2-hour hibernate failure

Your first comment on your previous post left some confusion. "Well
certainly not on any kind of dialup basis"
My system then, is very similar to yours. I.E. I have XP Home, I'm on a DSL
line. But, you have many more 'services' than I. Some I can easily explain,
(such as LexBeeS), I have a Hewlett Packard. But, psqlWGE,
lanmanworkstation, and the fact that Norton Antivirus pops up in auto after
you shut it down makes no sense.
I'll not offer any suggestions but await John John's next post.
"William B. Lurie" wrote in message
...
Unknown wrote:
Are you strictly dialup?

I thought I made that clear. I am DSL on a regular phone
line, hardwired and on all the time. And I can't find
Windows Workgroup Engine in Add/Remove.

Does Windows Workgroup Engine appear in add/remove
programs?

William B. Lurie" wrote in message
...
Well, certainly not on any kind of dial-up basis.
In the past, on specific occasion, I have granted
remote access to Symantec on-line-chat-technical
help to allow them to fix software problems. But
do you really think they are in any way accessing my
machine and causing it not to hibernate? Remember, I
am doing all these tests with my machine isolated
from the outside world. Specifically, I guess
those 'services' can be Disabled, to remove any such
worries.

Unknown wrote:
PSQLWGE (your services) is Window Workgroup Engine. That and
'lanmanworkstation' indicate to me that other computers have access to
your computer.

"William B. Lurie" wrote in message
...
No, I have XP/Home Edition/SP2 .....
And, to my knowledge, I installed no
Workgroup Engine.

Unknown wrote:
Your XP is Professional? Did you install Windows Workgroup Engine?
"William B. Lurie" wrote in message
...
Yes, and maybe John can devise a way to tell us why
it is being reset.

Unknown wrote:
Not all 'events' are recorded but the hibernate time out clock is
being reset..
"William B. Lurie" wrote in message
...
John John - MVP wrote:
Well, forgive me but I surely have to wonder what it is that is
going on at your end...

The last batch file that I asked you to run would have changed
some of the start values of some of the services but I note some
inconsistencies:

Ati HotKey Poller set to Manual now it' Disabled. Not that it
matters but who disabled this?

Browser set to Manual now it's back on Auto. Who set this back
to Auto? You told me that you have a stand alone desktop and that
definitely you are not on a network. The Browser service
maintains the browse list, a list of of all available servers on
domains or a list of available computers on workgroups. The
Browser service does broadcast announcements over the network at
specific time intervals (like every 12 minutes, until the Master
Browser tells it to shut up) and plays a role in the assignment
of browser tasks to specific computers on the network. You have
no network... why is the Browser service on Auto? Maybe someone
wants this thing barking every 12 minutes....

lanmanserver set to Disabled now it's Manual. No network, no
file and printer sharing so as far as I'm concerned this should
be set to disabled, Manual might also be fine but the point is,
who changed it from Disabled to Manual?

LexBceS still set to Auto. This is part of your Lexmark printer
software, if the printer and all its software was removed I have
to wonder why is this service still present...

psqlWGE set to Manual now it's bact to Auto. What is this thing?
What software are you running that needs this thing to be set to
Auto? A quick search had revealed that it might belong to an
accounting package, I can't say for sure but anything with "sql"
in it usually suggests that it is part of some kind of database.
And I have to wonder if this database is in anyway associated to
the Indexing service that seemed to be doing cataloging work at
any or all hours of the day.

Viewpoint Manager Service was set to Auto, now it's Disabled.
Information on this is a bit scant or vague but it seems that it
might be junk installed by AOL and that it might be needed for
some AOL features... or that it might be unwanted junk related to
adware. Without knowing if you are on AOL I had decided to leave
it on Auto for the time being. But as far as I'm concerned if
you can live without it maybe you should have it disabled.

W32Time set to Manual now back to Auto. You said in earlier
posts that the Time service was improperly configured and that it
couldn't synchronize with a time server, so all it's doing is
trying (and failing) to contact a time server, network traffic
for naught and for that specific reason I wanted to remove this
from the picture, but I see that it is back... like the cat with
nine lives...

WZCSVC was set to Manual now it's back to Auto. This is is the
service that automatically configures 802.11 wireless network
devices. Are you on a wireless network? You said that you are a
standalone machine that is not part of a network and that you
plug to the internet with a telephone cable (I assume DSL, not
dial-up, right?). Is your printer running on wireless? Is the
webcam a wireless device? Do you have a wireless router? If you
do have a wireless router, why are its wireless functions running
if you use a telephone cable to plug to the internet? Why is this
service back to Auto? For all I know maybe you have 'unwanted
guests' accessing your wireless router...

