Nothing matches that yet. Tell us what you were looking for and it goes on the list.
Windows System Log · Event 42
Windows recorded that the machine went to sleep, and why. It is informational, and it is the event people find when they are actually looking for Kernel-Power 41. The Sleep Reason field is the whole value here: it separates a lid closing from an idle timeout from an app putting the PC to sleep.
Also written as Event ID 42Kernel-Power 42The system is entering sleepsleep reason kernel power
Your PC went to sleep. This is not an error, even though it sits next to Kernel-Power 41, which is. If your machine keeps sleeping when you do not want it to, this event tells you who asked: closing the lid, the idle timer running out, the battery getting low, or a program requesting it.
Useful as a bracket around gaps in other telemetry: an EDR agent going quiet between an Event 42 and the next resume is explained, and one going quiet without an Event 42 is not. It is also the cleanest way to prove a laptop was asleep rather than powered off during a window under question, because a shutdown writes 1074 or 6006 instead.
Sanitised. Addresses come from the RFC 5737 documentation ranges.
Log Name: System
Source: Microsoft-Windows-Kernel-Power
Event ID: 42
Level: Information
Computer: LAPTOP-WKS117
The system is entering sleep.
Sleep Reason: Button or LidEverything else in the log line is context.
Button or LidYou pressed the power button or closed the lid. IdleThe power plan's sleep timer expired with no activity. Application APIA program asked Windows to sleep. Media apps, vendor utilities, and remote management tools all do this. BatteryThe battery reached the critical threshold and Windows slept to protect unsaved work. Most of the time it is one of these.
What gives it awaySleep Reason of Application API on a machine nobody was using, repeated, with no scheduled task or vendor utility that explains it. Correlate against process creation for rundll32 or powercfg activity at the same second.
ATT&CK T1562.001Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'; Id=42,107} -MaxEvents 100 | Sort-Object TimeCreated | Select-Object TimeCreated, Id, MessageGet-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Power-Troubleshooter'; Id=1} -MaxEvents 20 | Format-List TimeCreated, Messagepowercfg /sleepstudy /output C:\sleepstudy.htmlwevtutil qe System "/q:*[System[Provider[@Name='Microsoft-Windows-Kernel-Power'] and (EventID=42)]]" /c:10 /rd:true /f:textNo. Event 42 is informational and simply records that the machine went to sleep along with the reason. It is frequently mistaken for Event 41, which is the Kernel-Power event that does indicate a problem — 41 means Windows found on startup that the previous shutdown never happened cleanly.
Read the Sleep Reason on each Event 42. 'Idle' means the power plan's sleep timer is expiring, so raise or disable it in power settings. 'Application API' means a program asked for the sleep, and `powercfg /sleepstudy` will name it. 'Battery' means the critical battery action fired, which on a machine that is plugged in points at a failing battery or a charger that is not delivering power.
Event 42 records the sleep, not the wake. The wake is Kernel-Power Event 107, and the useful one is Microsoft-Windows-Power-Troubleshooter Event 1, which includes a Wake Source naming the device, timer, or power button responsible. `powercfg -lastwake` gives the same answer from the command line for the most recent wake only.
A program called the Windows API that requests a sleep transition, rather than the sleep coming from you or from the idle timer. Vendor power utilities, remote management agents, and some media software all do this legitimately. It is worth identifying which one, because it is the only Sleep Reason that does not correspond to something a person or a timer did.
Last reviewed 7 September 2026