How can I tell whether the system booted because of Wake-on-LAN (WoL) or because of the power button?

In Windows 10, I would like to know how I can tell in a script whether the system booted because it was turned on by receiving a Wake-on-LAN (WoL) packet, or because it was turned on because of pushing the power button.

I did find the WakeUpType property of the Win32_ComputerSystem class. That is documented to return the "event that causes the system to power up". There are 9 possible return values, one of them being "5" (meaning "LAN Remote").

Unfortunately, on my system it always seems to return "6" (meaning "Power Switch"):

PS C:\WINDOWS\system32> echo $(Get-WmiObject -class win32_computersystem).wakeuptype
6

I noticed that after putting the system to sleep and waking it using WoL, Windows posts an event in the System eventlog with source "Power-Troubleshooter" and event ID 1, containing the text:

Wake Source: Device -Intel(R) 82579V Gigabit Network Connection

Also, powercfg /lastwake reports the NIC as the reason for waking up. So, at least when waking from sleep Windows is able to determine that it woke up because of a WoL packet, even though the WakeUpType property still returns "6" (Power Switch) in that case.

Unfortunately, when the system receives a WoL packet in S5 state it will properly power up and boot, but I can't tell that it booted because of WoL. powercfg /lastwake shows exactly the same output as it does when the system powers on from S5 because of pushing the power button:

C:\WINDOWS\system32>powercfg /lastwake
Wake History Count - 0

How can I reliably tell, from any power state (up to S5), that the system powered on/woke up because of WoL?

Solution 1:

My approach would be to use dmidecode which will read data from the BIOS, with something like

dmidecode | findstr /R /C:"Wake-up"

Similarly to feitingen's answer to this question

If that doesn't work then your hardware must not be properly recording that value.