Maybe you inadvertently changed some of these settings while you
were 'playing' with CodeStuff Starter. I'm still quite busy with
other commitments, I will try to be back later with a new batch
file for you to run, we'll give it another try.

John
Well,John, the only approach I can see that makes sense, is for
you
to give me a script file that will set all my services to what you
want, and then I'll run ServiceStat.vbc and autoruns.exe and
establish a baseline, and then I'll simply let it sit for 2 hours
and run autoruns.exe again and report autostart.txt and we can see
what was changed when I do nothing in between. Meanwhile, I'm
waiting for your advice.

I can't understand how the Events Log shows absolutely nothing
happening in the two-hour period, so no reason for it not to
obey the hibernate command......yet it jest doesn't do it.

Your first comment on your previous post left some confusion. "Well
certainly not on any kind of dialup basis"
My system then, is very similar to yours. I.E. I have XP Home, I'm on a DSL
line. But, you have many more 'services' than I. Some I can easily explain,
(such as LexBeeS), I have a Hewlett Packard. But, psqlWGE,
lanmanworkstation, and the fact that Norton Antivirus pops up in auto after
you shut it down makes no sense.
I'll not offer any suggestions but await John John's next post.
"William B. Lurie" wrote in message
...
Unknown wrote:
Are you strictly dialup?

I thought I made that clear. I am DSL on a regular phone
line, hardwired and on all the time. And I can't find
Windows Workgroup Engine in Add/Remove.

Does Windows Workgroup Engine appear in add/remove
programs?

William B. Lurie" wrote in message
...
Well, certainly not on any kind of dial-up basis.
In the past, on specific occasion, I have granted
remote access to Symantec on-line-chat-technical
help to allow them to fix software problems. But
do you really think they are in any way accessing my
machine and causing it not to hibernate? Remember, I
am doing all these tests with my machine isolated
from the outside world. Specifically, I guess
those 'services' can be Disabled, to remove any such
worries.

Unknown wrote:
PSQLWGE (your services) is Window Workgroup Engine. That and
'lanmanworkstation' indicate to me that other computers have access to
your computer.

"William B. Lurie" wrote in message
...
No, I have XP/Home Edition/SP2 .....
And, to my knowledge, I installed no
Workgroup Engine.

Unknown wrote:
Your XP is Professional? Did you install Windows Workgroup Engine?
"William B. Lurie" wrote in message
...
Yes, and maybe John can devise a way to tell us why
it is being reset.

Unknown wrote:
Not all 'events' are recorded but the hibernate time out clock is
being reset..
"William B. Lurie" wrote in message
...
John John - MVP wrote:
Well, forgive me but I surely have to wonder what it is that is
going on at your end...

The last batch file that I asked you to run would have changed
some of the start values of some of the services but I note some
inconsistencies:

Ati HotKey Poller set to Manual now it' Disabled. Not that it
matters but who disabled this?

Browser set to Manual now it's back on Auto. Who set this back
to Auto? You told me that you have a stand alone desktop and that
definitely you are not on a network. The Browser service
maintains the browse list, a list of of all available servers on
domains or a list of available computers on workgroups. The
Browser service does broadcast announcements over the network at
specific time intervals (like every 12 minutes, until the Master
Browser tells it to shut up) and plays a role in the assignment
of browser tasks to specific computers on the network. You have
no network... why is the Browser service on Auto? Maybe someone
wants this thing barking every 12 minutes....

lanmanserver set to Disabled now it's Manual. No network, no
file and printer sharing so as far as I'm concerned this should
be set to disabled, Manual might also be fine but the point is,
who changed it from Disabled to Manual?

LexBceS still set to Auto. This is part of your Lexmark printer
software, if the printer and all its software was removed I have
to wonder why is this service still present...

psqlWGE set to Manual now it's bact to Auto. What is this thing?
What software are you running that needs this thing to be set to
Auto? A quick search had revealed that it might belong to an
accounting package, I can't say for sure but anything with "sql"
in it usually suggests that it is part of some kind of database.
And I have to wonder if this database is in anyway associated to
the Indexing service that seemed to be doing cataloging work at
any or all hours of the day.

Viewpoint Manager Service was set to Auto, now it's Disabled.
Information on this is a bit scant or vague but it seems that it
might be junk installed by AOL and that it might be needed for
some AOL features... or that it might be unwanted junk related to
adware. Without knowing if you are on AOL I had decided to leave
it on Auto for the time being. But as far as I'm concerned if
you can live without it maybe you should have it disabled.

