowerManager_IsMonitorOnChanged;
  40.         }
  42.         private void PowerManager_IsMonitorOnChanged(object sender, EventArgs e)
  43.         {
  44.             Point point2 = Cursor.Position;
  45.             if (PowerManager.IsMonitorOn == true && point == point2)
  46.                 Display.PowerOff();
  47.         }
  48.     }
  49. }

Basically, if the monitor powers on for whatever reason, and the mouse cursor has not moved, it will turn off again! Hurrah! No more getting out of bed walking to the computer! It's almost instantaneous when I try to use my keyboard to wake my machine up! I can add logging to this to get an idea of when the mouseless events occur and try to compare them to event logs.

But for now... it's time to enjoy some monitor-off sleep  :Thmbsup:

Have you checked in the bios and made sure you have all wake-on-lan and any other fishy options disabled?

If you turn off your network adapter (e.g. disconnect ethernet, disconnect from wireless), does the problem still happen?
Have you tried turning off automatic update checking?

Have you any 3rd party (like laptop manufacturer, or intel) app that might be trying to check regularly for updates?

I don't believe my BIOS has that option. I will check again soon.

I have been in airplane mode and it still wakes up.

My Blizzard agent checks for updates regularly, but in the months it ran before my 1903 update it ran and updated fine without waking up my screen.

I'm not sure how much farther I want to go down this rabbit hole. I could be messing with power configs, notification settings, network stuff, and registry entries forever. It's insane to see this problem I'm having be so difficult to diagnose for what seems like a simplistic functiion of the operating system.

It turned on again... I'm fairly close to igniting this computer in gasoline. I'm just going to say it's cursed at this point.

No more laptops for me. I'll build a nice desktop with a Linux distro that can run my favorite games. None of this NVIDIA Optimus tripe.

Sorry it's still around.

On the off-chance you haven't seen the following, this thread sounded awfully similar:


It appears there was some success for the original poster described on the second page of the thread, with the original suggestion (plus link to article) on the first page.
Thank you! I tried quite a bit from that thread. I also find the following commands from ghacks VERY useful, and might make a snack to make this a little easier:

Command line Fu

Here is a list of useful commands that can help you find out more about your PC's sleep mode and wake up configuration:

powercfg -a displays a list of available sleep states of the computer.
powercfg -devicequery wake_armed lists all devices that can wake the computer
powercfg -devicequery wake_programmable lists all devices that can be programmed to wake up the PC.
powercfg -devicedisablewake "exact device name" disables the wake functionality of the selected device.
powercfg -deviceenablewake "exact device name" will enable that device again.
powercfg -lastwake displays the last device that woke up the PC.
powercfg -waketimers lists all active wake timers.

FWIW, according to the following article which discusses LockApp.exe, it can be disabled:


Interesting, thank you! I've made the change in the registry and will see if this combined with no notifications has any effect tonight.

3am EDIT: *SLAMS HEAD MULTIPLE TIMES ON DESK* Nothing.... nothing can stop this...

My apologies. Nothing I read in your OP indicates that you assumed it was a notification (which could be from any/every application running on your PC!) that kept waking your monitor.
Well, some executable/application/program has to send a notification? Right? The "Focus Assist" notifications have never affected my screen-time outs or screen savers. If you can think of any other ways "notifications" appear and can be traced, please enlighten me.

EDIT: Looking at those notifications, each one is very descriptive of what is sending the notification: Microsoft Store, Google Chrome, Windows Security, etc... if it were that easy, I don't think I would have created this thread.

EDIT2: Disabled notifications completely and will see if that yields any results.

EDIT3: If that were the case, however, I have never disabled notifications, and for months this problem has not been happening, just after I updated...

EDIT4: I seem to recall sitting down at my monitor-off computer, jiggling the mouse, seeing the lock screen, then notifications will appear, yes, but it has never woken the screen before.

EDIT5: It seems "ShellExperienceHost.exe" is the executable for Notification/Action Center and I can verify it was running in my process tree for the duration of my 40 min 3GB log file, but it had 0 events associated with it.

My guess is that it is some background process or service that is activating it, perhaps some installed software checking for updates, phoning home, or syncing data.

