Re: PSA: Somehow, without action from me, hyberfile.sys got turned on

On 4/1/2026 4:24 AM, Maria Sophia wrote:
> Maria Sophia wrote:
>> Apparently, it "can" happen.
>> Apparently it "did" happen.
> 
> How the heck did this happen that hibernation was turned on but not by me?
> 
> Based on Winston's kind and helpful comment that it can't happen, I'm
> faithfully digging into if/how an unsupported Win10 box can change the
> power configuration without the user's consent, as it surprised me too.
> 
> Especially as I'm testing what happens on an unsupported Win10 box.
> (I never signed up for the MSA so I can't get the free ESU updates.)
> 
> Certainly I received Windows Defender updates as shown below:
>   Security Intelligence Update for Microsoft Defender Antivirus
>   KB2267602 (Version 1.447.105.0) - Current Channel (Broad)
>   Successfully installed on 3/31/2026
> 
>   Security Intelligence Update for Microsoft Defender Antivirus
>   KB2267602 (Version 1.447.96.0) - Current Channel (Broad)
>   Successfully installed on 3/30/2026
> 
> Apparently Windows defender updates use the Windows servicing stack.
> Which is apparently the same infrastructure used for Windows Update.
> 
> Apparently the servicing stack periodically validates system configuration.
> Apparently if a power policy has issues, Windows restores defaults.
> 
> Where the default for Windows 10 is:
>   a. Hibernation ON
>   b. HibernateEnabled = 1
>   c. hiberfil.sys created
> As shown by:
>   C:\> reg query HKLM\SYSTEM\CurrentControlSet\Control\Power /v HibernateEnabled
> 
> My theory?
> 
> A Windows servicing stack power-policy reset triggered during a Defender update cycle.
> 
> Can I prove that?
> Nope.
> 
> But since it happened, there must be a mechanism for it to happen.
> It's all I can think of that might do it without the users' knowledge.
> 
> There is a way to stop this, but it's nuclear.
>   C:\> powercfg /h off
>   C:\> cd C:\
>   C:\> echo. > hiberfil.sys
>   C:\> attrib +r +s +h hiberfil.sys
>   C:\> reg add HKLM\SYSTEM\CurrentControlSet\Control\Power /v HibernateEnabled /t REG_DWORD /d 0 /f
> 
> That supposedly will permanently disable hibernation by turning it off, and
> then blocking Windows from recreating the hibernation file, and then forcing
> the system to keep hibernation disabled at the registry level.
> 
> I just did those commands.
> I'll let you know if hiberfile.sys ever comes back alive again.

I run a daily batch and if you do just add this line:
IF EXIST C:\hiberfil.sys POWERCFG /H OFF