W32Time set to Manual now back to Auto. You said in earlier
posts that the Time service was improperly configured and that it
couldn't synchronize with a time server, so all it's doing is
trying (and failing) to contact a time server, network traffic
for naught and for that specific reason I wanted to remove this
from the picture, but I see that it is back... like the cat with
nine lives...

WZCSVC was set to Manual now it's back to Auto. This is is the
service that automatically configures 802.11 wireless network
devices. Are you on a wireless network? You said that you are a
standalone machine that is not part of a network and that you
plug to the internet with a telephone cable (I assume DSL, not
dial-up, right?). Is your printer running on wireless? Is the
webcam a wireless device? Do you have a wireless router? If you
do have a wireless router, why are its wireless functions running
if you use a telephone cable to plug to the internet? Why is this
service back to Auto? For all I know maybe you have 'unwanted
guests' accessing your wireless router...

Maybe you inadvertently changed some of these settings while you
were 'playing' with CodeStuff Starter. I'm still quite busy with
other commitments, I will try to be back later with a new batch
file for you to run, we'll give it another try.

John
Well,John, the only approach I can see that makes sense, is for
you
to give me a script file that will set all my services to what you
want, and then I'll run ServiceStat.vbc and autoruns.exe and
establish a baseline, and then I'll simply let it sit for 2 hours
and run autoruns.exe again and report autostart.txt and we can see
what was changed when I do nothing in between. Meanwhile, I'm
waiting for your advice.

I can't understand how the Events Log shows absolutely nothing
happening in the two-hour period, so no reason for it not to
obey the hibernate command......yet it jest doesn't do it.

William B. Lurie wrote:
John John - MVP wrote:

Well, forgive me but I surely have to wonder what it is that is going
on at your end...

The last batch file that I asked you to run would have changed some of
the start values of some of the services but I note some inconsistencies:

Ati HotKey Poller set to Manual now it' Disabled. Not that it matters
but who disabled this?

Browser set to Manual now it's back on Auto. Who set this back to
Auto? You told me that you have a stand alone desktop and that
definitely you are not on a network. The Browser service maintains
the browse list, a list of of all available servers on domains or a
list of available computers on workgroups. The Browser service does
broadcast announcements over the network at specific time intervals
(like every 12 minutes, until the Master Browser tells it to shut up)
and plays a role in the assignment of browser tasks to specific
computers on the network. You have no network... why is the Browser
service on Auto? Maybe someone wants this thing barking every 12
minutes....

lanmanserver set to Disabled now it's Manual. No network, no file and
printer sharing so as far as I'm concerned this should be set to
disabled, Manual might also be fine but the point is, who changed it
from Disabled to Manual?

LexBceS still set to Auto. This is part of your Lexmark printer
software, if the printer and all its software was removed I have to
wonder why is this service still present...

psqlWGE set to Manual now it's bact to Auto. What is this thing?
What software are you running that needs this thing to be set to
Auto? A quick search had revealed that it might belong to an
accounting package, I can't say for sure but anything with "sql" in it
usually suggests that it is part of some kind of database. And I have
to wonder if this database is in anyway associated to the Indexing
service that seemed to be doing cataloging work at any or all hours of
the day.

Viewpoint Manager Service was set to Auto, now it's Disabled.
Information on this is a bit scant or vague but it seems that it might
be junk installed by AOL and that it might be needed for some AOL
features... or that it might be unwanted junk related to adware.
Without knowing if you are on AOL I had decided to leave it on Auto
for the time being. But as far as I'm concerned if you can live
without it maybe you should have it disabled.

W32Time set to Manual now back to Auto. You said in earlier posts
that the Time service was improperly configured and that it couldn't
synchronize with a time server, so all it's doing is trying (and
failing) to contact a time server, network traffic for naught and for
that specific reason I wanted to remove this from the picture, but I
see that it is back... like the cat with nine lives...

WZCSVC was set to Manual now it's back to Auto. This is is the
service that automatically configures 802.11 wireless network
devices. Are you on a wireless network? You said that you are a
standalone machine that is not part of a network and that you plug to
the internet with a telephone cable (I assume DSL, not dial-up,
right?). Is your printer running on wireless? Is the webcam a
wireless device? Do you have a wireless router? If you do have a
wireless router, why are its wireless functions running if you use a
telephone cable to plug to the internet? Why is this service back to
Auto? For all I know maybe you have 'unwanted guests' accessing your
wireless router...

Maybe you inadvertently changed some of these settings while you were
'playing' with CodeStuff Starter. I'm still quite busy with other
commitments, I will try to be back later with a new batch file for you
to run, we'll give it another try.

