Windows Event ID 105 – Microsoft-Windows-Kernel-Power: System Power State Transition

Start by examining the specific details of Event ID 105 to understand the power transition context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 105 in the Event IDs field and click OK
5. Double-click on recent Event ID 105 entries to view detailed information
6. Examine the General tab for power state codes and transition reasons
7. Check the Details tab for XML data containing power source information and system capabilities
8. Note the timestamp patterns to identify if power transitions are occurring at expected intervals

Use PowerShell to extract and analyze power transition patterns from Event ID 105 logs.

1. Open PowerShell as Administrator
2. Query recent power events with detailed information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=105} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

3. Extract specific power state information from event data:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=105} -MaxEvents 20 | ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
        Time = $_.TimeCreated
        PowerState = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PowerState'} | Select-Object -ExpandProperty '#text'
        Reason = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PowerTransitionReason'} | Select-Object -ExpandProperty '#text'
        Source = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'PowerSource'} | Select-Object -ExpandProperty '#text'
    }
}

4. Export power event data for analysis:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=105} -MaxEvents 100 | Export-Csv -Path "C:\temp\PowerEvents.csv" -NoTypeInformation

Adjust Windows power management settings to control when and how power state transitions occur.

1. Open Settings → System → Power & battery (Windows 11) or Power & sleep (Windows 10)
2. Click Additional power settings to open the classic Power Options control panel
3. Select Change plan settings for your active power plan
4. Click Change advanced power settings
5. Expand Sleep settings and configure:
• Sleep after: Set appropriate timeout values
• Allow hybrid sleep: Enable or disable based on requirements
• Hibernate after: Configure hibernate timeout
6. Expand Power buttons and lid to configure physical button behavior
7. Use PowerShell to view current power configuration:

powercfg /query

8. Generate a power efficiency report to identify issues:

powercfg /energy /output "C:\temp\energy-report.html"

9. Create a sleep study report for modern standby analysis:

powercfg /sleepstudy /output "C:\temp\sleepstudy.html"

Identify what devices and processes are preventing or causing power state transitions.

1. Check current wake sources using PowerShell:

powercfg /waketimers

2. List devices that can wake the system:

powercfg /devicequery wake_armed

3. View active power requests preventing sleep:

powercfg /requests

4. Examine the last wake source:

powercfg /lastwake

5. Disable wake capability for problematic devices:

powercfg /devicedisablewake "Device Name"

6. Check Task Scheduler for wake-enabled tasks:
• Open Task Scheduler
• Navigate to Task Scheduler Library
• Look for tasks with Wake the computer to run this task enabled
• Review and modify wake settings as needed
7. Monitor network adapter wake settings in Device Manager:
• Open Device Manager
• Expand Network adapters
• Right-click your network adapter → Properties
• Go to Power Management tab
• Configure wake-on-LAN settings appropriately

Perform deep analysis of power events and system configuration for complex power management issues.

1. Create a comprehensive power event timeline:

$StartTime = (Get-Date).AddDays(-7)
$PowerEvents = @(105, 107, 109, 1074, 6005, 6006, 6008)
$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=$PowerEvents; StartTime=$StartTime} | Sort-Object TimeCreated
$Events | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv "C:\temp\PowerTimeline.csv"

2. Examine power management registry settings:

Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Control\Power" | Format-List

3. Check power policy registry entries:

Get-ChildItem -Path "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings" -Recurse | Where-Object {$_.Property -contains "ACSettingIndex" -or $_.Property -contains "DCSettingIndex"}

4. Analyze system firmware power capabilities:

powercfg /availablesleepstates

5. Generate battery report for mobile devices:

powercfg /batteryreport /output "C:\temp\battery-report.html"

6. Check for power-related Windows updates and driver issues:

Get-WmiObject -Class Win32_QuickFixEngineering | Where-Object {$_.Description -like "*Power*" -or $_.HotFixID -like "*KB*"} | Sort-Object InstalledOn -Descending

7. Monitor real-time power events using WEvtUtil:

wevtutil qe System "/q:*[System[EventID=105]]" /f:text /rd:true /c:10