How to fix Event ID 566 Kernel-Power error?

Kernel-Power Event ID 566 reads "The system session has transitioned from X to Y" and is an Information entry, not an error. Windows writes it each time the PC changes power state, such as sleep, wake or shutdown. Fix nothing until you have checked whether a real crash or an unwanted wake sits next to it.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2, with notes for Windows Server.

What Kernel-Power Event ID 566 means and why it is not an error

Event ID 566 comes from the provider Microsoft-Windows-Kernel-Power in the System log. Its level is Information, the same level as "the Event log service was started". Its General tab shows one short line, for example "The system session has transitioned from 0 to 1." On Windows 11 a second line names the reason, such as "Reason SxTransition".

The line is a summary of the event data on the Details tab. There Windows stores the number of the session that ended, the number of the session that started, the power state of each, how long the previous one lasted, the battery charge at its start and end, and why the state changed.

• Other spellings. Event 566, EventID 566, Kernel-Power 566, kernel power event 566 and error 566 all mean this one entry. The number is an event ID, not a Windows error code.
• Not the Security log event 566. Older Windows versions used Security log event 566 for an object operation. That is a different event from a different source and has nothing to do with power.
• Why the numbers sometimes jump by two. We could not confirm from Microsoft why some entries go from 1 to 3 or from 4 to 6. Treat it as normal unless a crash event sits next to it.

The Reason in event 566: what woke, slept or changed the PC

The Reason is the useful part of the event. Windows 11 prints its name on the General tab. Windows 10 and Windows Server print a number, for example "Reason: 22". The names match Microsoft's documented list of power monitor request reasons, and the number is the position in that list, counted from 0.

The session type fields work the same way. A technical answer on Super User maps them to the Windows power states: 1 is working, 2 to 4 are sleep states, 5 is hibernation and 6 is shutdown. In its example, type 3 followed by type 1 meant waking from sleep. Microsoft does not document this mapping for event 566, so use it as a hint.

Why you see event 566, and when it points to a real problem

Most often, event 566 is simply Windows going to sleep, waking up, or switching the screen state, and nothing is wrong. Less often, it marks an unwanted wake, a sleep that did not happen or a restart that did not finish. Rarely, it sits right before a crash, and then the crash is the problem, not 566.

How to read Event ID 566 and fix what stands behind it

Fix 1 and Fix 2 take about ten minutes and tell you whether there is anything to fix. Fixes 3 to 6 deal with unwanted wakes, standby drain and restarts that do not finish. Fix 7 is for a real crash found next to event 566.

Fix 1. Open the Details tab of event 566 and read the Reason

5 minutesNo riskEveryone who found event 566 and wants to know what it records.

The General tab gives only two session numbers. The Details tab shows the session types and the Reason, which tell you whether the PC slept, woke, hibernated or shut down, and what triggered it.

1. Press Win + R, type eventvwr and select OK.
2. Expand Windows Logs and select System.
3. Select Filter Current Log in the right pane, type 566 in the event ID box and select OK.
4. Double-click an entry whose source is Kernel-Power.
5. On the General tab, note the time, the two session numbers and the Reason.
6. Open the Details tab, choose Friendly View and expand EventData.
7. Read PreviousSessionType, NextSessionType and Reason, and compare them with the Reason table above.

PowerShell: the last 20 entries of event 566 with their text

Get-WinEvent -FilterHashtable @{ LogName='System'; ProviderName='Microsoft-Windows-Kernel-Power'; Id=566 } -MaxEvents 20 |
  Format-Table TimeCreated, Message -Wrap

• PreviousSessionDurationInUs is in microseconds. Divide by 1,000,000 to get seconds: 122364356 is about two minutes.
• PowerStateAc true means the PC was on mains power. On a laptop, false means it ran on battery.
• Energy capacity fields show the battery charge at the start and end of the session. A large drop over a short sleep is a sign for Fix 5.

Fix 2. Check whether a real crash or power loss sits next to event 566

5 minutesNo riskYour PC crashes, restarts by itself or goes black, and event 566 is what you found in the log.

Event 566 is logged around every power change, so it also appears near crashes. The events that describe a crash are Kernel-Power 41, EventLog 6008 and the 1001 bug check record. One list shows whether any of them is there.

1. Right-click Start and select Terminal (Admin). On Windows 10, search for PowerShell, right-click it and select Run as administrator.
2. Paste the command below and press Enter.
3. Read the rows around the time of your crash.
4. If you see only 566 rows, the PC changed power state normally. Go back to Fix 1.
5. If you see ID 41 or ID 6008, the shutdown was not clean. Open that event 41 in Event Viewer and read BugcheckCode and PowerButtonTimestamp on its Details tab.
6. If you see ID 1001 with the text "The computer has rebooted from a bugcheck", Windows crashed. Note the bug check code and go to Fix 7.

PowerShell (as administrator): power and crash events of the last 7 days, oldest first

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=41,566,1001,6008; StartTime=(Get-Date).AddDays(-7) } |
  Sort-Object TimeCreated |
  Format-Table TimeCreated, Id, ProviderName, Message -Wrap

Fix 3. Find out what woke the PC and stop that device from waking it

10 minutesLow riskEvent 566 shows a wake at a time when nobody used the PC, for example at night.