John

Well,John, the only approach I can see that makes sense, is for you
to give me a script file that will set all my services to what you
want, and then I'll run ServiceStat.vbc and autoruns.exe and
establish a baseline, and then I'll simply let it sit for 2 hours
and run autoruns.exe again and report autostart.txt and we can see
what was changed when I do nothing in between. Meanwhile, I'm
waiting for your advice.

I can't understand how the Events Log shows absolutely nothing
happening in the two-hour period, so no reason for it not to
obey the hibernate command......yet it jest doesn't do it.

I posted the wrong batch file earlier, it was a work file, not the
finished file. Sorry about that, try this instead:

Copy the stuff between the === lines and save it as a .bat file then run
the batch file (double click on it). After you run the batch file
reboot and see if the machine will hibernate.

================================================== ==================
rem Second set of changes

sc config Alerter start= Disabled
sc config ALG start= Manual
sc config AppMgmt start= Manual
sc config aspnet_state start= Manual
sc config Ati HotKey Poller start= Disabled
sc config ATI Smart start= Manual
sc config AudioSrv start= Auto
sc config Automatic LiveUpdate Scheduler start= Disabled
sc config BITS start= Manual
sc config Browser start= Manual
sc config CiSvc start= Manual
sc config ClipSrv start= Disabled
sc config clr_optimization_v2.0.50727_32 start= Manual
sc config COMSysApp start= Manual
sc config CryptSvc start= Auto
sc config DcomLaunch start= Auto
sc config Dhcp start= Auto
sc config dmadmin start= Manual
sc config dmserver start= Manual
sc config Dnscache start= Manual
sc config ERSvc start= Manual
sc config Eventlog start= Auto
sc config EventSystem start= Manual
sc config FastUserSwitchingCompatibility start= Manual
sc config Fax start= Manual
sc config FontCache3.0.0.0 start= Manual
sc config GEARSecurity start= Disabled
sc config helpsvc start= Auto
sc config HidServ start= Disabled
sc config HTTPFilter start= Manual
sc config IDriverT start= Manual
sc config idsvc start= Manual
sc config Imapi Helper start= Manual
sc config ImapiService start= Manual
sc config lanmanserver start= Disabled
sc config lanmanworkstation start= Auto
sc config LexBceS start= Disabled
sc config LiveUpdate start= Manual
sc config LmHosts start= Manual
sc config MBAMService start= Disabled
sc config MDM start= Manual
sc config Messenger start= Disabled
sc config mnmsrvc start= Manual
sc config MSIServer start= Manual
sc config NetDDE start= Disabled
sc config NetDDEdsdm start= Disabled
sc config Netlogon start= Manual
sc config Netman start= Manual
sc config NetTcpPortSharing start= Disabled
sc config Nla start= Manual
sc config Norton AntiVirus start= Manual
sc config Norton Save and Restore start= Manual
sc config NProtectService start= Manual
sc config NtLmSsp start= Manual
sc config NtmsSvc start= Manual
sc config ose start= Manual
sc config PlugPlay start= Auto
sc config PolicyAgent start= Manual
sc config ProtectedStorage start= Auto
sc config psqlWGE start= Disabled
sc config RasAuto start= Disabled
sc config RasMan start= Manual
sc config RDSessMgr start= Manual
sc config RemoteAccess start= Disabled
sc config RpcLocator start= Manual
sc config RpcSs start= Auto
sc config RSVP start= Manual
sc config SamSs start= Auto
sc config SCardSvr start= Manual
sc config Schedule start= Manual
sc config seclogon start= Manual
sc config SENS start= Auto
sc config SharedAccess start= Auto
sc config ShellHWDetection start= Auto
sc config Speed Disk service start= Disabled
sc config Spooler start= Manual
sc config srservice start= Auto
sc config SSDPSRV start= Manual
sc config stisvc start= Disabled
sc config SwPrv start= Manual
sc config Symantec RemoteAssist start= Manual
sc config SysmonLog start= Manual
sc config TapiSrv start= Manual
sc config TermService start= Manual
sc config Themes start= Auto
sc config TrkWks start= Manual
sc config upnphost start= Manual
sc config UPS start= Manual
sc config Viewpoint Manager Service start= Disabled
sc config VSS start= Manual
sc config W32Time start= Manual
sc config WebClient start= Manual
sc config winmgmt start= Auto
sc config WmdmPmSN start= Manual
sc config WmiApSrv start= Disabled
sc config WMPNetworkSvc start= Manual
sc config wscsvc start= Manual
sc config wuauserv start= Auto
sc config WudfSvc start= Manual
sc config WZCSVC start= Manual
sc config xmlprov start= Manual
sc config spooler depend= RPCSS
================================================== =======

If it still doesn't hibernate after doing the above do a clean boot and
try again:

http://support.microsoft.com/kb/310353
How to configure Windows XP to start in a "clean boot" state

John

John John - MVP wrote:
William B. Lurie wrote:
John John - MVP wrote:

Well, forgive me but I surely have to wonder what it is that is going
on at your end...

