Computer restarts when trying to wake it up from sleep

Topic

New Reply

[PKCano]

I use the sleep mode.  I activate by closing the lid and then open opening the lid the computer resumes from sleep.

Periodically when I open the lid instead of waking from slip the computer restarts and seems like it the “dotted circle” rotates about 30 times before completing the startup.  Normally it takes about two rotations.

Computer is on fast startup.  Whenever it happens I run SFC /Scannow with no integrity violations.  I also run chkdsk and finds no problems.

I would appreciate any suggestions.

From Event Viewer:

Information  2/7/2025 1:17:31 AM        Service Control Manager    7040  None

The start type of the Background Intelligent Transfer Service service was changed from demand start to auto start.

Information  2/7/2025 1:21:36 AM        Service Control Manager    7040  None

The start type of the Background Intelligent Transfer Service service was changed from auto start to demand start.

Error  2/7/2025 9:41:29 AM        EventLog      6008  None

The previous system shutdown at 1:19:00 AM on ‎2/‎7/‎2025 was unexpected.

Note: I could not find any entry at 1:19:00 AM

Windows 10 / Dell E6540 Laptop / 16GB Ram / SSD

• This topic was modified 1 month ago by PKCano.
• This topic was modified 1 month ago by ECWS.
• This topic was modified 1 month ago by ECWS.
• This topic was modified 1 month ago by ECWS.

Reply | Quote

Replies

ECWS wrote:

Periodically when I open the lid instead of waking from slip the computer restarts and seems like it the “dotted circle” rotates about 30 times before completing the startup. Normally it takes about two rotations.

I’m assuming you are running Win 10.

This sounds like your Power & Sleep settings need to be adjusted to make the sleep time longer.

Depending on your settings sleep times out and then triggers hibernation. A wake up from sleep is fast, not so for hibernation.

Extend your sleep time. This is done using minutes.
For example: 1 day = 1,440 minutes. 2 hours = 240 minutes. You get the picture.

Open Windows settings and find “Power & Sleep”.

Desktop Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.

Reply | Quote

Thanks for your reply.  Actually what happens is the computer restarts instead of waking from sleep saying this: “The previous system shutdown at 1:19:00 AM on ‎2/‎7/‎2025 was unexpected.”

Thinking of setting the hard drive for the laptop to sleep “Never” and restarting once a week.

1 user thanked author for this post.

TechTango

Reply | Quote

EC,

Sounds like a more serious problem than just your shutdown settings; I defer to the gray(er) beards on this one.

Zig

 

Reply | Quote

That sounds more like a hardware / driver issue, where you have a crash on sleep / wake.

Is it actually a full reboot or a return from hibernation?

Check for updated drivers on the laptop manufacturer’s site.

cheers, Paul

Reply | Quote

Hi Paul,

It is a full reboot – at least I think it is  – because it shows the DELL page then seems like it is going through a full report although it takes a lot longer than a normal boot

 

Reply | Quote

I think your system is doing a bit of a silent crash/dump.  The BITS thing I’m not worried about.  The “I didn’t shut down cleanly and I’m not happy” is more of a concern.  Home built or vendor built?  When’s the last time you did a firmware update?

Susan Bradley Patch Lady/Prudent patcher

2 users thanked author for this post.

satrow, TechTango

Reply | Quote

“Dell E6540 Laptop”

Duh.

Dell Latitude E6540 System BIOS | Driver Details | Dell US

See if that helps?

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Hi Susan,

I have had that latest BIOS update since 2019.

This seems to happen when I try to resume from sleep by opening the lid after placing the computer to sleep by shutting the lid.  Wondering if I should just leave it on all the time and just let the display go to sleep after 30 minutes.  I restart it once a week.

 

Reply | Quote

I honestly don’t use sleep, but have the monitor go off on my computers.

Over the years the sleep setting works and then it doesn’t work.  And then it works… and then…. you get the idea.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

agoldhammer

Reply | Quote

Thanks.  I should have mentioned this Dell E6540 is a laptop.  Would you leave the laptop SSD hard drive on and just let the display go to sleep?

 

Reply | Quote

ECWS wrote:

Wondering if I should just leave it on all the time

I have no experience with this approach, but it is a lot of time the cooling fan could be running. Unless the laptop has a decent intake dust filter the fan could get clogged with dust. I’ve cleaned out a couple of laptop fans that were a mess.

Desktop Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.

Reply | Quote

I usually vacuum the vents (or use compressed air) once a week.  I keep Speccy running to track the temperature.  Now CPU is 45 degrees C HD is 40 degrees C

 

1 user thanked author for this post.

