Scheduled tasks and wake timers: who wakes your PC at night

Verified 2026-10-292 min read

Find tasks that run at logon or on a schedule, check which ones can wake the machine, and disable the right one.

Tested onPro (26H2) / Server · Build 26300.9457 / 26100.33650 · x64

Build: 26300.9457 / 26100.33650
Edition: Pro (26H2) / Server
Architecture: x64
Support: Documentation (E1)
Evidence: E1Official documentation
Verified: 2026-10-29
Page type: Task

The short answer

Scheduled tasks are the third autostart mechanism, after Run keys and the Startup folder. Task Manager does not show them.

Two properties decide whether a task affects you:

Trigger — at logon, at startup, daily, on idle, on event.
Wake the computer to run this task — whether it can pull the machine out of sleep.

# tasks that run at logon or boot
Get-ScheduledTask |
  Where-Object { $_.Triggers.CimClass.CimClassName -match 'Logon|Boot' } |
  Select-Object TaskPath,TaskName,State |
  Sort-Object TaskPath | Format-Table -AutoSize

Find the ones that actually run

# enabled tasks with a logon trigger
Get-ScheduledTask |
  Where-Object { $_.State -ne 'Disabled' -and ($_.Triggers | Where-Object { $_.CimClass.CimClassName -eq 'MSFT_TaskLogonTrigger' }) } |
  Select-Object TaskPath,TaskName

# tasks allowed to wake the machine
Get-ScheduledTask |
  Where-Object { $_.Settings.WakeToRun -eq $true -and $_.State -ne 'Disabled' } |
  Select-Object TaskPath,TaskName

# what actually woke the machine last
powercfg /waketimers
powercfg /lastwake

powercfg /waketimers lists pending wake timers; /lastwake tells you what woke it most recently. Together they answer “why was my PC on at 3am” without guessing.

Reading a task before disabling it

$t = Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\' -TaskName 'Schedule Scan'
$t.Actions | Select-Object Execute,Arguments
$t.Triggers | Select-Object CimClass,StartBoundary,Enabled
$t.Settings | Select-Object WakeToRun,DisallowStartIfOnBatteries,ExecutionTimeLimit

Look at Execute + Arguments: the task name rarely matches what it does.

Task area	What it is	Safe to disable?
`\Microsoft\Windows\UpdateOrchestrator\*`	update scans and installs	not permanently
`\Microsoft\Windows\Defender\*`	scans	adjust schedule, do not disable
`\Microsoft\Windows\DiskCleanup\*`	silent cleanup	yes
`\Microsoft\Windows\Application Experience\*`	telemetry/CEIP jobs	yes, cosmetic
vendor update tasks	drivers/BIOS checkers	your call

Wake timers: the 3am problem

A machine that wakes itself is usually one of:

a wake timer (media, backup, update),
wake-on-LAN packet from another device,
a USB device allowed to wake the system,
Modern Standby background activity (laptops).

# devices allowed to wake the machine
Get-CimInstance -Namespace root\wmi -ClassName MSPower_DeviceWakeEnable |
  Where-Object Enable -eq $true | Select-Object InstanceName,Enable

Disable per device in Device Manager → device → Power Management → Allow this device to wake the computer, or via powercfg /devicequery wake_armed.

The safe procedure

List enabled logon/boot tasks; note the vendors you recognise.
List wake timers; if the machine is a desktop that should sleep, disable the timer on the specific task.
Re-test one night.
Keep a note of what you disabled — future-you will need it after a feature update re-enables things.

Lab boundary

E1. Task Scheduler and powercfg behaviour is Microsoft-documented. The lab VMs have no real sleep states, so no wake event was reproduced.