Windows Event ID 29 – Kernel-Power: Critical System Power Event

Start by examining the specific details of Event ID 29 to understand the exact power condition that triggered the alert.

Step 1: Open Event Viewer and navigate to Windows Logs → System. Filter for Event ID 29 from source Kernel-Power.

Step 2: Use PowerShell to extract detailed event information:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=29; ProviderName='Microsoft-Windows-Kernel-Power'} -MaxEvents 10 | Format-List TimeCreated, Id, LevelDisplayName, Message

Step 3: Check current system power status and thermal conditions:

Get-WmiObject -Class Win32_Battery | Select-Object Name, BatteryStatus, EstimatedChargeRemaining
Get-Counter "\Thermal Zone Information(*)\Temperature" -ErrorAction SilentlyContinue

Step 4: Review Windows Power Efficiency Diagnostics:

powercfg /energy /output C:\temp\energy-report.html
powercfg /batteryreport /output C:\temp\battery-report.html

Perform comprehensive hardware diagnostics to identify failing power delivery components.

Step 1: Check system hardware health using built-in diagnostics:

sfc /scannow
Dism /Online /Cleanup-Image /CheckHealth
chkdsk C: /f /r

Step 2: Monitor real-time power consumption and voltage levels:

Get-Counter "\Processor Information(_Total)\% Processor Time", "\Memory\Available MBytes", "\PhysicalDisk(_Total)\% Disk Time" -Continuous

Step 3: Access UEFI/BIOS power monitoring (if available through WMI):

Get-WmiObject -Namespace root\wmi -Class MSAcpi_ThermalZoneTemperature | Select-Object InstanceName, CurrentTemperature

Step 4: Check for hardware-specific power management drivers:

Get-WmiObject Win32_SystemDriver | Where-Object {$_.Name -like "*power*" -or $_.Name -like "*acpi*"} | Select-Object Name, State, Status

Examine and optimize Windows power management settings to prevent power-related instability.

Step 1: Review current power scheme configuration:

powercfg /list
powercfg /query SCHEME_CURRENT
powercfg /qh SCHEME_CURRENT

Step 2: Check for problematic power management policies:

powercfg /requests
powercfg /waketimers
powercfg /devicequery wake_armed

Step 3: Examine registry power management settings:

Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Power and review:

• CsEnabled - Connected Standby configuration
• HibernateEnabled - Hibernation settings
• PowerButtonAction - Power button behavior

Step 4: Reset power management to default safe configuration:

powercfg /restoredefaultschemes
powercfg /setactive SCHEME_BALANCED

Step 5: Disable aggressive power saving features that may cause instability:

powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN 100
powercfg /setdcvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN 100
powercfg /setactive SCHEME_CURRENT

Correlate Event ID 29 with other system events to identify the underlying cause of power issues.

Step 1: Create a comprehensive event timeline around the power event:

$StartTime = (Get-Date).AddHours(-2)
$EndTime = Get-Date
Get-WinEvent -FilterHashtable @{LogName='System','Application'; StartTime=$StartTime; EndTime=$EndTime} | Where-Object {$_.Id -in @(29,41,1074,6008,6009,6013)} | Sort-Object TimeCreated

Step 2: Check for hardware error events that precede Event ID 29:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Processor-Power','Microsoft-Windows-Kernel-General'} -MaxEvents 50

Step 3: Analyze Windows Error Reporting (WER) data for power-related crashes:

Get-ChildItem "C:\ProgramData\Microsoft\Windows\WER\ReportQueue" | Where-Object {$_.Name -like "*Power*" -or $_.Name -like "*Kernel*"}

Step 4: Export comprehensive power event data for analysis:

$Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=29} -MaxEvents 100
$Events | Export-Csv "C:\temp\PowerEvents.csv" -NoTypeInformation
$Events | ConvertTo-Json | Out-File "C:\temp\PowerEvents.json"

Investigate data center and infrastructure components that may be causing power delivery issues.

Step 1: Check UPS and PDU status using SNMP monitoring (if available):

Get-WmiObject -Class Win32_Battery | Select-Object Name, Chemistry, DesignCapacity, FullChargeCapacity, BatteryStatus
Get-WmiObject -Class Win32_UninterruptiblePowerSupply

Step 2: Monitor system power consumption trends:

Get-Counter "\Power Meter(*)\Power" -ErrorAction SilentlyContinue
Get-Counter "\Thermal Zone Information(*)\Temperature" -SampleInterval 5 -MaxSamples 60

Step 3: Create a power monitoring script for continuous surveillance:

while ($true) {
    $PowerEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=29; StartTime=(Get-Date).AddMinutes(-5)} -ErrorAction SilentlyContinue
    if ($PowerEvents) {
        $PowerEvents | Select-Object TimeCreated, Id, LevelDisplayName | Export-Csv "C:\logs\PowerMonitor.csv" -Append -NoTypeInformation
        Write-Host "CRITICAL: Event ID 29 detected at $(Get-Date)" -ForegroundColor Red
    }
    Start-Sleep 60
}

Step 4: Document environmental conditions and correlate with events:

• Record ambient temperature and humidity levels
• Check for electrical work or power grid issues in the area
• Verify UPS battery age and last replacement date
• Review data center power load distribution

Step 5: Implement preventive monitoring using Windows Admin Center or SCOM:

Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2" -Action {Write-Host "Power event detected: $($Event.SourceEventArgs.NewEvent)"}