The last batch file that I asked you to run would have changed some
of the start values of some of the services but I note some
inconsistencies:

Ati HotKey Poller set to Manual now it' Disabled. Not that it
matters but who disabled this?

Browser set to Manual now it's back on Auto. Who set this back to
Auto? You told me that you have a stand alone desktop and that
definitely you are not on a network. The Browser service maintains
the browse list, a list of of all available servers on domains or a
list of available computers on workgroups. The Browser service does
broadcast announcements over the network at specific time intervals
(like every 12 minutes, until the Master Browser tells it to shut up)
and plays a role in the assignment of browser tasks to specific
computers on the network. You have no network... why is the Browser
service on Auto? Maybe someone wants this thing barking every 12
minutes....

lanmanserver set to Disabled now it's Manual. No network, no file
and printer sharing so as far as I'm concerned this should be set to
disabled, Manual might also be fine but the point is, who changed it
from Disabled to Manual?

LexBceS still set to Auto. This is part of your Lexmark printer
software, if the printer and all its software was removed I have to
wonder why is this service still present...

psqlWGE set to Manual now it's bact to Auto. What is this thing?
What software are you running that needs this thing to be set to
Auto? A quick search had revealed that it might belong to an
accounting package, I can't say for sure but anything with "sql" in
it usually suggests that it is part of some kind of database. And I
have to wonder if this database is in anyway associated to the
Indexing service that seemed to be doing cataloging work at any or
all hours of the day.

Viewpoint Manager Service was set to Auto, now it's Disabled.
Information on this is a bit scant or vague but it seems that it
might be junk installed by AOL and that it might be needed for some
AOL features... or that it might be unwanted junk related to adware.
Without knowing if you are on AOL I had decided to leave it on Auto
for the time being. But as far as I'm concerned if you can live
without it maybe you should have it disabled.

W32Time set to Manual now back to Auto. You said in earlier posts
that the Time service was improperly configured and that it couldn't
synchronize with a time server, so all it's doing is trying (and
failing) to contact a time server, network traffic for naught and for
that specific reason I wanted to remove this from the picture, but I
see that it is back... like the cat with nine lives...

WZCSVC was set to Manual now it's back to Auto. This is is the
service that automatically configures 802.11 wireless network
devices. Are you on a wireless network? You said that you are a
standalone machine that is not part of a network and that you plug to
the internet with a telephone cable (I assume DSL, not dial-up,
right?). Is your printer running on wireless? Is the webcam a
wireless device? Do you have a wireless router? If you do have a
wireless router, why are its wireless functions running if you use a
telephone cable to plug to the internet? Why is this service back
to Auto? For all I know maybe you have 'unwanted guests' accessing
your wireless router...

Maybe you inadvertently changed some of these settings while you were
'playing' with CodeStuff Starter. I'm still quite busy with other
commitments, I will try to be back later with a new batch file for
you to run, we'll give it another try.

John

Well,John, the only approach I can see that makes sense, is for you
to give me a script file that will set all my services to what you
want, and then I'll run ServiceStat.vbc and autoruns.exe and
establish a baseline, and then I'll simply let it sit for 2 hours
and run autoruns.exe again and report autostart.txt and we can see
what was changed when I do nothing in between. Meanwhile, I'm
waiting for your advice.

I can't understand how the Events Log shows absolutely nothing
happening in the two-hour period, so no reason for it not to
obey the hibernate command......yet it jest doesn't do it.

I posted the wrong batch file earlier, it was a work file, not the
finished file. Sorry about that, try this instead:

Copy the stuff between the === lines and save it as a .bat file then run
the batch file (double click on it). After you run the batch file
reboot and see if the machine will hibernate.

