Windows Event ID 30 – Kernel-Power: System Power State Transition

Start by examining the specific power transition details recorded in the event.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions panel
4. Enter 30 in the Event IDs field and click OK
5. Double-click on recent Event ID 30 entries to examine the details
6. Review the General tab for power state information and the Details tab for XML data
7. Look for patterns in timing, frequency, and associated events immediately before or after

Use PowerShell to extract and analyze power transition data programmatically.

1. Open PowerShell as Administrator
2. Query recent Event ID 30 entries:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=30; StartTime=(Get-Date).AddDays(-7)} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

3. For detailed power state analysis:

   $Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=30; StartTime=(Get-Date).AddDays(-1)}
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       Write-Host "Time: $($Event.TimeCreated) - Power Transition Detected"
       Write-Host "Details: $($Event.Message)"
       Write-Host "---"
   }

4. Count power transitions by day:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=30; StartTime=(Get-Date).AddDays(-30)} | Group-Object {$_.TimeCreated.Date} | Sort-Object Name

Examine system power settings that control when and how power transitions occur.

1. Open Control Panel → Power Options or search for "Power & sleep settings"
2. Click Additional power settings to access advanced options
3. Select your current power plan and click Change plan settings
4. Click Change advanced power settings to review detailed configuration
5. Check these key settings:
   • Sleep → Sleep after and Hibernate after timers
   • USB settings → USB selective suspend setting
   • Power buttons and lid → Power button and lid close actions
   • Display → Turn off display after settings
6. Use PowerShell to audit current power configuration:

   powercfg /query
   powercfg /availablesleepstates
   powercfg /devicequery wake_armed

7. Generate a power efficiency report:

   powercfg /energy /output C:\temp\energy-report.html

Identify what devices or processes are causing unexpected power state changes.

1. Check what woke the system from sleep:

   powercfg /lastwake

2. List all devices capable of waking the system:

   powercfg /devicequery wake_armed

3. Review wake timers and scheduled tasks:

   powercfg /waketimers

4. Disable specific wake sources if needed:

   # Disable network adapter wake capability
   powercfg /devicedisablewake "Intel(R) Ethernet Connection"
   # Disable USB wake capability
   powercfg /devicedisablewake "USB Root Hub"

5. Check for applications preventing sleep:

   powercfg /requests

6. Monitor real-time power events:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=30} -MaxEvents 1 | Format-List *

Implement comprehensive monitoring to correlate Event ID 30 with other system events and performance metrics.

1. Create a PowerShell script for continuous monitoring:

   # PowerShell script: Monitor-PowerEvents.ps1
   $LogName = 'System'
   $EventID = 30
   $OutputFile = "C:\temp\PowerTransitions.csv"
   
   Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent" -Action {
       $Event = Get-WinEvent -FilterHashtable @{LogName=$LogName; Id=$EventID} -MaxEvents 1
       $Event | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv $OutputFile -Append -NoTypeInformation
   }

2. Set up Windows Performance Toolkit (WPT) tracing for detailed power analysis:

   # Start power tracing
   wpr -start power -filemode
   # Stop after collecting data
   wpr -stop C:\temp\power-trace.etl

3. Configure custom Event Log views in Event Viewer:
   • Right-click Custom Views → Create Custom View
   • Set Event Level to Information
   • Add Event ID 30 and related power events (1, 42, 107)
   • Save as "Power Management Events"
4. Use Group Policy to standardize power settings across domain computers:
   • Open gpedit.msc or Group Policy Management Console
   • Navigate to Computer Configuration → Administrative Templates → System → Power Management
   • Configure sleep and hibernation policies consistently
5. Implement SIEM correlation rules to alert on abnormal power transition patterns