Re: PSA: Somehow, without action from me, hyberfile.sys got turned on

...He wrote:
> For Win10 22H2, Windows Defender updates use the servicing stack but 
> that use is only by checking the presence of a Servicing Stack.
> For Windows 10 any Serving Stack successfully installed after Sept 2025 
> is sufficient for Windows Defender to update its engine and defs. Even 
> if ESU has been enabled , the Sept. 25 as a mininum is still sufficient. 
> If ESU has been enabled, the most recent monthly cumulative update 
> provided by ESU would have installed the latest servicing stack.
> 
> Windows Defender's installation of its engine or defs does not instruct 
> Windows Update to update the Servicing Stack or cause a power policy reset.
> 
> i.e. The hypothesis that a serving stack power policy reset was 
> triggered during a Defender update is false.
> 
> Something else, user controlled - managed or changed or tampered has 
> occurred.

Hi Winston,

Thanks for debugging that hypothesis for where the ghost is in Windows.
The ghost exists. But I don't know where or how it enabled hibernation.

Yet.

Since I didn't manually toggle hibernation, I probably need to look at the
triggers that force hiberfile.sys back into existence to figure it out.

I appreciate the clarification on the Servicing Stack logic for the
22H2/ESU era. Technically, you are right: a Defender signature update is
not a "Servicing Stack Update" and shouldn't trigger a power state change.

However, the assertion that nothing in Windows re-enables hibernation
except user tampering is simply not supported by the overt evidence here.

While the Servicing Stack itself might be innocent, the Windows Update
Orchestrator (USO) and Power Manager are not. Based on my digging into the
Internet, there are at least three somewhat documented non-user
"mechanisms" that cause this on legacy hardware (like my 2009 rig):
 1. Maintenance Phase Resets
 2. Modern Standby/S0 Transitions
 3. Corruption Recovery

Maintenance Phase Resets: 
When the Update Orchestrator runs its "System Health" or "Remediation"
tasks (at times which are bundled with monthly reliability rollups), it
validates key system files. On older ACPI-compliant hardware, if the OS
detects a power configuration it deems "incomplete" (such as missing the
Fast Startup requirements), it possibly might "repair" the state by
reverting HibernateEnabled to 1. I think.

Modern Standby/S0 Transitions: 
Even on older systems, certain Windows 10 updates may attempt to bridge
legacy BIOS power states with Modern Standby logic. If a driver update
(like an Intel Management Engine or ACPI driver) occurs via Windows Update,
the installer script may possibly resets the power provider to defaults.

Corruption Recovery: 
If the registry hive containing the power settings hits a write error,
perhaps Windows reverts to the System default hive, where hibernation is On
by default.

I'm not sure which (if any) of those happened.
I'm only sure that I didn't overtly touch the hibernation settings.

To say it can't happen because it isn't intended to happen works fine in a
perfect environment, but there is always the reality of "Self-Healing"
scripts that Microsoft can use (and which Paul himself had alluded to).

I just ran this debug command which is useful likely for everyone here:
PS C:\> Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Boot'; Id=27} | Select-Object TimeCreated, @{N='BootType'; E={$_.Properties[0].Value}}

The results indicate no transition to a Hybrid Boot state, so the
hyberfile.sys was not created by a user changing power settings or a "Fast
Startup" toggle. 

It was most likely created by a background process while the OS was live.

