31

About a week ago my Windows 10 Pro started waking up in a middle of the night. I've had similar problems about half a year ago, but managed to configure the cause - unruly UpdateOrchestration task and disable it - using this answer. Disabling the "Wake the computer..." option in Reboot task helped.

However, about a week ago the computer started waking in the middle of the night again and I am unable to convince the Reboot to stay down this time. When I uncheck "Wake the computer..." option a window appears that asks me to provide login credentials for some mysterious S-1-5-18 user that I have never heard about (see the picture below, I use the Polish Windows version).

enter image description here

I have no idea what the password for S-1-5-18 should be. This window's dropdown allows me to choose other users though, besides the mysterious S-1-5-18 - in fact there seems to be about 5 accounts with names similar to my Windows username (why there is a multitude of them? I have no idea, Control Panel shows me as the only user of this computer); when I select one of them in the dropdown and enter my password I get the following message (translated from Polish to English):

The supplied variant structure contains invalid data

Do you have any idea how to disable the computer from rebooting at night?

--

EDIT: To clarify the multiple username thing: there is a single S-1-5-18 user in the dropdown. The multiple user thing I said pertains to my original Windows username. The following picture shows the content of the users dropdown. I have edited out the names that show my original email address, my real name or the names of my computers.enter image description here.

EDIT2: I tried disabling the "Wake to run" option on the task using PowerShell, with the following script and it also did not work. No error is given but the WakeToRun stays true.

 ?{ $_.Settings.WakeToRun -eq $true -and $_.State -ne 'Disabled' } |
%{
    write-host $_
    $_.Settings.WakeToRun = $false;
    Set-ScheduledTask $_
 }
lukeg
  • 1,057
  • 1
  • 10
  • 19
  • If you have multiple [S-1-5-18](https://blogs.msdn.microsoft.com/oldnewthing/20070302-00/?p=27783/) which of course is the Local System account you have a problem. Could offer other links but I am way to lazy for that effort tonight. I would red to know, exactly how similar the other usernames are to one another, won’t do any research till that information is known (and contained within the question) not a comment – Ramhound Nov 16 '17 at 01:16
  • @Ramhound I have updated the question. Please note, that I have never said I have multiple `S-1-5-18`. I have multiple users similar to my own Windows username. – lukeg Nov 16 '17 at 09:29
  • 1
    The S-1-5-18 SID belongs to a well known account. Microsoft [has a list of those](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379649(v=vs.85).aspx). Your dropdown doesn't necessarily show current users but also users you have used in the past. To see the actual accounts that are setup on your machine open the run dialog and type in `lusrmgr.msc`. That will get you a console which would help you. Well known IDs/System accounts aren't going to be visible. But it should help you to figure out whenever multiple `lukeg` accounts exist on your system. – Seth Nov 16 '17 at 11:11
  • @Seth Thanks. Using `lusrmgr.msc` confirmed that there is in fact a single `lukeg` account. However, I am still not sure what credentials to enter when changing UpdateOrchestrator Reboot task. Do I have to use `S-1-5-18` username or my existing `lukeg` account? When I use the latter I enter my online MS account password - however that ends with aforementioned "The supplied variant structure contains invalid data" message. – lukeg Nov 16 '17 at 12:28
  • I never said you had multiple Local System accounts just if you had multiple that would be a problem (what you said was long winded and could be taken multiple ways) – Ramhound Nov 16 '17 at 12:49
  • You also need to disable WakeToRun for "Universal Orchestrator Start" and " Backup Scan" which are different tasks than Reboot (in the same `\Microsoft\Windows\UpdateOrchestrator\` folder). Using the properly (SYSTEM) elevated PowerShell definitely works for the purpose of flipping those bits. See e.g. https://superuser.com/questions/1632277/what-is-the-command-line-equivalent-for-toggling-wake-the-computer-to-run-this for details. – Fizz Mar 10 '21 at 15:59

3 Answers3

28

I was eventually able to disable the Reboot task. Firstly, I tried the following line in cmd:

SCHTASKS /Change /TN "Microsoft\Windows\UpdateOrchestrator\Reboot" /DISABLE

It did not work, and the error message said I do not have sufficient privileges to modify the task (even though I work on a Windows admin account). However, thanks to this message, I was able to find information about NSudo program. Per the already linked hint, I used it in a TrustedInstaller mode to start cmd and - lo and behold - SCHTASKS now worked perfectly, allowing me to disable the Reboot task. Windows is user friendly, they said.

EDIT: To make things clearer, NSudo gives you privilages over Reboot task and you do not have to use exactly the cmd listed above to disable Reboot task. Alternatively you may, for example, use it to run taskschd.msc and edit the Reboot task to your liking in the window that opens (for example by unchecking the "Wake up..." checkbox).