Maybe Chrome, your antivirus, Windows itself, some browser add-on (if you leave your browser open when you go to sleep), e-mail app checking for new mail, a utility from your laptop manufacturer, other software, etc. It could even be your printer, especially if it's a Canon and you accidentally authorized it to phone home with usage statistics, when you installed the software on your laptop. It could even be one of those Start Menu apps that comes with Windows 10 that displays data in your Start menu, such as weather, news, etc.

I don't know exactly what causes it, but sometimes my screens reactivate or the screensaver is interrupted whenever a notification pops up from any program. If I get a text, or email, or IM, or any app shows any notification, it can cause the screen to wake up.

It doesn't always happen, but it happens often enough to be a semi-regular thing on my PC. Maybe your laptop is doing something similar.

I have a problem with my computer, even after a new hard drive "Reach" install of Windows 10, so a fresh Windows 10 install is being used. The problem is that my computer will, at seemingly random points in time during the night, reactivate my screen, after it has powered down.

I would like some kind of recursive diagnostic logger to help identify the cause of this issue down to the executable, daemon, rootkit, malware, or virus this may be.

Note: Only on my Win10 partition do I exhibit random "screen turn on experiences" with nothing in my log files. OpenSUSE Tumbleweed and Ubuntu 14.04.5 Desktop 64bit.

In my very first post in this thread, I assumed all of this. I just wanted a tool to tell me which thing was doing it!

In somewhat better news, I ran a 40 min ProcMon scan and the screen turned itself on during the logging process. Several hours combing through the scan lead to some interesting findings (and a 3GB log file).

  • An entry by svchost.exe frequently used the path "HKLM\System\CurrentControlSet\Control\StateSeparation\RedirectionMap\Keys" with the RESULT as "REPARSE". Jumping to the key lead me to the registry entry "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Remote Assistance", which I found to be a bit odd. Looking through the entries I saw that "fAllowFullControl" and "fEnableChatControl" were enabled as "1", even though in my "System Properties" under the "Remote" tab, "Remote Assistance" was disabled. I changed these entries to "0" to disable them, just in case.
  • I noticed that Tablet Input was being called a lot in the log file. To my surprise, the service was running with no way to stop it, as all the options were greyed out. I could change the service to "Disabled" instead of "Automatic" but I needed to identify the process ID from svchost.exe and terminate it. Though an easier method in retrospect would have been typing "sc queryex TabletInputService" in an elevated command prompt.
  • I can't seem to find too much information on "LockApp.exe" or how it works. But it seems to be at the beginning of all the system calls which were used to turn my screen on. The process appears to be started under my user account and the command line that started the process looks like this ["C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7amqjywdat7d3j2z.mca] I can't seem to find any information regarding what the ServerName switch does.
  • In the "Event Properties" for LockApp.exe's listed modules is a "umpdc.dll" located in "C:\Windows\System32\" directory. I sent it to hybrid-analysis for a review. Some of the more suspicious data from the analysis come from the file exports: "PdcSleep", "PdcSleepstudyHelperBlockerActiveDereference", "PdcSleepstudyHelperBlockerActiveReference", "PdcSleepstudyHelperBuildBlocker", and so on.... this is because when I analyzed the SleepStudy log file taken at the exact moment my monitor turned on, all "Process" return "Unknown". It might be something, it might be nothing. I don't know.

After taking the steps above, such as disabling the Remote Assistance registry entries and disabling tablet input, the computer still wakes on its own.

Have you tried booting it with a different distribution, like a linux distro, to see if its a hardware issue?
What about reinstalling windows?
In prior posts, I have run Ubuntu and OpenSUSE Tumbleweed with no problems regarding "screen power time outs", and the monitor has never turned on by itself when left on the distro all night.

This was occurring on my old Win10 drive, I bought a new drive and did a multi-boot install with a fresh install of Win10 and it was doing it the same night I installed the fresh copy. It stopped happening in March but resurfaced immediately after the 1903 update.

Which laptop model is it?

Are the BIOS and Intel Management Engine Firmware (if applicable) up to date?
-ConstanceJill (July 16, 2019, 09:45 AM)
Bios was up to date, but I see just a month ago they released a 3.03, which I will be updating to after this reply.
Intel Management Engine appears to be version Will try to see if I can update it.