TimeCreated            BootType
-----------            --------
3/31/2026 1:13:48 PM          0
3/30/2026 6:55:51 AM          0
3/29/2026 11:45:17 PM         0
3/29/2026 12:19:43 AM         0
3/28/2026 11:49:05 AM         0
3/27/2026 4:03:29 AM          0
3/27/2026 12:00:43 AM         0
3/24/2026 12:41:35 PM         0
3/24/2026 10:52:41 AM         0
3/22/2026 8:09:20 AM          0
3/22/2026 2:38:19 AM          0
3/22/2026 1:08:29 AM          0
3/21/2026 11:56:03 AM         0
3/20/2026 10:11:06 PM         0
3/19/2026 12:07:54 PM         0
3/18/2026 10:30:12 AM         0
3/17/2026 1:05:30 PM          0
3/14/2026 1:16:43 PM          0
3/12/2026 11:35:03 AM         0
3/11/2026 11:00:32 AM         0
3/10/2026 10:43:58 AM         0
3/8/2026 11:30:39 AM          0
3/6/2026 4:34:35 AM           0
3/6/2026 12:21:42 AM          0
3/5/2026 9:07:24 PM           0
3/3/2026 9:36:54 PM           0
3/1/2026 9:22:02 PM           0
2/28/2026 9:03:34 PM          0
2/28/2026 10:08:48 AM         0
2/27/2026 9:56:53 PM          0
2/27/2026 12:43:13 PM         0
2/26/2026 1:38:14 PM          0
2/25/2026 6:53:18 AM          0
2/24/2026 8:38:16 AM          0
2/23/2026 10:16:59 AM         0
2/22/2026 11:09:32 AM         0
2/21/2026 8:53:03 PM          0
2/20/2026 9:05:54 PM          0
2/20/2026 11:56:23 AM         0
2/19/2026 10:16:05 AM         0
2/18/2026 11:33:46 AM         0
2/17/2026 10:57:48 AM         0
2/16/2026 12:31:20 PM         0
2/14/2026 4:24:38 AM          0
2/14/2026 3:28:44 AM          0
2/14/2026 3:00:18 AM          0
2/14/2026 2:11:51 AM          0
2/13/2026 12:16:49 PM         0
2/12/2026 1:32:29 PM          0
2/8/2026 6:58:58 PM           0
2/6/2026 10:56:14 AM          0
2/6/2026 4:46:54 AM           0
2/4/2026 3:13:51 PM           0
2/4/2026 9:24:49 AM           0
2/3/2026 10:17:39 AM          0
2/2/2026 6:29:44 PM           0
2/2/2026 5:11:02 AM           0
2/1/2026 5:11:13 PM           0
2/1/2026 9:10:37 AM           0
1/31/2026 10:09:49 PM         0
1/31/2026 9:39:13 AM          0
1/30/2026 9:48:54 AM          0
1/30/2026 2:09:54 AM          0
1/29/2026 10:32:06 AM         0
1/29/2026 12:09:10 AM         0
1/28/2026 3:19:04 AM          0
1/27/2026 8:14:05 AM          0
1/24/2026 1:45:46 PM          0
1/23/2026 9:03:18 AM          0
1/23/2026 12:00:56 AM         0
1/22/2026 9:33:12 AM          0
1/21/2026 11:57:31 PM         0
1/21/2026 9:34:24 AM          0
1/20/2026 11:33:18 PM         0
1/19/2026 7:15:40 AM          0
1/18/2026 8:44:37 PM          0
1/17/2026 10:05:18 AM         0
1/16/2026 8:51:28 PM          0
1/15/2026 10:48:40 AM         0
1/14/2026 11:54:57 PM         0
1/14/2026 10:14:48 AM         0
1/13/2026 10:27:38 AM         0
1/13/2026 2:22:30 AM          0
1/12/2026 12:47:39 PM         0
1/11/2026 5:15:50 AM          0
1/10/2026 9:17:19 PM          0
1/10/2026 11:40:27 AM         0
1/9/2026 10:15:18 PM          0
1/9/2026 12:37:34 PM          0
1/9/2026 6:59:35 AM           0
1/7/2026 2:07:54 PM           0
1/6/2026 11:12:49 PM          0
1/5/2026 9:04:52 PM           0
1/5/2026 10:45:54 AM          0
1/5/2026 1:42:23 AM           0
1/4/2026 11:59:59 AM          0
1/3/2026 11:28:19 PM          0
1/2/2026 5:43:08 PM           0
1/1/2026 10:33:07 PM          0
1/1/2026 5:10:31 PM           0
1/1/2026 11:48:43 AM          0
12/31/2025 12:15:33 PM        0
12/30/2025 7:55:35 PM         0
12/29/2025 10:55:58 PM        0
12/29/2025 5:07:17 PM         0
12/29/2025 4:48:52 PM         0
12/28/2025 11:39:15 AM        0
12/27/2025 9:34:49 AM         0
12/26/2025 11:54:14 AM        0
12/25/2025 9:00:35 AM         0
12/24/2025 7:40:16 AM         0
12/23/2025 1:09:03 PM         0
12/22/2025 10:55:12 AM        0
12/21/2025 2:43:07 PM         0
12/18/2025 10:56:27 AM        0
12/17/2025 1:22:33 AM         0
12/14/2025 6:21:47 PM         0
12/14/2025 11:20:52 AM        0
12/13/2025 8:29:15 PM         0
12/13/2025 10:07:18 AM        0
12/12/2025 7:45:15 PM         0
12/11/2025 8:25:03 PM         0
12/11/2025 10:31:54 AM        0
12/10/2025 11:23:47 PM        0
12/10/2025 2:56:30 PM         0
12/9/2025 10:44:28 AM         0
12/7/2025 11:06:12 AM         0
12/6/2025 10:32:46 AM         0
12/4/2025 9:20:04 AM          0
12/3/2025 10:25:00 AM         0
12/2/2025 10:02:02 AM         0
12/2/2025 6:06:40 AM          0
12/1/2025 8:53:18 AM          0
11/30/2025 10:38:48 AM        0