A wake is logged as event 566 with a Reason such as SxTransition or an input type. Microsoft's powercfg tool reports what woke the system from the last sleep and which devices are allowed to wake it.

1. Right-click Start and select Terminal (Admin).
2. Run powercfg /lastwake right after an unwanted wake and read the Wake Source lines.
3. Run powercfg /devicequery wake_armed to list every device that may wake the PC.
4. Find the device you do not need as a wake source, often a mouse, a network adapter or a USB hub.
5. Run powercfg /devicedisablewake "device name" with the name exactly as the list shows it.
6. Run powercfg /devicequery wake_armed again and check that the device is gone from the list.

Terminal (as administrator): what woke the PC, and which devices may wake it

powercfg /lastwake
powercfg /devicequery wake_armed
powercfg /devicedisablewake "HID-compliant mouse"

Fix 4. Check wake timers and the programs that keep the PC awake

10 minutesLow riskThe PC wakes with no device as the source, or it does not go to sleep when it should.

Scheduled tasks and drivers can set wake timers, and apps can hold power requests that block sleep. Both show up only as power changes in event 566, while powercfg names the program behind them.

1. Open Terminal (Admin) as in Fix 3.
2. Run powercfg /waketimers. Each line names the process or task that set a timer and when it runs out.
3. Run powercfg /requests. It lists the apps, services and drivers that ask Windows to stay awake or keep the screen on.
4. If a scheduled task set the timer, open Task Scheduler, find that task and check whether it needs to wake the PC.
5. If an app holds a request you do not need, close it or change its settings, then try sleep again.
6. Run both commands again before the next sleep to confirm the change.

Terminal (as administrator): wake timers and power requests

powercfg /waketimers
powercfg /requests

Microsoft describes wake timers as timers that, if enabled, wake the system from sleep and hibernate states when they run out. A media player, a download or a backup that is still running often appears in the requests list. That is normal while it runs.

Fix 5. On a laptop, read the sleep study report for Modern Standby

15 minutesNo riskYour laptop or tablet shows many 566 entries at night, loses battery in standby or is warm in the bag.

Many current laptops use Modern Standby, where the PC stays partly active and changes sessions often, each logged as event 566. Microsoft's sleep study report shows which components were active during standby.

1. Open Terminal (Admin).
2. Run powercfg /availablesleepstates to see which sleep states your PC supports. A PC with S0 low power idle uses Modern Standby.
3. Run powercfg /sleepstudy. It saves an HTML file in the current folder.
4. Open the file. Read the standby sessions with the highest drain and the components listed as most active.
5. If one device or app tops the list, update it or turn it off during standby.
6. Compare the session times in the report with the 566 entries in Event Viewer.

Terminal (as administrator): sleep states and the standby report

powercfg /availablesleepstates
powercfg /sleepstudy
powercfg /systemsleepdiagnostics

• Sleep study. Microsoft describes it as a report of modern standby quality over the last three days.
• System sleep diagnostics. It reports intervals when the user was not present over the last three days, and whether the system went to sleep. It works on PCs without Modern Standby too.

Fix 6. Turn off Fast Startup when shutdown or restart misbehaves

5 minutesLow riskShut down does not finish, a restart is ignored once, or problems survive a shutdown but not a restart.

With Fast Startup on, a shutdown is partly a hibernation, so the kernel and drivers are saved and loaded again. A driver problem then survives the shutdown and shows as odd power transitions. Turning it off makes every shutdown a full one.

1. Open Power Options. Press Windows key + R, type the command below and select OK.

   powercfg.cpl

2. Open the power button settings. In the left pane, select Choose what the power buttons do.
3. Make the shutdown settings editable. Select Change settings that are currently unavailable, then Yes when Windows asks for permission.
4. Clear the Fast Startup box. Under Shutdown settings, clear Turn on fast startup (recommended).
5. Save. Select Save changes.
6. Shut down once. Shut down the PC and start it again. From now on every shutdown is a full one.

These steps were written for Windows 11 and Windows 10 (the steps are the same). The full page with the other versions and what each result means: Turn off Fast Startup

Every step, and what to do when the option is missing: Turn off Fast Startup Restart is not affected by Fast Startup, so if a restart already fixes your problem, this is a good sign it will help.

Fix 7. If a crash sits next to event 566: drivers, memory and system files

30 minutes or moreLow riskFix 2 found a Kernel-Power 41 with a bug check code, a 1001 bug check or repeated 6008 entries.

Here the problem is the crash, and event 566 is only logged around it. On a new PC, the usual suspects are a chipset, graphics or storage driver, the firmware, or a memory fault, so check them in that order.

1. Note the bug check code from event 1001 or from BugcheckCode in event 41.
2. Open the support page of your PC or motherboard maker and install its latest chipset driver and firmware (BIOS or UEFI) update.
3. If the crashes began after a driver update, roll that driver back in Device Manager.
4. Run the Windows memory test, especially when the bug check codes change from crash to crash.
5. Repair the Windows system files with DISM and SFC.
6. Use the PC for a few days and run the command from Fix 2 again.