EDIT1: Bios updated from 3.00 to 3.03 and after finding this link here my Intel Management Engine reports version Of the previous 3 Intel vulnerability tools I ran, 2 are still vulnerable after the update. MDS Tool also reports many vulnerabilities still. Though I will have to wait until tonight to see if my computer magically wakes up some more from it's the monitor-powered-down state.

EDIT2: There was a microcode update for my CPU provided by windows in KB44650655, however, the update is for 1809 and not 1903. So I cannot update my microcode just yet.

EDIT3: Went to lay down and turned the screen off. Relaxing after 20 min, the screen popped back on by itself. *sigh*

Using procmon and nircmd, I began banging away at various programs that were performing tasks while the computer's monitor was off to no avail. Last night the screen turned on unprovoked several times.

We had also once wondered if it still happened "when the lid is closed". I got fed up and closed my lid and my computer entered full sleep mode rather than the monitor powering off after a timeout. Several minutes later, yes, my computer woke up while the lid was still closed.

I am literally losing sleep over this.

Are you sure there is not a scheduled task configured in your system that triggers the monitor/Windows to activate again?

Even if you did not configure one or never even have created such a task on your system, that doesn't mean such a task won't exist. And yes, although the name implies that these tasks are executed based on any kind of time interval, you can also create tasks that are triggered by changes in software or settings that happen in your system. A Microsoft update could have added such a task.

I will check, but just moments ago my screen turned itself off by itself for the first time during use. All previous instances in which it has turned on/off were not during use.

Maybe look to see if you have your network NIC set to wake up?
All those settings have been disabled.

Sorry to bump an old thread but I updated to Win10 1903 and the problem has come back. Last night, the monitor powered on, so I got up and turned the machine onto airplane mode just to be sure, went back to bed, and after a few hours, it did turn on again. I am at my wits end here. I need to trace the root of this problem!

It just turned itself on again by itself this morning. I don't think there's a possible way to diagnose this according to you guys other than blaming drivers or peripherals.  :(

N.A.N.Y. 2019 / Re: NANY 2019 - Windows App - Process Watcher
« on: January 02, 2019, 11:26 AM »

I am forever referring to programmers as "Rare File Architects" henceforth... okay, maybe not...

Avast informed me the installer version was just fine though!

Ooooh, fancy that! Nice find, thanks much!  :Thmbsup:

EDIT: It's nearly 3am and I just want this batch processing to finish so I can disconnect everything. The Laptop Buyers Remorse is really real tonight folks...

EDIT2: I didn't sleep, and no, it never turned on. I guess I'll try again before I actually fall asleep.

I thought people were trying to argue that the hardware itself was doing it, not the drivers.

Due to the "murkiness" of the original post, eg. "powered down" as opposed to Windows turning the display off.  ;)

First step should still be remove all peripherals, mice, RF transceivers, external HDDs, etc, etc - so we'll see what happens.

That's why I created this thread and hoped some sort of ProcMon like software existed or could exist, to diagnose this issue.

There's also Sysmon which will log to the Event Log.

I will be doing this, and also using a NANY 2019 app from Mouser! Gonna let it run all night!

N.A.N.Y. 2019 / Re: NANY 2019 - Windows App - Process Watcher
« on: January 02, 2019, 12:31 AM »
Avast seems to terminate the process and won't let the installer run, insisting I submit it to them for analysis. I have not done so yet, but just a heads up.


I have never, EVER, seen such behavior from it before...

EDIT: It seems to have sent something without my permission, but it does indeed give me an opportunity! I have installed the software, disabling the shields, and reactivated the software, seeing what, if anything, avast does to it, and what, if anything, avast updates with to let them know the file's signature is safe or not.

It would have relevance if Linux used the same drivers and ran the same processes ... but then it would be Windows.  So it still doesn't exclude peripherals from the equation.
Interesting. So you're saying it would be at the driver level anyway if any tampering would be had, and not by faulty hardware. Alright, I can buy that. I thought people were trying to argue that the hardware itself was doing it, not the drivers. This makes more sense.

In the absence of information, can we assume that most, if not all, of the Windows telemetry has not been disabled?
Initially, yes. I have since run Blackbird and disabled (seemingly all telemetry. It has done the on/off thing since this.

