In Windows 10, I would like to know how I can tell in a script whether the system booted because it was turned on by receiving a Wake-on-LAN (WoL) packet, or because it was turned on because of pushing the power button.
I did find the WakeUpType property of the Win32_ComputerSystem class. That is documented to return the "event that causes the system to power up". There are 9 possible return values, one of them being "5" (meaning "LAN Remote").
Unfortunately, on my system it always seems to return "6" (meaning "Power Switch"):
PS C:\WINDOWS\system32> echo $(Get-WmiObject -class win32_computersystem).wakeuptype 6
I noticed that after putting the system to sleep and waking it using WoL, Windows posts an event in the System eventlog with source "Power-Troubleshooter" and event ID 1, containing the text:
Wake Source: Device -Intel(R) 82579V Gigabit Network Connection
powercfg /lastwake reports the NIC as the reason for waking up. So, at least when waking from sleep Windows is able to determine that it woke up because of a WoL packet, even though the WakeUpType property still returns "6" (Power Switch) in that case.
Unfortunately, when the system receives a WoL packet in S5 state it will properly power up and boot, but I can't tell that it booted because of WoL.
powercfg /lastwake shows exactly the same output as it does when the system powers on from S5 because of pushing the power button:
C:\WINDOWS\system32>powercfg /lastwake Wake History Count - 0
How can I reliably tell, from any power state (up to S5), that the system powered on/woke up because of WoL?