Difference between ResumeAutomatic & ResumeSuspend modes of Windows Service

Question

According to MSDN documentation

ResumeAutomatic : The computer has woken up automatically to handle an event.

Note : If the system detects any user activity after broadcasting ResumeAutomatic, it will broadcast a ResumeSuspend event to let applications know they can resume full interaction with the user.

ResumeSuspend : The system has resumed operation after being suspended.

Does this mean 'ResumeAutomatic' is called when the computer wakes up from sleep and 'ResumeSuspend' is called when the user logs in after entering credentials?

I am using tcp socket to communicate with a server. So in order to reconnect to the service when the system is back from sleeping state, I have the following code

    protected override bool OnPowerEvent(PowerBroadcastStatus powerStatus)
    {
        Logger.Log("Power status is : " + powerStatus);
        if (powerStatus == PowerBroadcastStatus.ResumeAutomatic)
        {
            ConnectionWatchdog.ReConnect();
        }
        return base.OnPowerEvent(powerStatus);
    }

But I observe that the enum values are random. Below are 3 different traces at 3 different wake up times.

20150525#094449 :: Power status is : Suspend

20150525#094716 :: Power status is : ResumeSuspend

---

20150525#103431 :: Power status is : Suspend

20150525#103525 :: Power status is : ResumeSuspend

20150525#103525 :: Power status is : ResumeAutomatic

---

20150525#103558 :: Power status is : Suspend

20150525#103835 :: Power status is : ResumeAutomatic

Answer 1

How it's supposed to work

(This is not how it all works in practice - see below.)

ResumeAutomatic

This message is always sent when the computer has resumed after sleep.

ResumeSuspend

The computer has resumed after sleep, and Windows believes a user is present - i.e. that there is a human sitting in front of the machine. This message is sent when either a) the wake was caused by human interaction (someone pressing the power button, pressing a key, moving the mouse, etc); or b) the first time there is human interaction after the machine wakes automatically due to a wake timer.

To directly answer your question, ResumeSuspend is sent the first time a user interacts with the computer. This could be entering a password to unlock it, but it doesn't have to be. If the user just wiggles the mouse, ResumeSuspend will still be sent.

To summarise:

1. ResumeAutomatic is always sent when the computer resumes from sleep.
2. ResumeSuspend is sent as well as ResumeAutomatic when the computer resumes from sleep and Windows believes a user is present.

---

How it actually works

1. ResumeAutomatic occasionally isn't sent at all. This is a long-standing bug, presumably in Windows itself. Fortunately I've never seen the computer wake with both ResumeAutomatic and ResumeSuspend unsent. If you need to know that the system has resumed, but don't care whether a user's there or not, you need to listen for both ResumeAutomatic and ResumeSuspend and treat them as the same thing.
2. ResumeSuspend is extremely unreliable. I've never seen it not sent when it's supposed to be, but it's often sent when it isn't supposed to be - when actually there's no user there at all. Whether this is due to one or more bugs in Windows, third party drivers, firmware or hardware, I have no idea.
3. When ResumeAutomatic is sent with no corresponding ResumeSuspend the system idle timeout is brief (2 minutes by default in Windows 10) and attached displays are kept in power saving mode. When a corresponding ResumeSuspend is sent the system idle timeout is normal (30 minutes by default in Windows 10) and attached displays are woken up. This is so that the computer goes back to sleep as soon as possible if it wakes automatically to perform maintenance, etc. It would be fantastic if Microsoft could make it work reliably.

I've had the misfortune of having to go deep inside the rabbit hole of Windows' support for power management, profiles, etc. The Vista-era stuff is frustrating, because it's based on quality and thoughtful design, but both the implementation and documentation is not quite there, and has never been fixed. There are numerous other niggling problems I've not gone into here. It's all a bit of a shame.