It's Google, they along with Microsoft want to collect everything about you, this is common knowledge - since you've knowingly installed Chrome I would have thought you'd expect to see it's grubby little feet trampling through your machine  :)

Google has a big enough footprint on me that I've become rather comfy knowing if I'm suddenly wanted for murder or something, their activity could just prove I was on the toilet while the crime was committed or whatever. Microsoft, meh, but to see chrome itself as an executable accessing what is essentially the area of Windows in which users are authenticated is a little shocking. I'm not fully alarmed by it, but it is quite the unexpected appearance.

Find what's turning it on since the second event can't happen without the first event.

That's why I created this thread and hoped some sort of ProcMon like software existed or could exist, to diagnose this issue. The program Shades mentioned might be able to help out there, but if only I can figure out how to utilize it. Hmm....

Going to unplug everything but power and wifi tonight, see if it happens again.

I like the idea of creating a log entry when the screensaver times out, that's very clever. I don't have gpedit as I don't have pro but you may be onto something.

EDIT: Oh, what? Event IDs 4802 and 4803 do not appear in my event logs even when manually activated...  :o

When did you first notice it happening, (and does it coincide with anything else, eg. software install, power fluctuations)?
It first started doing this on my machine sometime at the beginning of last year, so about a year ago now. The house power fluctuations are more recent, the beginning of Winter 2018. I can only monitor what I am awake for and it only happens in the dark, all lights off, and when I am in bed. It is quite possible the process knows this through some sort of malware hijacking my cam, as the monitor never shuts off by itself while being used. However, no such exe was found using my webcam when I had Avast Pro's webcam anti-spy thing, there was no activity logged but I was still suspicious.
eg. Until I recently decided to uninstall ~20 programs I no longer use, my computer would not go into Sleep mode, something I had become used to.
Now it does again.
It did this the night of the fresh Win10 install on a new hard drive about a month ago. So it survived an entire Hard Drive and OS clean install. Again, left overnight, no forms of Linux seem affected.

Another experiment, instead of just getting it to turn the display off, have it also Lock the computer.
This will require physical interaction with the mouse or keyboard to have the display turn on.
It's worth a shot, but I highly doubt this will affect it in any manner.

EDIT: I can't seem to find a "require login on wake" setting, but I do find a "allow wake timers" which might not have been modified on my old machine and was set to "important only", and I have now set it to "disabled". I have also set the "Screen Saver" to "none" and require login after the same amount of time as the power management to turn off my monitor.

However: None of this can explain what turns my monitor back off after turning it on.

EDIT2: Found this in my security audit. Should I be concerned? Why would chome.exe be in there while I'm using it to read this reply?
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          1/1/2019 4:38:40 PM
Event ID:      4798
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      DESKTOP-GHRIIHN
A user's local group membership was enumerated.

   Security ID:      DESKTOP-GHRIIHN\bigge
   Account Name:      bigge
   Account Domain:      DESKTOP-GHRIIHN
   Logon ID:      0x1E8E43D2

   Security ID:      DESKTOP-GHRIIHN\bigge
   Account Name:      bigge
   Account Domain:      DESKTOP-GHRIIHN

Process Information:
   Process ID:      0x24e4
   Process Name:      C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Event Xml:
<Event xmlns="http://schemas.micro...2004/08/events/event">
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <TimeCreated SystemTime="2019-01-02T00:38:40.791620000Z" />
    <Correlation ActivityID="{4e25fc43-9d83-0005-52fc-254e839dd401}" />
    <Execution ProcessID="868" ThreadID="15548" />
    <Security />
    <Data Name="TargetUserName">bigge</Data>
    <Data Name="TargetDomainName">DESKTOP-GHRIIHN</Data>
    <Data Name="TargetSid">S-1-5-21-1929593028-2655745888-1613840321-1001</Data>
    <Data Name="SubjectUserSid">S-1-5-21-1929593028-2655745888-1613840321-1001</Data>
    <Data Name="SubjectUserName">bigge</Data>
    <Data Name="SubjectDomainName">DESKTOP-GHRIIHN</Data>
    <Data Name="SubjectLogonId">0x1e8e43d2</Data>
    <Data Name="CallerProcessId">0x24e4</Data>
    <Data Name="CallerProcessName">C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</Data>

Keyboard can. And if the external drives came with driver and/or back-up software, those could trigger Windows to become active again.
If my keyboard is phantom stroking itself off at 2 or 4 in the morning when I am trying to sleep I will be pissed. Also, note, I said it does not happen in other OSes.