TechTango

Reply | Quote

ECWS wrote:

I activate by closing the lid and then opening the lid the computer resumes from sleep. Periodically when I open the lid instead of waking from sleep the computer restarts

IMO it sounds like your device is failing with a BSOD and it’s set to automatically restart.

Have a look at How to Enable or Disable BSOD Automatic Restart in Windows for more info about possible causes and how to check the setting for automatic restart. (I always uncheck it ‘cos I think it’s more trouble than it’s worth.)

The Background Intelligent Transfer Service (BITS) entries may have something to do with Windows Update or – if you use it – Microsoft Defender. (Defender piggybacks onto Windows Update‘s Orchestrator to download definition and engine updates.)

If the Orchestrator doesn’t run correctly in the background then after 3 failed attempts it falls back to using BITS. This is so, for example, Defender definition updates can still be downloaded (but not engine updates).

If you close the lid whilst Orchestrator is running in the background doing a download then this may trigger BITS as an alternative downloader. (BITS is able to resume downloads. I don’t know about Orchestrator… ‘resumed downloads’ are not mentioned in Microsoft’s How Windows Update works article.) This could explain why BITS‘ startup value is being toggled.

It might be an idea to run the Windows Update Troubleshooter to check. See this Microsoft Support article – Troubleshoot problems updating Windows – for more info.

Hope this helps…

UPDATE: I just disabled Windows Update to check a script and found Windows also uses BITS to update Edge and fonts:

I wasn’t aware of that before.

1 user thanked author for this post.

TechTango

Reply | Quote

Would it help to attach information from event viewer?  Would it help if I ran a version of chkdsk?

Last night I used Fn key and F1 to put the computer to sleep, then closed the lid.  This morning when I opened the lid the hard drive light was blinking but then after a while it stopped.  It did NOT restart.  It went into sleep mode.  Then when I clicked on the on/off button it woke from sleep.

No mention of Windows not being properly shut down

 

 

Reply | Quote

ECWS wrote:

I would appreciate any suggestions.

With an image backup at the ready, an over the top repair install from an ISO might fix everything in one swoop.

Also, while you’ve run the usual Command Line disk diagnostics, the Crystal Disk Info utility might shed some light. Seems unlikely, but is an easy tool.
https://www.carifred.com/cleardiskinfo/

Desktop Asus TUF X299 Mark 1, CPU: Intel Core i7-7820X Skylake-X 8-Core 3.6 GHz, RAM: 32GB, GPU: Nvidia GTX 1050 Ti 4GB. Display: Four 27" 1080p screens 2 over 2 quad.

Reply | Quote

ECWS wrote:

it shows the DELL page then seems like it is going through a full report

This may be a fast boot, not a restart. Is fast boot enabled?

If it’s returning from sleep, your apps will still be open.

cheers, Paul

Reply | Quote

Thanks Paul.  Last night I disabled the fast boot.  But then this morning when I tried to get it to respond from sleep it seemed like it was updating then went to sleep then when I clicked on the on/off button woke up.  Here is the Event Viewer text: It took about 8 minutes to update then go to sleep.  No errors listed in reliability history.

Information       2/8/2025 12:22:51 PM Service Control Manager            7040     None

Information       2/8/2025 12:20:17 PM Service Control Manager            7040     None

Information       2/8/2025 12:18:48 PM Kernel-General 16           None

Warning              2/8/2025 12:18:24 PM DNS Client Events         1014     (1014)

Information       2/8/2025 12:18:21 PM Power-Troubleshooter 1             None

Warning              2/8/2025 12:18:20 PM e1dexpress       27           None

Information       2/8/2025 12:18:18 PM Kernel-Power   131        (33)

Information       2/8/2025 12:18:18 PM Kernel-General 1             (5)

Information       2/8/2025 12:17:32 PM Kernel-Power   107        (102)

Information       2/8/2025 12:17:32 PM Kernel-Power   42           (64)

Information       2/8/2025 12:17:27 PM Service Control Manager            7040     None

Information       2/8/2025 12:16:42 PM Service Control Manager            7040     None

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Warning 2/8/2025 12:15:37 PM      Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power)

Information       2/8/2025 12:14:31 PM Time-Service   37           None

Information       2/8/2025 12:14:29 PM Power-Troubleshooter 1             None

Warning              2/8/2025 12:14:29 PM Time-Service   134        None

Information       2/8/2025 12:14:28 PM Service Control Manager            7040     None

