Windows Event ID 98 – System: Processor Thermal Throttling Event

Start by examining the specific Event ID 98 details to understand the thermal throttling context:

1. Open Event Viewer → Windows Logs → System
2. Filter for Event ID 98 using the filter option
3. Double-click the most recent Event ID 98 entry to view detailed information
4. Note the processor cores affected and throttling duration
5. Use PowerShell to query recent thermal events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=98} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Check current system temperatures using built-in Windows tools:

Get-WmiObject -Namespace "root/WMI" -Class MSAcpi_ThermalZoneTemperature | Select-Object InstanceName, CurrentTemperature

Investigate processor performance states and thermal behavior patterns:

1. Open Performance Monitor (perfmon.exe)
2. Add counters for Processor Information → % Processor Performance
3. Add Thermal Zone Information → Temperature counters
4. Monitor for 15-30 minutes during typical workloads
5. Use PowerShell to check processor power management settings:

powercfg /query SCHEME_CURRENT SUB_PROCESSOR

Check thermal throttling frequency with WMI:

Get-WmiObject -Class Win32_PerfRawData_Counters_ThermalZoneInformation | Select-Object Name, Temperature, ThrottleReasons

Review processor frequency scaling behavior:

Get-Counter "\Processor Information(_Total)\% Processor Performance" -SampleInterval 5 -MaxSamples 12

Perform physical inspection and hardware diagnostics to identify cooling issues:

1. Shut down the system safely and inspect internal components
2. Check CPU cooler mounting and thermal paste condition
3. Verify all case fans are operational and properly connected
4. Clean dust from heat sinks, fans, and air intake filters
5. Use hardware monitoring tools to verify fan speeds:

Get-WmiObject -Namespace "root/OpenHardwareMonitor" -Class Sensor | Where-Object {$_.SensorType -eq "Fan"} | Select-Object Name, Value

Check system power settings that may affect thermal management:

powercfg /query SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX

Verify thermal interface and cooling capacity:

1. Document current CPU temperatures under load
2. Compare against manufacturer specifications
3. Consider thermal paste replacement if temperatures exceed 80°C under normal load
4. Evaluate cooling solution adequacy for current processor TDP

Identify processes and workloads contributing to thermal throttling events:

1. Use Task Manager to identify high CPU usage processes during thermal events
2. Correlate Event ID 98 timestamps with process activity:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, WorkingSet

Monitor processor usage patterns around thermal events:

$thermalEvents = Get-WinEvent -FilterHashtable @{LogName='System'; Id=98; StartTime=(Get-Date).AddDays(-7)}
foreach ($event in $thermalEvents) {
    Write-Host "Thermal event at: $($event.TimeCreated)"
    Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$event.TimeCreated.AddMinutes(-5); EndTime=$event.TimeCreated.AddMinutes(5)} | Where-Object {$_.Id -eq 7036 -or $_.Id -eq 7040}
}

Check for malware or runaway processes:

Get-WmiObject Win32_Process | Where-Object {$_.PageFileUsage -gt 100000} | Select-Object Name, ProcessId, PageFileUsage, CreationDate

Review scheduled tasks that may cause thermal spikes:

Get-ScheduledTask | Where-Object {$_.State -eq "Running"} | Select-Object TaskName, TaskPath, State

Implement advanced thermal management policies and monitoring solutions:

1. Configure processor power management for thermal optimization:

powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMAX 90
powercfg /setacvalueindex SCHEME_CURRENT SUB_PROCESSOR PROCTHROTTLEMIN 10
powercfg /setactive SCHEME_CURRENT

Set up proactive thermal monitoring with custom PowerShell script:

$thermalThreshold = 85
while ($true) {
    $temp = Get-WmiObject -Namespace "root/WMI" -Class MSAcpi_ThermalZoneTemperature
    $celsiusTemp = ($temp.CurrentTemperature - 2732) / 10
    if ($celsiusTemp -gt $thermalThreshold) {
        Write-EventLog -LogName "Application" -Source "ThermalMonitor" -EventId 1001 -EntryType Warning -Message "High temperature detected: $celsiusTemp°C"
    }
    Start-Sleep 30
}

Configure Windows Event Forwarding for centralized thermal monitoring:

1. Create custom event subscription for Event ID 98
2. Set up automated alerts for thermal throttling events
3. Implement Group Policy settings for thermal management:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\54533251-82be-4824-96c1-47b60b740d00\893dee8e-2bef-41e0-89c6-b55d0929964c" /v "Attributes" /t REG_DWORD /d 2 /f