Driver update and rollback, step by step: Update, roll back or reinstall a driver The memory test: How to test your RAM with Windows Memory Diagnostic System file repair: Run DISM and SFC to repair Windows system files

If the PC still crashes or wakes on its own: what to collect

Event 566 entries alone are never proof of a fault, so do not send them to support as the error. Send what describes the real symptom. That saves a round of questions from the PC maker, Microsoft Support or a repair shop.

• The event list from Fix 2 for 14 days or more, with IDs 41, 566, 1001 and 6008 together.
• Event 41 details. BugcheckCode and PowerButtonTimestamp of each Kernel-Power 41.
• Dump files. C:\Windows\MEMORY.DMP and the files in C:\Windows\Minidump after a crash.
• The powercfg reports. The output of powercfg /lastwake, /waketimers and /requests, and the HTML file of /sleepstudy on a laptop.
• What you were doing. Gaming, idle, asleep, lid closed, on battery or on mains power, each time it happened.

How to keep event 566 normal and your power changes under control

Frequently asked questions

What does Event ID 566 Kernel-Power mean?

It means the Windows power session changed. Kernel-Power writes event 566 to the System log each time the PC moves between power states, such as working, sleep, hibernation and shutdown, and at some screen and input events. The text "The system session has transitioned from X to Y" names the old and the new session number. The Details tab holds the power state of each session and the Reason for the change. The level is Information, so it is a record of normal activity, not an error or a warning.

Is Kernel-Power event 566 an error I need to fix?

No. Event 566 is logged at the Information level and appears on healthy PCs many times a day. People search for error 566, but the number is an event ID, not a Windows error code. It needs attention only when it matches something you noticed, such as a wake in the night or a restart that did not finish. Then the Reason in the event points you to Fix 3, Fix 4, Fix 5 or Fix 6. If your PC crashes, the events to read are Kernel-Power 41 and EventLog 6008.

What does "The system session has transitioned from 0 to 1" mean?

It means session 0 ended and session 1 began. The numbers are session IDs that start at 0 when Windows starts and count up with every power change. The first entry after a start often reads "from 0 to 1". Later in the day you can see "from 1 to 3", "from 4 to 6" or numbers far above 50. We could not confirm why some entries skip a number. None of these numbers is an error code. To see what really happened, open the Details tab and read the session types and the Reason.

Can event 566 cause my PC to crash or restart?

No. An event is a record that Windows writes after something happens. It cannot cause a crash. Event 566 often appears near a crash only because the PC changes power state around it. To find the cause, list Kernel-Power 41, EventLog 6008 and event 1001 for the same time with the command in Fix 2. A bug check code in event 41 or 1001 means a crash, usually a driver or hardware fault. Event 41 with only zeros points to a loss of power or a hardware problem.

What is the Reason number or name in event 566?

It is why the power state changed. Windows 11 prints a name such as SxTransition, InputKeyboard, InputAccelerometer or AcDcBurst. Windows 10 and Windows Server print a number such as "Reason: 22". The names match Microsoft's documented list of power monitor request reasons, and the number is the position in that list counted from 0. For example, 20 is a system sleep or wake transition, 31 is keyboard input and 32 is mouse input. The table in this guide lists the common values.

Why do I have so many event 566 entries every day?

Because the PC changes power state often. Each sleep and wake, each idle timeout and, on laptops with Modern Standby, each short burst of activity in standby can add an entry. A PC that sleeps several times a day collects dozens of them, and the session numbers climb accordingly. Many entries are not a problem by themselves. They matter when the laptop drains its battery in standby or wakes when nobody touches it, and then the sleep study report from Fix 5 shows what kept it busy.

Is event 566 the same on Windows 10, Windows 11 and Windows Server?

Yes, the event ID, the source and the message are the same. The difference is the Reason. Windows 11 shows its name on the General tab, while Windows 10 and Windows Server 2022 show only a number, which you can look up in the table in this guide. The powercfg commands in Fixes 3 to 5 work on all of them. Windows 10 left support on 14 October 2025, so a Windows 10 PC no longer gets regular security updates.

Will updating drivers, disabling fast startup or running SFC fix event 566?

Not the event, because event 566 is not a fault and will keep appearing at every power change. These steps help only when the log shows a matching problem. A driver or firmware update helps when Kernel-Power 41 or a 1001 bug check shows real crashes. Turning off Fast Startup helps when shutdown or restart does not finish. A system file check repairs damaged Windows files, but it does not change how often the PC sleeps or wakes. Start with Fix 1 and Fix 2 to know which case you have.

Is Security log event 566 the same as Kernel-Power event 566?

No. Older Windows versions such as Windows Server 2003 used Security log event 566 for an object operation. It lives in the Security log and comes from a different source. The Kernel-Power event 566 discussed here lives in the System log and records power session changes. When you search for event 566, check the log name and the Source column first. Event numbers repeat across sources and only mean something together with the source.