Find what wakes a Windows 11 PC immediately after sleep

A PC that wakes within seconds may have a mouse, network adapter, wake timer or driver that prevented sleep in the first place. Microsoft's powercfg commands expose available sleep states, the last wake source, armed devices and active timers. These are distinct clues. Disable only the confirmed wake source; otherwise a blanket change can break keyboard wake, remote management or backup schedules while the original problem remains.

Before you start​

Record the approximate sleep and wake times, whether the system used a dock, and which wake behavior you actually need. Save work and update the relevant device driver from its maker. Keep a local keyboard or power-button recovery path before changing wake permissions. On a work PC, scheduled management tasks may be intentional.

Do it step by step​

1. Run powercfg /a and note the supported sleep states; a device using Modern Standby may not behave like an older S3 PC.
2. Put the PC to sleep, observe the wake, then promptly run powercfg /lastwake. Record its reported source rather than relying on a vague memory.
3. Run powercfg /devicequery wake_armed and powercfg /waketimers. Compare them with the last-wake report and the actual time; an armed device is only a candidate.
4. If a confirmed mouse or network adapter is the source, adjust that device's wake permission in Device Manager or use Microsoft's powercfg option for that named device. Preserve keyboard or power-button access.
5. If a scheduled timer is responsible, inspect the owning task and why it runs before changing timer policy. If powercfg /requests shows activity, the issue may be failure to enter sleep rather than waking.
6. Repeat the test several times, then restore any unrelated wake permission changed during diagnosis. Record the exact driver or task for future updates.

Check the result​

The PC enters its intended sleep state and stays asleep for the test interval while required wake methods still work.

If something goes wrong​

A last-wake result can be unknown; use event logs and a repeat test rather than disabling every device. If dock behavior differs from undocked behavior, update the dock and test each configuration. If only closing the lid fails, inspect lid and external display settings.

Know the limit​

Powercfg reveals current state and history, not certainty about malicious activity. Firmware can also generate wakes. Do not disable security updates merely to quiet one scheduled wake. Microsoft powercfg wake options

Decision checkpoint​

Preserve the wake behavior you actually use. A desktop may rely on keyboard wake for accessibility; a work PC may need scheduled maintenance. One failed sleep test is not enough to disable both. Change a single identified source, repeat the same test and note any tradeoff. If the culprit is firmware, use only the PC maker's approved update path and keep the BitLocker recovery key available before flashing.

Aftercare​

Verify the system can still wake through the method you need. An apparently fixed wake problem can hide a new accessibility or remote-management issue if every wake source was disabled.