18

About a week ago my Windows 10 Pro started waking up in a middle of the night. I've had similar problems about half a year ago, but managed to configure the cause - unruly UpdateOrchestration task and disable it - using this answer. Disabling the "Wake the computer..." option in Reboot task helped.

However, about a week ago the computer started waking in the middle of the night again and I am unable to convince the Reboot to stay down this time. When I uncheck "Wake the computer..." option a window appears that asks me to provide login credentials for some mysterious S-1-5-18 user that I have never heard about (see the picture below, I use the Polish Windows version).

enter image description here

I have no idea what the password for S-1-5-18 should be. This window's dropdown allows me to choose other users though, besides the mysterious S-1-5-18 - in fact there seems to be about 5 accounts with names similar to my Windows username (why there is a multitude of them? I have no idea, Control Panel shows me as the only user of this computer); when I select one of them in the dropdown and enter my password I get the following message (translated from Polish to English):

The supplied variant structure contains invalid data

Do you have any idea how to disable the computer from rebooting at night?

--

EDIT: To clarify the multiple username thing: there is a single S-1-5-18 user in the dropdown. The multiple user thing I said pertains to my original Windows username. The following picture shows the content of the users dropdown. I have edited out the names that show my original email address, my real name or the names of my computers.enter image description here.

EDIT2: I tried disabling the "Wake to run" option on the task using PowerShell, with the following script and it also did not work. No error is given but the WakeToRun stays true.

 ?{ $_.Settings.WakeToRun -eq $true -and $_.State -ne 'Disabled' } |
%{
    write-host $_
    $_.Settings.WakeToRun = $false;
    Set-ScheduledTask $_
 }
  • If you have multiple S-1-5-18 which of course is the Local System account you have a problem. Could offer other links but I am way to lazy for that effort tonight. I would red to know, exactly how similar the other usernames are to one another, won’t do any research till that information is known (and contained within the question) not a comment – Ramhound Nov 16 '17 at 1:16
  • @Ramhound I have updated the question. Please note, that I have never said I have multiple S-1-5-18. I have multiple users similar to my own Windows username. – lukeg Nov 16 '17 at 9:29
  • 1
    The S-1-5-18 SID belongs to a well known account. Microsoft has a list of those. Your dropdown doesn't necessarily show current users but also users you have used in the past. To see the actual accounts that are setup on your machine open the run dialog and type in lusrmgr.msc. That will get you a console which would help you. Well known IDs/System accounts aren't going to be visible. But it should help you to figure out whenever multiple lukeg accounts exist on your system. – Seth Nov 16 '17 at 11:11
  • @Seth Thanks. Using lusrmgr.msc confirmed that there is in fact a single lukeg account. However, I am still not sure what credentials to enter when changing UpdateOrchestrator Reboot task. Do I have to use S-1-5-18 username or my existing lukeg account? When I use the latter I enter my online MS account password - however that ends with aforementioned "The supplied variant structure contains invalid data" message. – lukeg Nov 16 '17 at 12:28
  • I never said you had multiple Local System accounts just if you had multiple that would be a problem (what you said was long winded and could be taken multiple ways) – Ramhound Nov 16 '17 at 12:49
20

I was eventually able to disable the Reboot task. Firstly, I tried the following line in cmd:

SCHTASKS /Change /TN "Microsoft\Windows\UpdateOrchestrator\Reboot" /DISABLE

It did not work, and the error message said I do not have sufficient privileges to modify the task (even though I work on a Windows admin account). However, thanks to this message, I was able to find information about NSudo program. Per the already linked hint, I used it in a TrustedInstaller mode to start cmd and - lo and behold - SCHTASKS now worked perfectly, allowing me to disable the Reboot task. Windows is user friendly, they said.

EDIT: To make things clearer, NSudo gives you privilages over Reboot task and you do not have to use exactly the cmd listed above to disable Reboot task. Alternatively you may, for example, use it to run taskschd.msc and edit the Reboot task to your liking in the window that opens (for example by unchecking the "Wake up..." checkbox).

I have found that the changes don't always stick. The aforementioned message states that on has to issue the following command using cmd from NSudo (note you may have to translate the account names to language your Windows uses):

icacls "%WINDIR%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot" /inheritance:r /deny "Everyone:F" /deny "SYSTEM:F" /deny "Local Service:F" /deny "Administrators:F"
  • 1
    thanks for this, I had the exact same problem on Polish version of Windows :) – Adassko Jan 7 '18 at 21:57
  • NSudo - the hell? How does it work? I mean, it works, thank you, but, WHY? – Locane Mar 15 '18 at 18:05
  • Man I hate Windows. – jcollum Mar 21 '18 at 2:42
  • link for NSudo majorgeeks.com/files/details/nsudo.html -- the repo doesn't really give you any idea of where to get it – jcollum Mar 23 '18 at 4:21
  • 1
    Mmm that sounds wonderful... But even with nsudo, running taskschd.msc to edit the reboot task, on pressing OK windows asks for the password to the S-1-5-18 account. – zx81 Jul 14 '18 at 17:58
1

Solution for new hindu$oft 17134 something

jest run regedit.exe and paste this to path bar then delete subfolders

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator

its working like some russian malware that you can't remove, service "Update Orchestrator Service" will be try to renable windows update or recreate task and you can't disable manual. try this one, or run Windows update service "Log on" as some user that should block auto run

takeown /f "%WINDIR%\System32\UsoClient.exe" /a
icacls "%WINDIR%\System32\UsoClient.exe" /remove "Administrators" "Authenticated Users" "Users" "System"

icacls "%WINDIR%\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot" /inheritance:r /deny "Everyone:F" /deny "SYSTEM:F" /deny "Local Service:F" /deny "Administrators:F"

takeown /f "%WINDIR%\System32\UsoClient.exe" /a
icacls "%WINDIR%\System32\UsoClient.exe" /inheritance:r /remove "Administrators" "Authenticated Users" "Users" "System"

I know windows update is important but windows 10 is still in Alpha, Bill please come back ?

0

S-1-5-18 is a local SYSTEM account. It has no password and only services can run under it.

But there is a tool psexec that can allow a user app to run under SYSTEM account. You can use it like this:

psexec.exe -i -s schtasks ...

However, even disabling wakeup for the Reboot task won't stop the reboots entirely.

The following alternative solution worked for me:

Go into "Power Options" -> "Change When Computer Goes to Sleep" -> "Advanced Options".

Under "Sleep" you'll see "Allow wake timers". Set both "on battery" and "plugged in" of to "Disable".

power options - sleep

That should take care if it.

You'll have to check again after updates as Microsoft sometimes resets that and enables the wake up timers when plugged in.

protected by Community Apr 9 '18 at 23:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.