|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
BUT
C:\Windows\System32\SleepStudy\UserNotPresentSession.etl
is NOT THERE!!
I thought I had patched this problem long ago, with a startup .bat file that deleted .etl files from that folder.
I can add and remove that startup program, and RESTART, with no effects now.
Windows 10 22H2 is writing 3.8MB/sec to a file that Windows 10 says IS NOT THERE??
now, checking the Properties for the SleepStudy folder,
I’m seeing
ANONYMOUS LOGON
-and-
Account Unknown (etc.)
Have I been hacked by an anonymous intruder?
You haven’t been hacked…
I see the same accounts in Properties > Security for that .etl file.
You’ll find them in other files as well.
The fact that you say that the disk activity went away with shutting down and rebooting the computer suggests to me that what you saw was a system (PID 4) process that was actively handling the file in question, therefore the word “Normal” instead of “Background” in the column for I/O Priority. Disk activity that high can be something as innocuous as a disk defrag (if you have an HDD) or optimization (if you have an SSD).
Since you’ve rebooted your machine as part of your experiment, Windows might have recreated the folders that you renamed (depending on your system settings), so go in there and take a look to see if they’re back and are right alongside the ones you renamed. You might not need to rename anything.
On my system, I had to click through a special cautionary box about getting access to the SleepStudy folder to get permission to look at it for the first time, even logged in with an administrator account, so be careful handling some of the files and folders in here. That cautionary box usually only comes up for folders and files that are supposed to be specially protected operating system files and folders.
That particular review is from 2021…
There might be a driver update.
I would suggest downloading and installing Sysinternals Process Explorer.
Right-click on a high-CPU process and select Properties.
Click on the Threads tab to see the state of each thread in the process.
Another thing you can do is download Sysinternals free program Process Monitor, and let it run for a while. It has nice filtering features that will allow you to narrow down what was running at the time, as well as setting “watch” filters.
https://technet.microsoft.com/en-us/sysinternals/bb896645
Set up Process Monitor and let it run continuously. There is a logging feature. Turn it on by clicking on File > Backing Files…. There will be two options: Use virtual memory (which is the default), and Use file named:.
Click on the Browse button (the one with 3 dots) and it will take you to the folder where Process Monitor is installed. Enter a file name. It will automatically be given an extension of .PML. Click Save.
When Process Monitor is restarted, check that File > Capture Events is checked. It will log everything within the filter criteria that has been set up (default filters are fine for now).
I would set it up to see what is writing to and reading UserNotPresentSession.etl
Anyone with Process Monitor will be able to use it to open the .PML file and view it as if it were on their system.
The ProcMon filter you would use is Path.
The value would be C:\Windows\System32\SleepStudy\UserNotPresentSession.etl
I also downloaded and updated the device driver for the Highpoint SSD7103:
I didn’t see any drivers for the 7103 on the Highpoint site…
There is a note about SSD vendor drivers conflicting with Highpoint NVMe RAID solutions.
How old is the SSD?
What does your SSD SMART status tell you about the remaining life?
You may find the writes make no difference to its longevity.
cheers, Paul
My email to Highpoint is dated May 2020:
I managed to completely disable Sleep Study and all the files it creates as follows:
1st. Open Task Scheduler > Microsoft > Windows > Power Efficiency Diagnostics > AnalyzeSystem and disabled & delete that task.
2nd. Delete the contents of the SleepFolder and then remove all access to it.
1- Open Windows Explorer and navigate to C:\Windows\System32\SleepStudy.
2- Right-click the SleepStudy folder > Properties > Security tab > click the Advanced button.
3- Click the Change option to the right of “Owners:” and set Administrators (or your user if it’s not an administrator) as the new owner, click the Replace owner on subcontainers and objects box, click OK twice to exit back to Explorer.
4- Repeat step 2.
5- Click the Disable inheritance button, select the Convert inherited permissions into explicit permissions on this object option, click OK twice to exit back to Explorer.