Information       2/8/2025 12:14:27 PM Time-Service   158        None

Warning              2/8/2025 12:14:27 PM e1dexpress       27           None

Warning              2/8/2025 12:14:27 PM Time-Service   134        None

Information       2/8/2025 12:14:27 PM EventLog            6013     None

Information       2/8/2025 12:14:25 PM Kernel-Power   131        (33)

Information       2/8/2025 12:14:25 PM Kernel-General 1             (5)

Information       2/8/2025 12:51:51 AM Kernel-Power   107        (102)

Information       2/8/2025 12:51:51 AM Kernel-Power   42           (64)

Information       2/8/2025 12:51:43 AM Kernel-General 16           None

 

Reply | Quote

Kernel power messages are usually the interesting ones, but the warnings for Kernel-Processor-Power may be our best bet.

cheers, Paul

1 user thanked author for this post.

ECWS

Reply | Quote

Think you may be on to something.  Last night I placed the computer to sleep with Fn and F1.  Then I shut the lid.  This morning the computer resumed from sleep by opening the lid.  Here is Event Viewer.  This is what was in the warnings for Kernel Power.  Same message but processor #’s that were referenced were 0,2,4,6,1,3,5,7

The speed of processor 4 in group 0 is being limited by system firmware. The processor has been in this reduced performance state for 71 seconds since the last report.

Information 2/9/2025 10:35:39 AM Kernel-General 16 None
Information 2/9/2025 10:33:57 AM Service Control Manager 7040 None
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Warning 2/9/2025 10:27:09 AM Kernel-Processor-Power (Microsoft-Windows-Kernel-Processor-Power) 37 (7)
Information 2/9/2025 10:26:22 AM WindowsUpdateClient 19 Windows Update Agent
Information 2/9/2025 10:26:20 AM WindowsUpdateClient 43 Windows Update Agent
Information 2/9/2025 10:26:19 AM WindowsUpdateClient 19 Windows Update Agent
Information 2/9/2025 10:26:19 AM Kernel-General 16 None
Information 2/9/2025 10:26:18 AM Kernel-General 16 None
Information 2/9/2025 10:26:18 AM WindowsUpdateClient 43 Windows Update Agent
Information 2/9/2025 10:26:15 AM Kernel-General 16 None
Warning 2/9/2025 10:26:03 AM DNS Client Events 1014 (1014)
Information 2/9/2025 10:26:02 AM Power-Troubleshooter 1 None
Warning 2/9/2025 10:25:59 AM e1dexpress 27 None
Information 2/9/2025 10:25:57 AM Kernel-Power 131 (33)
Information 2/9/2025 10:25:57 AM Kernel-General 1 (5)
Information 2/9/2025 2:14:58 AM Kernel-Power 107 (102)
Information 2/9/2025 2:14:58 AM Kernel-Power 42 (64)

 

Reply | Quote

I think that is the CPU being put to sleep by the hardware. Does the time match the shutdown time?

cheers, Paul

Reply | Quote

Seemed like the shutdown was fairly quick but then I observed this in Event Viewer:

Source: Microsoft-Windows-Kernel-Power
Date: 2/9/2025 2:14:58 AM
Event ID: 42
Task Category: (64)
The system is entering sleep.

Sleep Reason: Button or Lid

Source: Microsoft-Windows-Kernel-Power
Date: 2/9/2025 2:14:58 AM
Event ID: 107

The system has resumed from sleep.

Reply | Quote

ECWS wrote:

Information 2/8/2025 12:14:31 PM Time-Service 37 None
Information 2/8/2025 12:14:29 PM Power-Troubleshooter 1 None
Warning 2/8/2025 12:14:29 PM Time-Service 134 None
Information 2/8/2025 12:14:28 PM Service Control Manager 7040 None
Information 2/8/2025 12:14:27 PM Time-Service 158 None
Warning 2/8/2025 12:14:27 PM e1dexpress 27 None
Warning 2/8/2025 12:14:27 PM Time-Service 134 None

1. I notice 2 Time-Service warnings that suggest a possible DNS issue (i.e. event id 134).

2. I find it easier to read event log entries downwards and forwards in time rather than them being reversed and having to read upwards to understand the event sequence in ascending time order.

3. I also think it’s important to include each entry’s Message field which often shows a helpful description of the issue.