11/29/2025 3:43:09 PM         0
11/29/2025 2:54:31 PM         0
11/13/2025 3:27:42 AM         0
11/11/2025 10:19:06 AM        0
11/10/2025 9:33:19 AM         0
11/7/2025 5:37:23 PM          0
11/7/2025 10:18:12 AM         0
11/5/2025 11:09:07 AM         0
11/4/2025 8:29:38 PM          0
11/4/2025 9:17:52 AM          0
11/3/2025 8:49:06 PM          0
11/3/2025 9:43:36 AM          0
11/2/2025 11:15:13 AM         0
10/31/2025 7:52:05 AM         0
10/30/2025 1:04:12 PM         0
10/29/2025 7:43:21 PM         0
10/28/2025 11:25:49 PM        0
10/28/2025 11:01:17 AM        0
10/27/2025 7:14:59 PM         0
10/27/2025 3:37:41 AM         0
10/26/2025 11:02:15 AM        0
10/23/2025 11:19:39 AM        0
10/21/2025 3:46:24 PM         0
10/20/2025 4:44:11 PM         0
10/20/2025 3:47:34 PM         0
10/20/2025 12:37:55 PM        0
10/19/2025 10:30:26 AM        0
10/18/2025 3:48:28 PM         0
10/18/2025 6:55:04 AM         0
10/16/2025 1:34:31 PM         0
10/15/2025 2:39:52 PM         0
10/15/2025 3:17:52 AM         0
10/14/2025 5:49:25 PM         0
10/13/2025 11:04:56 AM        0
10/11/2025 12:41:17 PM        0
10/10/2025 9:06:44 PM         0
10/9/2025 4:38:56 PM          0
10/8/2025 4:09:18 PM          0
10/7/2025 7:20:14 PM          0
10/7/2025 12:30:25 PM         0
10/6/2025 12:12:04 PM         0
10/5/2025 10:56:30 AM         0
10/4/2025 2:15:47 PM          0
10/3/2025 3:52:04 PM          0
10/3/2025 11:27:23 AM         0
10/2/2025 2:50:36 PM          0
10/2/2025 9:13:28 AM          0
10/1/2025 2:33:07 PM          0
9/29/2025 9:12:49 PM          0
9/27/2025 11:04:54 AM         0
9/26/2025 8:18:25 PM          0
9/26/2025 10:20:03 AM         0
9/25/2025 8:03:52 PM          0
9/24/2025 11:42:13 PM         0
9/23/2025 9:48:31 AM          0
9/22/2025 10:47:05 AM         0
9/21/2025 9:48:31 AM          0
9/20/2025 11:13:12 PM         0
9/20/2025 9:08:29 PM          0
9/17/2025 9:32:37 AM          0
9/16/2025 10:05:26 AM         0
9/15/2025 3:58:18 PM          0
9/13/2025 10:41:26 AM         0
9/12/2025 11:04:35 AM         0
9/11/2025 6:45:37 AM          0
9/10/2025 7:28:26 PM          0
9/10/2025 1:09:37 PM          0
9/9/2025 9:21:30 AM           0
9/8/2025 2:12:20 PM           0
9/8/2025 10:22:58 AM          0
9/6/2025 1:08:08 PM           0
9/4/2025 4:53:11 PM           0
9/4/2025 12:18:52 PM          0
9/2/2025 6:16:58 PM           0
9/2/2025 9:14:25 AM           0
9/2/2025 1:43:16 AM           0
9/2/2025 12:41:27 AM          0
9/1/2025 10:24:14 AM          0
8/31/2025 3:09:02 PM          0
8/31/2025 1:04:32 PM          0
8/31/2025 12:56:56 PM         0
8/31/2025 11:32:49 AM         0
8/31/2025 5:47:53 AM          0
8/30/2025 10:39:50 AM         0
8/29/2025 10:49:57 AM         0
8/28/2025 11:58:03 AM         0
8/27/2025 6:35:26 PM          0
8/27/2025 1:07:17 PM          0
8/26/2025 6:59:39 PM          0
8/26/2025 9:34:00 AM          0
8/25/2025 8:38:23 PM          0
8/23/2025 11:16:58 AM         0
8/22/2025 3:18:47 PM          0
8/22/2025 3:59:14 AM          0
8/21/2025 6:55:46 PM          0
8/19/2025 1:36:12 PM          0
8/18/2025 9:25:06 AM          0
8/16/2025 6:27:18 PM          0
8/16/2025 10:21:45 AM         0
8/15/2025 5:35:29 PM          0
8/15/2025 9:29:42 AM          0
8/14/2025 11:18:09 AM         0
8/14/2025 3:16:00 AM          0
8/14/2025 12:45:10 AM         0
8/13/2025 6:44:37 AM          0
8/11/2025 9:46:54 AM          0
8/10/2025 11:16:07 AM         0
... etc ... 

That's hundreds of boots over half a year and every single one is a Type 0
(Cold Boot) which proves that this part of the system configuration was
stable for quite a while. 

I'm guessing (from the dataset) but since hiberfil.sys was recreated but
the BootType remained 0, it probably wasn't a "Fast Startup" event. 

Instead, it was most likely a "Live" System Change where something
triggered the HiberbootEnabled registry value to reset to 1, which
commanded the kernel to reserve that hyberfile.sys disk space.

Note since we're all Windows experts on this newsgroup, I'm not claiming
certainty about the exact trigger. I'm only claiming that the logs rule out
the usual suspects. I believe something in the running system reset the
hibernation state, and the kernel responded by allocating the file.

But what?
-- 
Every post to Usenet should strive to add value or it shouldn't be posted.