none
Was device started via WOL? RRS feed

  • Question

  • Hey,

    is there a way to check by script (e.g. PowerShell / VBS) if the device was started via WOL or manually?
    This would be a great information for automation tasks :)

    Thank you
    Wednesday, August 17, 2016 8:54 AM

Answers

  • Thanks both.

    I have done some tests with 6 differnet devices here, too and it seems to depend on a lot of different factors.

    Since I plan to use the script in combination with SCCM WOL & TaskSequence it is not usable practice to check with about 12000 devices a central log if they have been waked up.

    My current "workaround" is not to check if the device was WOL, but to check if there is an interactive domain user currently logged on.
    I think the method has some cons but some pros, too.

    Thanks for your support
    • Marked as answer by MK-Maddin Monday, August 29, 2016 5:26 PM
    Wednesday, August 17, 2016 1:36 PM

All replies

  • Hi MK,

    I highly doubt that there is a way to do this. WOL is configured on your driver, so your network card sends a power-up signal to the mainboard when triggered. Unless your network card implements a way to present this information, there is little hope of retrieving it.

    Cheers,
    Fred

    PS: However you can log your WOL requests and then compare it to the timestamp of boot events. This would allow correlation of events.


    There's no place like 127.0.0.1

    Wednesday, August 17, 2016 10:30 AM
  • hm..I am having a big number of devices with differnet a lot of network cards & drivers, too.
    So I think "asking" the driver might not be the best idea...

    Could you please describe more detailed about "log" my WOL requests?
    Wednesday, August 17, 2016 10:38 AM
  • Look in event logs.  When the Adapter causes a wakeup there should be a logged event.

    \_(ツ)_/

    Wednesday, August 17, 2016 11:41 AM
  • Look in event logs.  When the Adapter causes a wakeup there should be a logged event.

    Tested it on my notebook (Win 10 on HP hardware) - no event logged in system or application logs ...

    Could you please describe more detailed about "log" my WOL requests?

    Sure thing: Whenever you send a WOL request, write that down. We use a function I wrote in PowerShell for sending WOL requests, adding an automatic logging functionality wasn't that hard in that scenario. Automating this when you use a third-party software may be a bit harder though.


    There's no place like 127.0.0.1

    Wednesday, August 17, 2016 12:11 PM
  • Log Name:      System
    Source:        Microsoft-Windows-Power-Troubleshooter
    Date:          8/17/2016 6:47:12 AM
    Event ID:      1
    Task Category: None
    Level:         Information
    Keywords:      
    User:          LOCAL SERVICE
    Computer:      ALPHA
    Description:
    The system has returned from a low power state.
    
    Sleep Time: ‎2016‎-‎08‎-‎17T07:04:53.934295800Z
    Wake Time: ‎2016‎-‎08‎-‎17T10:47:10.039629800Z
    
    Wake Source: Power Button
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Power-Troubleshooter" Guid="{CDC05E28-C449-49C6-B9D2-88CF761644DF}" />
        <EventID>1</EventID>
        <Version>2</Version>
        <Level>4</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000000000000000</Keywords>
        <TimeCreated SystemTime="2016-08-17T10:47:12.388155400Z" />
        <EventRecordID>4187</EventRecordID>
        <Correlation ActivityID="{48AF2FAB-9DCC-455D-9F7A-A6101386B772}" />
        <Execution ProcessID="1220" ThreadID="8644" />
        <Channel>System</Channel>
        <Computer>ALPHA</Computer>
        <Security UserID="S-1-5-19" />
      </System>
      <EventData>
        <Data Name="SleepTime">2016-08-17T07:04:53.934295800Z</Data>
        <Data Name="WakeTime">2016-08-17T10:47:10.039629800Z</Data>
        <Data Name="SleepDuration">1395</Data>
        <Data Name="WakeDuration">539</Data>
        <Data Name="DriverInitDuration">375</Data>
        <Data Name="BiosInitDuration">0</Data>
        <Data Name="HiberWriteDuration">0</Data>
        <Data Name="HiberReadDuration">0</Data>
        <Data Name="HiberPagesWritten">0</Data>
        <Data Name="Attributes">19468</Data>
        <Data Name="TargetState">4</Data>
        <Data Name="EffectiveState">4</Data>
        <Data Name="WakeSourceType">1</Data>
        <Data Name="WakeSourceTextLength">0</Data>
        <Data Name="WakeSourceText">
        </Data>
        <Data Name="WakeTimerOwnerLength">0</Data>
        <Data Name="WakeTimerContextLength">0</Data>
        <Data Name="NoMultiStageResumeReason">0</Data>
        <Data Name="WakeTimerOwner">
        </Data>
        <Data Name="WakeTimerContext">
        </Data>
      </EventData>
    </Event>

    The wake source will be Power Button even when the keyboard was used. 

    Also the following records are generated when hardware wakes the system:

    Log Name:      System
    Source:        Microsoft-Windows-Kernel-Power
    Date:          8/17/2016 2:32:27 AM
    Event ID:      107
    Task Category: (102)
    Level:         Information
    Keywords:      (70368744177664),(1024),(64),(4)
    User:          N/A
    Computer:      ALPHA
    Description:
    The system has resumed from sleep.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-Power" Guid="{331C3B3A-2005-44C2-AC5E-77220C37D6B4}" />
        <EventID>107</EventID>
        <Version>1</Version>
        <Level>4</Level>
        <Task>102</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8000400000000444</Keywords>
        <TimeCreated SystemTime="2016-08-17T06:32:27.599253100Z" />
        <EventRecordID>4161</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="15564" />
        <Channel>System</Channel>
        <Computer>ALPHA</Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="TargetState">4</Data>
        <Data Name="EffectiveState">4</Data>
        <Data Name="WakeFromState">4</Data>
        <Data Name="ProgrammedWakeTimeAc">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="ProgrammedWakeTimeDc">1601-01-01T00:00:00.000000000Z</Data>
        <Data Name="WakeRequesterTypeAc">0</Data>
        <Data Name="WakeRequesterTypeDc">0</Data>
      </EventData>
    </Event>


    \_(ツ)_/


    • Edited by jrv Wednesday, August 17, 2016 12:29 PM
    Wednesday, August 17, 2016 12:26 PM
  • Well, I only receive those when waking the machine from Standby (and it doesn't differentiate between causes that wake it - both WakeRequesterType remain "0", WakeSourceType is also "0". Text interprets it as "Reactivation Source: Unknown"). Anything else that needs to be configured for it to write those as they apparently should with precise information for WOL? Or well ... maybe it does need to be configured on the UEFI ...


    There's no place like 127.0.0.1

    Wednesday, August 17, 2016 1:17 PM
  • Thanks both.

    I have done some tests with 6 differnet devices here, too and it seems to depend on a lot of different factors.

    Since I plan to use the script in combination with SCCM WOL & TaskSequence it is not usable practice to check with about 12000 devices a central log if they have been waked up.

    My current "workaround" is not to check if the device was WOL, but to check if there is an interactive domain user currently logged on.
    I think the method has some cons but some pros, too.

    Thanks for your support
    • Marked as answer by MK-Maddin Monday, August 29, 2016 5:26 PM
    Wednesday, August 17, 2016 1:36 PM