I have found that the changes don't always stick. The aforementioned message states that on has to issue the following command using cmd from NSudo (note you may have to translate the account names to language your Windows uses):

icacls "%WINDIR%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot" /inheritance:r /deny "Everyone:F" /deny "SYSTEM:F" /deny "Local Service:F" /deny "Administrators:F"
lukeg
  • 1,057
  • 1
  • 10
  • 19
  • 1
    thanks for this, I had the exact same problem on Polish version of Windows :) – Adassko Jan 07 '18 at 21:57
  • NSudo - the hell? How does it work? I mean, it works, thank you, but, WHY? – Locane Mar 15 '18 at 18:05
  • link for NSudo http://www.majorgeeks.com/files/details/nsudo.html -- the repo doesn't really give you any idea of where to get it – jcollum Mar 23 '18 at 04:21
  • 5
    Can do this too with PsExec (https://docs.microsoft.com/en-us/sysinternals/downloads/pstools), developed by Microsoft, which to me was more comfortable than the slightly iffy download locations of NSudo (`majorgeeks.com` doesn't evoke my trust :) With PsExec, open command prompt as admin, run: `c:\some-path-to\PsExec64.exe /S CMD.EXE` and then the `SCHTASKS` command mentioned in this answer. – Jan Żankowski Jun 15 '18 at 19:51
  • 1
    Mmm that sounds wonderful... But even with nsudo, running taskschd.msc to edit the *reboot task*, on pressing OK windows asks for the password to the S-1-5-18 account. – zx81 Jul 14 '18 at 17:58
  • @zx81 That's strange. Worked for me this week when the damn thing reenabled itself again. – lukeg Jul 14 '18 at 18:00
  • Let me see if I got the right workflow... Run NSudo as Admin. As Trusted Installer, run *taskschd.msc*. Edit *UpdateOrchestrator/reboot* , e.g. change the date to 2049, and that works for you without a password? – zx81 Jul 15 '18 at 18:51
  • @zx81 Generally, that's the workflow. Strangely, it has asked me about a password this time I tried it. Definitely worked a week ago though. I think it might be because I have issued the `icacls ...` command to stop reenabling it. – lukeg Jul 19 '18 at 11:41
  • FYI you can't (normally) run `taskschd.msc` via psexec because it wants to interact with `SYSTEM`'s desktop session, which of course it does not have. You might be able to work around this with creative use of other flags, I haven't tried it myself. – James B Aug 03 '20 at 21:56
  • 7
    @JamesB, you can try to run `psexec -i -d -s mmc taskschd.msc`. It works for me. – Bohdan Kuts Aug 15 '20 at 14:56
  • @JanŻankowski Thanks for the trusted program. It seemed to work for me (although I had to replace `Reboot` by `Reboot_AC` according to `powercfg /lastwake` and the error message of the `SCHTASKS` command), but sadly, my PC did turn itself on again eventually. On the other hand, using @BohdanKuts's command to launch the task planner, and then editing the properties of `Microsoft/Windows/UpdateOrchestrator/Reboot_AC`, did the job. No wakeups have happened for about 24 hours now! – Mew Mar 11 '22 at 00:28
7

S-1-5-18 is a local SYSTEM account. It has no password and only services can run under it.

But there is a tool psexec that can allow a user app to run under SYSTEM account. You can use it like this:

psexec.exe -i -s schtasks ...

However, even disabling wakeup for the Reboot task won't stop the reboots entirely.

The following alternative solution worked for me:

Go into "Power Options" -> "Change When Computer Goes to Sleep" -> "Advanced Options".

Under "Sleep" you'll see "Allow wake timers". Set both "on battery" and "plugged in" of to "Disable".

power options - sleep

That should take care if it.

You'll have to check again after updates as Microsoft sometimes resets that and enables the wake up timers when plugged in.

rustyx
  • 890
  • 1
  • 10
  • 24
  • I just checked and wake timers are supposed to be disabled on all plans under battery power, yet I have an event log that the PC resumed from sleep last night at 3AM, and promptly started a Windows Update check. (Then, somehow it never quite went back to sleep and the battery died, which is what I'm troubleshooting, but that's another question.) – James B Aug 03 '20 at 21:50
1

2020 update


Windows Update Blocker New version allow users to add any other service into Wub.ini file to block it , first please edit Wub.ini file and add your desired service name under the “dosvc=2,4” line , for example if you want to block “Windows Update medic Service” Please open services and find i

https://www.sordum.org/9470/windows-update-blocker-v1-5/

enter image description hereWindows Update Blocker v1.5

Solution for new Microsoft 17134 something

user956584
  • 356
  • 4
  • 13