Windows Event ID 1038 – Kernel-Power: Critical System Power Event

Start by examining the specific details of Event ID 1038 to understand the power event context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log for Event ID 1038 by right-clicking System → Filter Current Log → enter 1038 in Event IDs field
4. Double-click the most recent Event ID 1038 entry to view detailed information
5. Examine the General tab for power state data, including:
   • System power state at time of event
   • Connected power sources (AC, battery, UPS)
   • Power policy settings active during the event
   • Timestamp correlation with other system events
6. Check the Details tab for additional diagnostic data including voltage readings and power draw information

Use PowerShell to extract detailed event information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1038} -MaxEvents 5 | Format-List TimeCreated, Id, LevelDisplayName, Message

Verify system power configuration and connected UPS devices to identify potential power infrastructure issues.

1. Open Control Panel → Hardware and Sound → Power Options
2. Click Change plan settings for your active power plan, then Change advanced power settings
3. Review critical power settings:
   • Critical battery action - should be set to Hibernate or Shutdown
   • Low battery level - verify appropriate percentage threshold
   • Critical battery level - ensure sufficient warning time
4. Check UPS status using PowerShell:

# Check battery/UPS status
Get-WmiObject -Class Win32_Battery | Select-Object Name, BatteryStatus, EstimatedChargeRemaining, EstimatedRunTime

# Check power supply information
Get-WmiObject -Class Win32_PowerSupply | Select-Object Name, TotalOutputPower, TypeOfSwitching

5. For systems with UPS software installed, check UPS management software logs and configuration
6. Verify UPS battery health and last maintenance date
7. Test UPS functionality by safely disconnecting AC power while system is running

Investigate thermal-related shutdowns and hardware health issues that can trigger critical power events.

1. Check system temperature using PowerShell WMI queries:

# Check thermal zone temperatures
Get-WmiObject -Namespace "root/WMI" -Class MSAcpi_ThermalZoneTemperature | Select-Object InstanceName, @{Name="Temperature(C)"; Expression={($_.CurrentTemperature/10)-273.15}}

# Check fan speeds and power consumption
Get-WmiObject -Class Win32_Fan | Select-Object Name, DesiredSpeed, VariableSpeed

2. Open Device Manager and check for hardware errors:
   • Expand System devices and look for warning icons
   • Check Batteries section for battery health issues
   • Examine Power management devices for driver problems
3. Use built-in hardware diagnostics:

# Run memory diagnostic (requires restart)
mdsched.exe

# Check disk health
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId, Temperature, PowerOnHours

4. Review Reliability Monitor by typing perfmon /rel in Run dialog
5. Look for patterns of critical events, hardware failures, or application crashes preceding power events
6. Check BIOS/UEFI settings for thermal protection thresholds and power management options

Examine power management policies and drivers that may cause improper power state transitions.

1. Generate detailed power configuration report:

# Create comprehensive power report
powercfg /energy /output C:\PowerReport.html

# Generate battery report (laptops)
powercfg /batteryreport /output C:\BatteryReport.html

# Check power requests preventing sleep
powercfg /requests

2. Review power policy settings using PowerShell:

# List all power schemes
powercfg /list

# Export current power scheme for analysis
powercfg /export C:\CurrentPowerScheme.pow

# Check specific power settings
powercfg /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX

3. Examine power management drivers:
   • Open Device Manager → System devices
   • Right-click ACPI-Compliant System → Properties → Driver tab
   • Check driver date and version, update if outdated
   • Review Power Management tab settings for USB and network devices
4. Check for conflicting power management software:
   • Review installed programs for third-party power management utilities
   • Disable or uninstall conflicting power management applications
   • Check manufacturer-specific power management software (Dell Power Manager, HP Power Assistant, etc.)
5. Update system BIOS/UEFI firmware to latest version for improved power management

Set up comprehensive monitoring and logging to capture detailed power event data for ongoing analysis.

1. Enable advanced power logging in the registry:

# Enable detailed power logging
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Power" -Name "PowerLogging" -Value 1 -Type DWord

# Enable power button logging
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Power" -Name "PowerButtonLogging" -Value 1 -Type DWord

2. Create custom Event Log monitoring with PowerShell:

# Create scheduled task to monitor power events
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\PowerEventMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "PowerEventMonitor" -Action $Action -Trigger $Trigger -Settings $Settings

3. Set up Windows Performance Monitor (PerfMon) counters for power monitoring:
   • Open Performance Monitor from Administrative Tools
   • Add counters: Power Meter → Power, Thermal Zone Information → Temperature
   • Configure data collector set to log power metrics continuously
4. Configure Event Log forwarding for centralized monitoring:

# Configure Windows Event Forwarding (WEF)
wecutil qc /q

# Create custom subscription for power events
wecutil cs PowerEventSubscription.xml

5. Implement automated alerting using PowerShell and Task Scheduler:
   • Create PowerShell script to check for Event ID 1038 and send email alerts
   • Schedule script to run every 15 minutes during business hours
   • Include power event details, system information, and recommended actions in alerts
6. Document power event patterns and create baseline metrics for comparison