================================================== ==================
rem Second set of changes

sc config Alerter start= Disabled
sc config ALG start= Manual
sc config AppMgmt start= Manual
sc config aspnet_state start= Manual
sc config Ati HotKey Poller start= Disabled
sc config ATI Smart start= Manual
sc config AudioSrv start= Auto
sc config Automatic LiveUpdate Scheduler start= Disabled
sc config BITS start= Manual
sc config Browser start= Manual
sc config CiSvc start= Manual
sc config ClipSrv start= Disabled
sc config clr_optimization_v2.0.50727_32 start= Manual
sc config COMSysApp start= Manual
sc config CryptSvc start= Auto
sc config DcomLaunch start= Auto
sc config Dhcp start= Auto
sc config dmadmin start= Manual
sc config dmserver start= Manual
sc config Dnscache start= Manual
sc config ERSvc start= Manual
sc config Eventlog start= Auto
sc config EventSystem start= Manual
sc config FastUserSwitchingCompatibility start= Manual
sc config Fax start= Manual
sc config FontCache3.0.0.0 start= Manual
sc config GEARSecurity start= Disabled
sc config helpsvc start= Auto
sc config HidServ start= Disabled
sc config HTTPFilter start= Manual
sc config IDriverT start= Manual
sc config idsvc start= Manual
sc config Imapi Helper start= Manual
sc config ImapiService start= Manual
sc config lanmanserver start= Disabled
sc config lanmanworkstation start= Auto
sc config LexBceS start= Disabled
sc config LiveUpdate start= Manual
sc config LmHosts start= Manual
sc config MBAMService start= Disabled
sc config MDM start= Manual
sc config Messenger start= Disabled
sc config mnmsrvc start= Manual
sc config MSIServer start= Manual
sc config NetDDE start= Disabled
sc config NetDDEdsdm start= Disabled
sc config Netlogon start= Manual
sc config Netman start= Manual
sc config NetTcpPortSharing start= Disabled
sc config Nla start= Manual
sc config Norton AntiVirus start= Manual
sc config Norton Save and Restore start= Manual
sc config NProtectService start= Manual
sc config NtLmSsp start= Manual
sc config NtmsSvc start= Manual
sc config ose start= Manual
sc config PlugPlay start= Auto
sc config PolicyAgent start= Manual
sc config ProtectedStorage start= Auto
sc config psqlWGE start= Disabled
sc config RasAuto start= Disabled
sc config RasMan start= Manual
sc config RDSessMgr start= Manual
sc config RemoteAccess start= Disabled
sc config RpcLocator start= Manual
sc config RpcSs start= Auto
sc config RSVP start= Manual
sc config SamSs start= Auto
sc config SCardSvr start= Manual
sc config Schedule start= Manual
sc config seclogon start= Manual
sc config SENS start= Auto
sc config SharedAccess start= Auto
sc config ShellHWDetection start= Auto
sc config Speed Disk service start= Disabled
sc config Spooler start= Manual
sc config srservice start= Auto
sc config SSDPSRV start= Manual
sc config stisvc start= Disabled
sc config SwPrv start= Manual
sc config Symantec RemoteAssist start= Manual
sc config SysmonLog start= Manual
sc config TapiSrv start= Manual
sc config TermService start= Manual
sc config Themes start= Auto
sc config TrkWks start= Manual
sc config upnphost start= Manual
sc config UPS start= Manual
sc config Viewpoint Manager Service start= Disabled
sc config VSS start= Manual
sc config W32Time start= Manual
sc config WebClient start= Manual
sc config winmgmt start= Auto
sc config WmdmPmSN start= Manual
sc config WmiApSrv start= Disabled
sc config WMPNetworkSvc start= Manual
sc config wscsvc start= Manual
sc config wuauserv start= Auto
sc config WudfSvc start= Manual
sc config WZCSVC start= Manual
sc config xmlprov start= Manual
sc config spooler depend= RPCSS
================================================== =======

If it still doesn't hibernate after doing the above do a clean boot and
try again:

http://support.microsoft.com/kb/310353
How to configure Windows XP to start in a "clean boot" state

John
WILL DO IT TOMORROW MORNING.
btw.... I don't see the 'earlier' file posted, but
you don't want me to use it anyway.
Bill...

William B. Lurie wrote:

Latest news, overnight runs (I was up with a bad cold anyway):
Did first half of what was requested. Ran the .bat file and
am posting interesting results below. Will do it again from
Clean Boot later. See SCM/WIA involvement,

Windows Image Acquisition (WIA) used by scanners, cameras and probably
your webcam, this is why I asked you to *completely* remove these
devices and all their associated software from your machine. In the
batch file the line:

sc config stisvc start= Disabled

will (should have) set the Windows Image Acquisition (WIA) to
*disabled*. A disabled service cannot start, trying to start it will
throw an error. Something in your startup applications is changing the
start status of the service an re-enabling it, these things don't change
by themselves alone. Run the batch file again to reset the start values
of the services then do a clean boot, don't reboot after you run the
batch file because the startup applications will just change it again!
Run the batch file then do the necessary steps to clean boot then reboot.


plus specifically the every-hour-events.