4. As a result, rather than use Event Viewer, I prefer to query event logs using PowerShell.

Here’s a problem-finder script that:

• Saves you hunting through Event Viewer by querying the 2 most relevant logs  – Application and System – but allows the addition of other logs easily. *
• Shows only the 3 most relevant levels by default- 1 (Critical), 2 (Error) and 3 (Warning) – but allows the addition of other levels easily. ** For example, level 4 (Information) just shows something’s working. I’m really only interested if something isn’t working, hence the default levels.
• Lets you specify how many days back to query. I’ve used 3 days as a default as this is when you made the first post… feel free to change this date range to whatever you want. ***
• Shows results in time order – sorted by newest events last – so it’s easier to read the flow of events.
• Lets you choose from four different types of results – Screen for a quick look, Grid for a much nicer look (IMO) and two methods of saving the results as a file on your desktop, .TXT or .CSV (better, IMO, as easier to sort/query) that can be attached to forum posts.
• Checks you are running the Windows PowerShell ISE elevated, i.e. using the right-click option to Run as administrator. (Note: In theory you shouldn’t need elevation as you are only reading data. *** I used the ISE to avoid any issues with ExecutionPolicy… I just wanted a method that was simple to implement.)

Note: I’ve attached the script as a zip file at the end of this post.

Here’s how, step-by-step… it’s very easy:

1. In the Start menu, navigate to Windows PowerShell ISE (Integrated Scripting Environment), right-click on the entry and choose Run as administrator.

2. When the PowerShell ISE opens it will just show a dark blue console pane. Press CTRL+N keys together OR select New from the File menu OR click on the left-most button in the menubar:

Any of these actions will create a new tabbed script pane above the console pane.

3. Copy/paste the following PowerShell script into the top pane:

# Ensure script is running as Admin
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] “Administrator”)) {
Write-Host “Please run the Windows PowerShell ISE using ‘Run as administrator’!” -ForegroundColor Red
exit
}

# Define time range – current example is last 3 days; feel free to change
$startTime = (Get-Date).AddDays(-3)

# Explicitly define key logs to search; feel free to change
$logNames = @(“System”, “Application”, “Security”, “Setup”)

# Get events from specified logs (Levels: Critical, Error, Warning – feel free to change)
$events = @()
foreach ($log in $logNames) {
try {
$logEvents = Get-WinEvent -FilterHashtable @{
LogName = $log
Level = @(1, 2, 3) # Critical (1), Error (2), Warning (3), Information (4), Verbose (5)
StartTime = $startTime
} -ErrorAction SilentlyContinue | Select-Object TimeCreated, LogName, Id, Level, ProviderName, Message

if ($logEvents) {
$events += $logEvents
}
} catch {
Write-Host “Error accessing log: $log – $_” -ForegroundColor Yellow
}
}

# Sort events by TimeCreated
$events = $events | Sort-Object TimeCreated

# Check if any events were found
if ($events.Count -eq 0) {
Write-Host “No Critical, Error, or Warning events found in the last 3 days.” -ForegroundColor Yellow
exit
}

# Prompt for output choice
$choice = Read-Host “Please choose an output format: [1] Screen, [2] Grid, [3] Text File, [4] CSV File”

# Define file paths
$desktopPath = [System.Environment]::GetFolderPath(“Desktop”)
$txtFile = “$desktopPath\Problem_Finder_Report.txt”
$csvFile = “$desktopPath\Problem_Finder_Report.csv”

# Handle output choice
switch ($choice) {
“1” { # Display on screen
$events | Format-Table -AutoSize
}
“2” { # Show in grid view
$events | Out-GridView -Title “Event Log Problem Finder Report”
}
“3” { # Save as TXT
$events | Format-Table -AutoSize | Out-File -FilePath $txtFile
#New-BurntToastNotification -AppLogo C:\Scripts\tick-mark.png -Text “Problem Finder”, ‘Your TXT file has been saved to your desktop.’
Write-Host “Report saved as TXT file: $txtFile” -ForegroundColor Green
}
“4” { # Save as CSV
$events | Export-Csv -Path $csvFile -NoTypeInformation
#New-BurntToastNotification -AppLogo C:\Scripts\tick-mark.png -Text “Problem Finder”, ‘Your CSV file has been saved to your desktop.’
Write-Host “Report saved as CSV file: $csvFile” -ForegroundColor Green
}
default {
#New-BurntToastNotification -AppLogo C:\Scripts\cross-mark.png -Text “Problem Finder”, ‘Invalid choice! Please re-run the script and choose a valid option.’
Write-Host “Invalid choice! Please re-run the script and choose a valid option.” -ForegroundColor Red
}
}

4. Click on the Run button that looks like a green triangle:

5. In the lower pane, respond to the prompt to choose an output option. I suggest you re-run the script many times and try out each of the options.

