Windows Event ID 45 – Kernel-Power: System Power State Transition

Start by examining the specific Event ID 45 entries to understand the power transition context:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 45 in the Event IDs field and click OK
5. Double-click on recent Event ID 45 entries to view detailed information
6. Note the Event Data section which contains power state codes and transition details
7. Check the timestamp correlation with any system issues you're investigating

PowerShell provides powerful filtering and analysis capabilities for Event ID 45:

1. Open PowerShell as Administrator
2. Query recent Event ID 45 entries:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=45} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Analyze power state transitions over a specific time period:

   $StartTime = (Get-Date).AddDays(-7)
   $Events = Get-WinEvent -FilterHashtable @{LogName='System'; Id=45; StartTime=$StartTime}
   $Events | Group-Object {$_.TimeCreated.Date} | Sort-Object Name

4. Export detailed event data for analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=45} -MaxEvents 100 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path "C:\Temp\PowerEvents.csv" -NoTypeInformation

5. Check for correlating events around power transitions:

   Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=(Get-Date).AddHours(-1)} | Where-Object {$_.Id -in @(1, 6, 12, 42, 45, 107)} | Sort-Object TimeCreated

Investigate current power management settings that may be causing frequent Event ID 45 entries:

1. Check current power scheme settings:

   powercfg /query

2. List all available power schemes:

   powercfg /list

3. Generate a detailed power configuration report:

   powercfg /energy /output "C:\Temp\energy-report.html"

4. Check sleep study information (Windows 10/11):

   powercfg /sleepstudy /output "C:\Temp\sleepstudy-report.html"

5. Review wake timers and their sources:

   powercfg /waketimers

6. Examine devices that can wake the system:

   powercfg /devicequery wake_armed

7. Check the registry for power policy settings:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Power" -Name "*"

Power state transition problems often stem from hardware or driver conflicts:

1. Check Device Manager for power management issues:
   • Open Device Manager (devmgmt.msc)
   • Look for devices with warning icons or error states
   • Right-click problematic devices and select Properties
   • Check the Power Management tab settings
2. Review system hardware using PowerShell:

   Get-WmiObject -Class Win32_SystemEnclosure | Select-Object ChassisTypes, Manufacturer, Model
   Get-WmiObject -Class Win32_Battery | Select-Object Name, BatteryStatus, EstimatedChargeRemaining

3. Check for driver issues in Device Manager and update outdated drivers
4. Run Windows Memory Diagnostic:

   mdsched.exe

5. Examine system file integrity:

   sfc /scannow
   Dism /Online /Cleanup-Image /CheckHealth

6. Review BIOS/UEFI power management settings and ensure they're compatible with Windows power policies

Set up comprehensive monitoring for power-related events and their correlation:

1. Create a custom Event Viewer view for power events:
   • In Event Viewer, right-click Custom Views and select Create Custom View
   • Select By log and choose System
   • In Event IDs, enter: 1,6,12,42,45,107,109,1074
   • Name the view "Power Management Events"
2. Configure PowerShell logging for automated monitoring:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='System'; Id=45} -MaxEvents 1 | Out-File -Append C:\Logs\PowerEvents.log"
   $Trigger = New-ScheduledTaskTrigger -AtLogOn
   Register-ScheduledTask -TaskName "PowerEventLogger" -Action $Action -Trigger $Trigger

3. Set up Windows Performance Toolkit (WPT) for detailed power analysis:
   • Download and install Windows Performance Toolkit from Windows SDK
   • Use Windows Performance Analyzer (WPA) to analyze power transitions
   • Create custom power management traces using wpr.exe
4. Configure registry monitoring for power policy changes:

   $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Power"
   Get-Acl $RegPath | Set-Acl $RegPath

5. Implement Group Policy monitoring for enterprise environments to track power policy deployment and compliance