Sleep Study in Windows 10

[Hellbovine]

I was Googling how to disable the SleepStudy in Windows 10, which creates a bunch of ETL files and runs on my desktop that has all forms of away/hibernate/sleep disabled.

Well I stumbled on an article by the Microsoft Defrag Tools team (https://docs.microsoft.com/en-us/shows/defrag-tools/168-powercfg-sleep-study) and so I e-mailed them, asking how to disable SleepStudy.

I got a reply back from the Microsoft team, and we discussed a few things too, like why is the OS growing in resource usage so much, and they said a few points:

1) Microsoft's policies are to never remove features once they are implemented into the OS, which is why each new Windows gets heavier as time progresses.

2) They helped me solve it. It turns out that it was just a scheduled task which is easy to find. I just hadn't tweaked anything in the tasks yet, I've been focusing solely on the registry so far, and I assumed it would be a registry tweak since some of the other AutoLoggers are.

Edit: updated the post, it was moved as a reply from another thread into a thread of its own, and now a lot of this post is out of context, so that discussion was all removed from my original post now by me.

 

[MacVap]

Hellbovine Care to share how to disable Sleep Study? I have heavily lited & tweaked Win10 with ALL scheduled tasks disabled and the little bugger still appears.

 

[garlin]

You want to disable/delete Sleep Study's reporting task, and (optionally) stop the ETL providers supplying performance data.

schtasks /delete /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /f

wevtutil sl Microsoft-Windows-SleepStudy/Diagnostic /e:false
wevtutil sl Microsoft-Windows-Kernel-Processor-Power/Diagnostic /e:false
wevtutil sl Microsoft-Windows-UserModePowerService/Diagnostic /e:false

From NTLite, you can disable AnalyzeSystem task and by default all those ETL providers are disabled. There's a couple of more PnP Diagnostic providers, but you probably should keep them for normal error reporting.

                <ScheduledTasks>
                        <TweakGroup name="Tree\Microsoft\Windows\Power Efficiency Diagnostics">
                                <Tweak name="AnalyzeSystem\AnalyzeSystem">remove</Tweak>
                        </TweakGroup>
                </ScheduledTasks>

 

[Deleted member 8142]

Very dirty trick to lock sleepstudy for any user access which is found in system32 directory of w10.

Powershell -C "Write-Host 'Removing Everbody Access' -ForegroundColor Green"
icacls "%Windir%\System32\SleepStudy" /setowner "NT AUTHORITY\LOCAL SERVICE"
echo y| cacls.exe "%Windir%\System32\SleepStudy" /S:"DAI(D;OICI;DCLCRPCR;;;WD)(D;OICI;FA;;;AN)"

 

[Clanger]

dirty trick? i like a good kludge

 

[Hellbovine]

Care to share how to disable Sleep Study? I have heavily lited & tweaked Win10 with ALL scheduled tasks disabled and the little bugger still appears.

Yeah, sorry I wasn't at my normal computer when I posted this. It looks like Garlin already addressed it, but just for completeness here is what the Microsoft guys gave me to use:

schtasks /change /tn "\microsoft\windows\power efficiency diagnostics\analyzesystem" /disable

You can also manually go to the task by using these steps:

Start > Windows Administrative Tools > Task Scheduler

Then expand the tree down:

Task Scheduler Library > Microsoft > Windows > Power Efficiency Diagnostics

Then right-click on the "AnalyzeSystem" trigger and you can disable or delete it manually.

 

[MacVap]

My Win10 install in a VM (the penultimate LTSC) was butchered with multiple tools (I know, a big no-no), Performance logs and alerts was taken out so I can not see/disable ETL providers in a regular way. Nevertheless, they are disabled in the registry (almost all); and ALL scheduled tasks are disabled (because of my experience in Win8.1, when deleted tasks were recreated, I just disable them running as Trusted Installer). Does that mean that Windows re-enables some of them? Possible, but I haven't caught it.

Anyway, this is begging for a fresh install, I just don't have the time...

 

[Hellbovine]

Yeah Windows does re-enable a lot of things, it will actually change your power plan without your notification or permission, it reverts registry keys, and even re-installs software. There's a ton of self-healing capabilities in Windows 10.

The only real way to avoid the re-enabling is to not use Windows Update at all, Microsoft does most of the self-healing during updates.

 

[Deleted member 8142]

Not with me M$ cant do anything on my machine without my acknowledgement .