6- Delete all the files and subfolders in the SleepStudy folder (i.e. the folder should now be empty.)
7- Repeat step 2.
8- Remove all the users in “Permission entries:“, click OK, answer “Yes” to the Do you want to continue? prompt, click OK to exit back to Explorer.
The Sleep Study process is now completely disabled and you won’t get any error notices about it failing when starting Windows.
Just FYI, after completing the above steps, there’s no longer any writes to the .etl files (because the system can no longer access the SleepStudy folder to create them) and my “System” process now shows 0%.
Of course I don’t have any of those Samsung NVMe drives, my are all Samsung Sata SSDs.
Have you tired use Samsung Magician to check to see if there’s a firmware update available for them?
BTW, I don’t really understand how the NVMe drivers (or any other drivers for that matter) would have an effect on what the Sleep Study process does.
Sleep Study tells you how well the system slept and how much activity it experienced during that time.
Oh, boy, I hope everyone still reading here gets a GOOD BELLY LAUGH from the following:
I like to add supplemental cooling fans to workstations.
To supplement the chassis cooling for our HP Z220 tower workstation, I recycled the cardboard backing from a desk top calendar.
I was attaching this jury rig with electrical tape, but I noticed that the tape was coming loose.
So, to fix that problem, I replaced the electrical tape with good ol’ fashioned DUCK TAPE!
Great SEAL of approval there (pun intended). Call me a QUACK, I won’t mind!!
Now, however, the fans I mounted in that cardboard jury rig had to work harder, because the duck tape was sealing the seams much more tightly.
You’ll never guess: this new duck tape solution caused a Vantec USB 3.0 adapter to STOP working, even though it has been powered correctly via a chain of molex extension cables.
And, it turned out that those extension cables had too many extensions.
Consequently, the molex input cable was not supplying the Vantec USB 3.0 adapter with sufficient power, and 2 x SanDisk 256GB flash drives stopped showing up in Windows Explorer.
I re-seated that Vantec adapter, and removed the unnecessary molex extension cables.
I also attached my cardboard jury rig with smaller strips of electrical tape, to allow the internal chassis over-pressure to escape more easily and not over-burden any of the chassis fans.
VOILA! Not only did the Vantec adapter start working again.
THE CPU OVERHEAD HAS VANISHED!
Whew, what a CHAIN REACTION!
I should go back to school and study nuclear physics.
p.s. I am available at any time to receive my 30 lashes with a wet noodle.
IME computers suck air in at the front and blow it out the rear.
If you are pressurising the rear you may be upsetting the internal airflow and reducing cooling.
cheers, Paul
I agree that is one-half of “computer ventilation” basics 
Our Vantec twin fans mount in an available PCI slot:
https://www.newegg.com/vantec-sp-fc70-bl-pci-slot-case-cooler/p/N82E16835888112
The slow fan in the bottom rear end of our left side panel merely adds a small amount of colder air to the upwards flow of those twin fans.
Not only do computers suck air in the front, and blow it out the rear; warm air rises naturally by operation of convection — like hot air balloons.
The Vantec twin fans direct cooler air directly onto the RAID controller’s heatsink.
The air that is warmed as it rises upwards naturally,then exhausts out the rear fan and the PSU’s internal fan.
So, I would add to your general observation by saying that computers suck air in and blow it out the back; computers should also suck air in near the bottom, preferably the front, and that warmed air should rise upwards to exhaust out the top and/or the rear exhaust fans and PSU’s internal fan when the PSU is located at the top/rear.
PCs don’t use convection cooling, it isn’t good enough. That’s why they have variable speed fans.
cheers, Paul
Vantec UGT-PC345 USB 3.0 adapter
Here’s another 2-pin adapter from EN-LABS, but the USB female connectors are close enough to each other, that many USB flash drives won’t fit in pairs when their housings are wide:
Dual Port USB 3.0 to Motherboard Mainboard Internal 20pin /19pin Header Adapter, 20-pins to 2 X USB A Female Connector
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Notifications
