Hacker's ramblings

Problem

My gaming PC got the fall update quite late and after that it wouldn't stay in sleep. Something got broken in the update and I had to shut it down every single time I didn't want to use it. Annoying!

Debugging - The Reason

The reason it popped back on wasn't big of a mystery. There is a simple command to query the wake reason:

PS C:\WINDOWS\system32> .\powercfg.exe /waketimers
Timer set by [SERVICE] \Device\HarddiskVolume4\Windows\System32\svchost.exe (SystemEventsBroker) expires at 21:46:29 on 15.12.2017.
Reason: Windows will execute 'NT TASK\Microsoft\Windows\UpdateOrchestrator\Reboot' scheduled task that requested waking the computer.

There are number of articles about How to disable wake timers?, but it doesn't fix this.

A peek into Windows Task Scheduler reveals the ugly fact:

There is a hourly scheduled task, that indeed does run every hour and every goddamn hour it will wake my computer from the sleep to see if it needs to reboot it! Who having half a brain made that engineering decision at Microsoft?!

Attempt 1 - Disable the task - FAIL!

Ok, easy thing, let's disable the task. Or ... let's not. It is impossible! The permissions prevent regular human beings from doing that.

After a while, I bumped into somebody else having this same particular problem. Computer is waking up and: Can't modify task “Reboot” in win10 home. Basically, the idea is to go get Sysinternals PStools. It contains a tool called PSexec, which can do the modification for you.

Like this:

First run a cmd.exe with the PSexec 64-bit version:

PS D:\Users\Downloads> .\PsExec64.exe /s cmd.exe

Now, that permission-barrier is fixed, then:

C:\WINDOWS\system32>schtasks /change /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot" /disable
SUCCESS: The parameters of scheduled task "\Microsoft\Windows\UpdateOrchestrator\Reboot" have been changed.

Now the stupid scheduled task is running hourly as expected, but NOT when your computer is sleeping. But ... guess what! Yes! There is something in Windows 10 internals, that keeps that particular task enabled. It will stay disabled for half an hour or so, but ultimately just using the computer makes the task enabled again, and the problem persists.

Attempt 2 - Remove the allow wake setting - FAIL!

By using the PsExec64.exe-trick, it is possible to get an XML-representation of the task, by running:
schtasks /tn "\Microsoft\Windows\UpdateOrchestrator\Reboot" /xml
in the XML-data there is:
<WakeToRun>true</WakeToRun>
... but I don't know how to change a task from XML-file. You can create a new one, but changing seems impossible.

So, ultimately I had to find something else

Attempt 3 - Powershell - FAIL!

Instead of spawning a new cmd.exe, going for PowerShell has benefits - it can actually edit an existing task. There is a built-in applet Get-ScheduledTask, with appropriate counterpart for setting the properties.

Spawn a nice PowerShell-session with appropriate permissions:

.\PsExec64.exe /s powershell.exe

The shell is kinda dead, for example output is garbled and input editing has issues, but if you know what to run, it will do it given the correct permissions.

As suggested in use powershell to find scheduled tasks set to wake the computer, now it is possible to get a list of Scheduled Tasks which have permission to wake the computer:

PS C:\WINDOWS\system32> Get-ScheduledTask | where {$_.settings.waketorun}

My computer will output a list like:

TaskPath                               TaskName
--------                               --------
\Microsoft\Windows\.NET Framework\     .NET Framework NGEN v4.0.3031...
\Microsoft\Windows\.NET Framework\     .NET Framework NGEN v4.0.3031...
\Microsoft\Windows\SharedPC\           Account Cleanup
\Microsoft\Windows\UpdateOrchestrator\ Reboot

A simple(?) one-liner will edit the task (backtick is the word-wrap operator):

Get-ScheduledTask `
  -TaskPath \Microsoft\Windows\UpdateOrchestrator\ `
  -TaskName Reboot |
  %{ $_.Settings.WakeToRun = $false ; `
  Set-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath -Settings $_.Settings }

Yes, now the task is enabled, but has the appropriate condition setting for allow wake the computer from sleep disabled.

... aaaand it doesn't work. The same thing altering the enabled-state also resets this setting. Darn!

Attempt 4 - Revoke permissions - Success!

This was driving me mad!

It worked perfectly before the stupid update!

Finally, I found an article from Reddit: Is there ANY way to stop UpdateOrchestrator for turning 'wake the computer to run this task' back on after every cumulative update?

That guy suggested to revoke all permissions from the file. Now the automator which keeps resetting the settings fails to touch the file.

The command I ran in PowerShell is:

icacls $env:windir"\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot" `
  /inheritance:r `
  /deny "Everyone:F" `
  /deny "SYSTEM:F" `
  /deny "Local Service:F" `
  /deny "Administrators:F"

That simply puts everybody and everything into deny-list for the file-access. AND IT WORKS!

So, looks like ultimately whatever the mechanism is restoring the setting, somebody loves writing to the file, but it doesn't know how to reset the permissions. Which is nice!

I chose to keep the task enabled, but unset the allow wake -setting. So, when my computer is running, the task is ran every hour as expected, but when my computer is sleeping, my computer is sleeping and doesn't wake for nobody.

Microsoft:
Suggestion, eat your own dog food! If anybody at the Windows-team doing power management/task scheduler would run this at home they would know the annoyance instantly.