No backup software or drivers to my knowledge outside whatever MS provides with Win10.

Wireless headset uses BlueTooth?
RF receiver, which blinks when deactivated and stays lit when activated. It has never stayed lit when the monitor has powered back on, or if it has, the headset itself would be plugged into a power outlet and is just broadcasting silence. The random on/off of my screen has been observed in both states.

Not just the devices that you think is logical.
Turning the machine off to avoid the issue is a logical fix. This disconnects all power. I am not looking for logic. I am looking to find the answer.

Logic would imply I would be staring at my screenless laptop while all items are disconnected through countless nights of waiting for the issue to happen, and then it happens, then I have nothing other than a confirmation some process in Windows is causing this. As I have stated before, no other OSes do this.

Logic would also imply these devices cannot turn the screen back off at a non-designated Windows time (5 min), and yet, the light can turn off in anywhere from 5 sec after turning on to 2 min after turning on.

Logic does not explain that any of these devices could also cause the screen to power down.

EDIT: One minor note, I am experiencing what appear to be unrelated power fluctuations on the circuit in my house with lights flashing as well. This behavior as observed on my laptop is as follows:
The laptop detects a power drop and momentarily enters battery mode, in which it has a different set of rules to follow for powering the monitor off and the event is logged as a "power unplugged" event. When power is restored to the laptop, usually within a few moments, the backlight will kick into full brightness under the "plugged in" profile, and will recognize (somehow) the monitor should be in the powered off state, as its states was never cleared properly when it was plugged in, and will turn off my monitor once again. This is observed and consistent behavior.

EDIT2: I feel that this is the closest answer I can find to monitor power on/off behaviors.

BTW, "reactivate" the screen = turn the backlight on (with no signal, eg. no Desktop) or completely wake the screen, ie. normal backlight/Desktop ?
Something else to try, turn the display off manually using NirCmd (nircmd.exe monitor off) and see if it wakes up.
Reactivate = normal backlight/desktop

Latest graphics and chipset drivers.

After nircmd was used to power down the monitor, it was powered up unexpectedly again.

All I have left is my external audio card (wireless headset), my keyboard, 2 external drives, and an external BD drive. I could unplug those too but I doubt those units could also be powering the monitor off as well as back on.

Perhaps with a tool like this you are able to find out what instance of software is making your monitor light up.
I will investigate this software to see if it can't help trace the problem down, thanks!
Going back to the OP:
To clarify, what do you mean by powered down?

Good question, I should have been more specific: In Power Management, you are given a power option for when you would like your screen turned off at what I assume is the hardware level:

Once my afk has been detected for 5 minutes, I expect my screen to soft-power-down, meaning the lcd pixels and backlighting are turned off on my laptop monitor. I also do not expect the screen to resume until such input behavior is received from only my mouse or keyboard. My linux distros follow these rules similarly without power restoring to my monitor unexpectedly.

Bumping with new info: With mouse disabled, the backlight is turning on and back off at times not designated by Windows.

Greetings all,

I have a seemingly large amount of time to spend with myself and all the bits on this computer I could flip to my heart's content. However, my ability to keep that heart beating as fast as it does for using my computer could be greatly improved if I made adjustments myself. I find two of my online worlds colliding a lot and wish to have them sorted through my own program to help define the commonalities between the two social networks. Nothing like this currently exists which brings up what I've run into a lot and I call my "developer's dilemma".
  • If I intend to make a program that does not exist in one form or another, is it worth making at all?
  • Would maintenance on the program outweigh its usefulness over using the two platforms non-integrated?
  • If I made this in a language which used external modules, am I prepared to have my software bloat from the unneeded components?
  • If I did want to write it from scratch in a new language, what should I write it in?

I am not certain if other developers (or the self-proclaimed developer like myself) get this or not, especially when FOSS becomes involved.

DC Website Help and Extras / Re: Is DC attacked again?
« on: December 26, 2018, 05:44 PM »
Gave $10 of my DonationCredits to the server! Hold strong server!

Pages: [1] 2 3 4 5 6next