For example, I find option 2 (Grid) very useful – for example, you can click on each of the column headers to change the sort order – and visually attractive:

That’s about it really.

Notes:

If you think the script is useful then you can save it from within the PowerShell ISE as something like Event_Log_Problem_Finder.ps1 (or whatever you want) so you can re-use it.

* Change the value for $logNames in line 11… but don’t go mad. During testing I tried querying all event logs. It took ages and resulted in a huge CSV file on my desktop… which was too big for LibreOffice Calc to open:

Also, be aware that – as I found during testing – not all logs allow querying by level.

** Change the value for Level in line 19 but, again, don’t go mad. Adding level 4 (Information) and/or 5 (Verbose) will increase the time the script runs and the size of report files saved to your desktop.

*** Change the value for $startTime in line 8 but, once more, don’t go mad… especially if you want to attach a report file to a post. Even querying for just 3 days created 13Kb TXT and CSV files during testing.

**** In practice I ran into several issues whilst testing and ended up using the PowerShell ISE run as administrator.

Finally, ignore lines referring to New-BurntToastNotification. They’re preceded by a hash mark, meaning they have been commented-out and won’t be parsed. I’ve been playing with them for use as visual indicators instead of using different coloured text on screen, for example:

Hope this helps…

Click the link below to download the script as a zipped file.

Event_Log_Problem_Finder

(Remember to right-click on the downloaded zip file and unblock it.)

4 users thanked author for this post.

n0ads, wavy, ECWS, satrow

Reply | Quote

Thanks to your script, I was finally able to ID the specific cause for three recurring items in my log and apply the appropriate fixes to stop them!

1- …failed to register with DCOM within the specified time period.

2- …failed to update a Secure boot variable.

3- …account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

👍

Reply | Quote

n0ads wrote:

Thanks to your script, I was finally able to ID the specific cause for three recurring items in my log and apply the appropriate fixes to stop them!

I’m pleased it helped. I was surprised by how many problems came to light during testing on my own devices.

These included what appeared at first to be possible DNS errors showing in the Time-Service, which I mentioned at the beginning of my post.

However, when I modified the Problem Finder script to look just at Time-Service‘s Operational log, the recorded reason codes showed why… the power state change coming out of sleep when I lifted the lid:

There were two events with ID 266 as the Time-Service looked for the NTP server then a follow-up event ID 264 when it had rediscovered the NTP server.

Checking back shows that this happens every time I close the laptop lid to put it to sleep.. so not DNS errors at all.

The modified script:

# Define time range (last 3 days)
$startTime = (Get-Date).AddDays(-3)

# Define event log and event IDs
$logName = “Microsoft-Windows-Time-Service/Operational”
$eventIDs = @(264, 266)

# Try to retrieve the events
try {
$events = Get-WinEvent -FilterHashtable @{
LogName = $logName
Id = $eventIDs
StartTime = $startTime
} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, Id, Level, ProviderName, Message, LogName |
Sort-Object TimeCreated
} catch {
Write-Host “Error retrieving event logs: $_” -ForegroundColor Red
exit
}

# Check if any events were found
if ($events.Count -eq 0) {
Write-Host “No matching events (IDs 264, 266) found in the last 3 days.” -ForegroundColor Yellow
exit
}

# Prompt user for output choice
$choice = Read-Host “Choose output format: [1] Screen, [2] Grid, [3] Text File, [4] CSV File”

# Define file paths
$desktopPath = [System.Environment]::GetFolderPath(“Desktop”)
$txtFile = “$desktopPath\TimeServiceEvents.txt”
$csvFile = “$desktopPath\TimeServiceEvents.csv”

# Handle output choice
switch ($choice) {
“1” { # Display on screen
$events | Format-Table -AutoSize
}
“2” { # Show in grid view
$events | Out-GridView -Title “Time Service Event Log Report”
}
“3” { # Save as TXT
$events | Format-Table -AutoSize | Out-File -FilePath $txtFile
Write-Host “Report saved as TXT file: $txtFile” -ForegroundColor Green
}
“4” { # Save as CSV
$events | Export-Csv -Path $csvFile -NoTypeInformation
Write-Host “Report saved as CSV file: $csvFile” -ForegroundColor Green
}
default {
Write-Host “Invalid choice! Please run the script again and choose a valid option.” -ForegroundColor Red
}
}

Hope this helps…

Reply | Quote