You mean Norton stuff? That will be the next one to get its head
chopped off! It shouldn't run if you do the clean boot properly.

John

William B. Lurie wrote:

Latest news, overnight runs (I was up with a bad cold anyway):
Did first half of what was requested. Ran the .bat file and
am posting interesting results below. Will do it again from
Clean Boot later. See SCM/WIA involvement,

Windows Image Acquisition (WIA) used by scanners, cameras and probably
your webcam, this is why I asked you to *completely* remove these
devices and all their associated software from your machine. In the
batch file the line:

sc config stisvc start= Disabled

will (should have) set the Windows Image Acquisition (WIA) to
*disabled*. A disabled service cannot start, trying to start it will
throw an error. Something in your startup applications is changing the
start status of the service an re-enabling it, these things don't change
by themselves alone. Run the batch file again to reset the start values
of the services then do a clean boot, don't reboot after you run the
batch file because the startup applications will just change it again!
Run the batch file then do the necessary steps to clean boot then reboot.


plus specifically the every-hour-events.

You mean Norton stuff? That will be the next one to get its head
chopped off! It shouldn't run if you do the clean boot properly.

John

John John - MVP wrote:
William B. Lurie wrote:

Latest news, overnight runs (I was up with a bad cold anyway):
Did first half of what was requested. Ran the .bat file and
am posting interesting results below. Will do it again from
Clean Boot later. See SCM/WIA involvement,

Windows Image Acquisition (WIA) used by scanners, cameras and probably
your webcam, this is why I asked you to *completely* remove these
devices and all their associated software from your machine. In the
batch file the line:

sc config stisvc start= Disabled

will (should have) set the Windows Image Acquisition (WIA) to
*disabled*. A disabled service cannot start, trying to start it will
throw an error. Something in your startup applications is changing the
start status of the service an re-enabling it, these things don't change
by themselves alone. Run the batch file again to reset the start values
of the services then do a clean boot, don't reboot after you run the
batch file because the startup applications will just change it again!
Run the batch file then do the necessary steps to clean boot then reboot.


plus specifically the every-hour-events.

You mean Norton stuff? That will be the next one to get its head
chopped off! It shouldn't run if you do the clean boot properly.

John
John, Norton in service is too important to me, and removing
it completely and reinstalling could be a forever task. We
have to either clear it or chop its legs off, and I propose
a test that will meet you more than half way. As you know,
I can always make more clones, even though it takes some time.

Let's take my test clone and remove all of Norton's A-V right
from Add/Remove. I just have to remember never to go online on
that system.

I'll take the system as it is now, UNinstall NAV,do your
ServicesStart.vbc again, and autorunsc.exe, and let's see
what happens. I'll start that right now.
Bill

John John - MVP wrote:
William B. Lurie wrote:

Latest news, overnight runs (I was up with a bad cold anyway):
Did first half of what was requested. Ran the .bat file and
am posting interesting results below. Will do it again from
Clean Boot later. See SCM/WIA involvement,

Windows Image Acquisition (WIA) used by scanners, cameras and probably
your webcam, this is why I asked you to *completely* remove these
devices and all their associated software from your machine. In the
batch file the line:

sc config stisvc start= Disabled

will (should have) set the Windows Image Acquisition (WIA) to
*disabled*. A disabled service cannot start, trying to start it will
throw an error. Something in your startup applications is changing the
start status of the service an re-enabling it, these things don't change
by themselves alone. Run the batch file again to reset the start values
of the services then do a clean boot, don't reboot after you run the
batch file because the startup applications will just change it again!
Run the batch file then do the necessary steps to clean boot then reboot.


plus specifically the every-hour-events.

You mean Norton stuff? That will be the next one to get its head
chopped off! It shouldn't run if you do the clean boot properly.

John
John, Norton in service is too important to me, and removing
it completely and reinstalling could be a forever task. We
have to either clear it or chop its legs off, and I propose
a test that will meet you more than half way. As you know,
I can always make more clones, even though it takes some time.

Let's take my test clone and remove all of Norton's A-V right
from Add/Remove. I just have to remember never to go online on
that system.

I'll take the system as it is now, UNinstall NAV,do your
ServicesStart.vbc again, and autorunsc.exe, and let's see
what happens. I'll start that right now.
Bill

William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System Event 513 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security Logon/Logoff 551
Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to the network, and has initiated normal operation over the network adapter.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....
Bill

William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System Event 513 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security Logon/Logoff 551
Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege Use 576 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff 528 NETWORK
SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event 515 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy Change 850 SYSTEM
COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None 6006 N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter \DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to the network, and has initiated normal operation over the network adapter.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....
Bill

William B. Lurie wrote:
William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System
Event 513 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security
Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff
528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff
528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event
515 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None 6006
N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter
\DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
the network, and has initiated normal operation over the network adapter.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....

