UpdateOrchestrator waking up the machine

~ afish

Recently I was investigating machine waking up from sleep without any user interaction. It was a bit irritating because user was putting his PC to sleep and leaving it for a day just to notice in the evening that the machine woke up and was on for most of the time.

Event viewer showed this:

So it looks like there was some update task waking the computer. After opening the Task Scheduler we could see this:

There are two important things you can see (even though screenshot is in Polish). First, owner of the task is NT SYSTEM. Second, it is scheduled to run at 8:58 AM.

So we know why the machine was waking up. How can we disable the task? Starting Task Scheduler as an administrator didn’t allow us to disable the task.

The thing is: Administrator is not the most powerful account in Windows. SYSTEM account has more privileges and we need to use it to disable the task. How do we run Task Scheduler as NT SYSTEM?

I typically use psexec from Sysinternals. Just run this command:

This opens management console. Add snap-in for Task Scheduler and you are good to go. Now you can disable the task and see that it solves the issue.