Please do the clean boot.

John

William B. Lurie wrote:
William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System
Event 513 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security
Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Logon/Logoff
528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Logon/Logoff
528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System Event
515 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None 6006
N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter
\DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
the network, and has initiated normal operation over the network adapter.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....

Please do the clean boot.

John

John John - MVP wrote:
William B. Lurie wrote:
William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System
Event 513 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security
Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security
Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security
Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System
Event 515 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None
6006 N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter
\DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
the network, and has initiated normal operation over the network
adapter.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....

Please do the clean boot.

John
That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.
Bill

John John - MVP wrote:
William B. Lurie wrote:
William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System
Event 513 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security
Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security
Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security
Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System
Event 515 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None
6006 N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter
\DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected to
the network, and has initiated normal operation over the network
adapter.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....

Please do the clean boot.

John
That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.
Bill

William B. Lurie wrote:
John John - MVP wrote:
William B. Lurie wrote:
William B. Lurie wrote:
snip
I just finished what might be the most positive indicating
run yet. Same conditions as last run, except this time I did

Clean Boot
Disabled Auto Live Update
Disabled WIA and started at 9:12 P.M.

2.5 hours later, it had not hibernated, but I think
there is just one reason clearly shown. I'll send you
the files in the morning to look at, John.

What I see is just *one* event, but it happened at 10:35 .....
Tcpip... Type 4201 ......."SCM" I think.

Bill
See these:

Type Date Time Source Category Event User Computer
Information 4/14/2010 9:05:01 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 9:04:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006
Information 4/14/2010 6:03:02 PM Automatic LiveUpdate
Scheduler Devices 101 SYSTEM COMPAQ-2006

Type Date
Success Audit 4/14/2010 11:34:34 PM Security System
Event 513 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 11:34:28 PM Security
Logon/Logoff 551 Compaq_Owner COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:11:04 PM Security
Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security Privilege
Use 576 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security
Logon/Logoff 528 NETWORK SERVICE COMPAQ-2006
Success Audit 4/14/2010 9:10:24 PM Security System
Event 515 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006
Success Audit 4/14/2010 9:10:22 PM Security Policy
Change 850 SYSTEM COMPAQ-2006

Type Date Time Source Cate
Information 4/14/2010 11:34:34 PM eventlog None
6006 N/A COMPAQ-2006
Information 4/14/2010 11:34:33 PM Service Control
Manager None 7036 N/A COMPAQ-2006
Information 4/14/2010 11:30:33 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 10:35:53 PM Tcpip None 4201
N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 Compaq_Owner COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7035 SYSTEM COMPAQ-2006
Information 4/14/2010 9:11:40 PM Service Control Manager
None 7036 N/A COMPAQ-2006

Event Type: Information
Event Source: Tcpip
Event Category: None
Event ID: 4201
Date: 4/14/2010
Time: 10:35:53 PM
User: N/A
Computer: COMPAQ-2006
Description:
The system detected that network adapter
\DEVICE\TCPIP_{D5E50A75-4A1C-4421-A5B4-569C9FE131B8} was connected
to the network, and has initiated normal operation over the network
adapter.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 02 00 50 00 ......P.
0008: 00 00 00 00 69 10 00 40 ....i..@
0010: 02 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

I think that 10:35 PM event was the killer........
Our old friend Tcpip again. I have the feeling that, if I let it
run on past 11:30. it would repeat every hour or so.

I'm ready to clean out the Event Logs on the Clone
system, and Clean Boot, and do whatever you tell me to,
John, to track it down. I don't know what Network Adapter they're
referring to in the Event Description.....

Please do the clean boot.

John
That last run *was* from squeaky cleanest clean boot,
John. I can clear out the ancient history just to make
the Event Logs look smaller, but that isn't going to change anything.
As I see it, we have the Tcpip 10:35 PM Event Type 4201 which I
expanded out and posted......and that needs blocking or whatever.

Typically you should only be seeing one (if ever) Event 4201 from TCPIP
when the computer is booted, or when the adapter is disabled or enabled.
Have you always been getting multiple Events 4201? If yes this might
be indicative of faulty or failing network hardware, bad cable, bad
switch, bad router, bad NIC... Try disabling the network adapter and
see what happens, to disable the adapter go in "Network Connections" and
right click on the connection. On your previous effort with a different
clone, did you ever at any time successfully hibernate at 2 hours?

John