How to Configure Wake on Pattern Match on Network Adapters in Windows 11 Using PowerShell

In modern corporate and residential networking environments, preserving system sleep states on Windows 11 workstations and portable devices is vital for battery longevity, energy conservation, and hardware thermals. While Wake-on-LAN (WoL) is widely used by systems administrators to power on remote computers using directed “Magic Packets,” standard network controllers also support a broader, more sensitive mechanism known as Wake on Pattern Match. Unlike Magic Packets—which require a specific frame payload containing 16 repetitions of the adapter’s MAC address—Pattern Match allows network adapters to wake the computer upon detecting common local network frames, such as IPv4/IPv6 ping requests, NetBIOS queries, or incoming TCP connection handshakes. In Windows 11, configuring Wake on Pattern Match using PowerShell ensures administrative wake capabilities remain active without allowing ambient broadcast traffic to trigger unwanted system wake-ups.

Understanding Wake on Pattern Match vs Wake on Magic Packet

To implement proper network power management, administrators must distinguish between the two primary wake triggers supported by NDIS network adapters:

• Wake on Magic Packet: The network adapter monitors physical incoming frames for an exact synchronization stream (six bytes of 0xFF followed by 16 repetitions of the target NIC’s 48-bit MAC address). Because Magic Packets rarely occur naturally in ambient network traffic, this setting provides reliable, intentional remote wake control.
• Wake on Pattern Match: When Windows enters sleep, the NDIS stack programs the network adapter with specific bitmask patterns based on active network sockets, local name resolution services, and operating system listeners. If an incoming packet matches one of these registered patterns (e.g., an incoming ICMP echo request, an SMB session inquiry, or an ARP query for an un-offloaded address), the network controller triggers a hardware Power Management Event (PME) interrupt, waking the host CPU.

In environments with network discovery tools, shared printers, or frequent background broadcasts, Pattern Match frequently causes laptops to wake up inside backpacks or desktops to power on repeatedly overnight. Disabling Pattern Match while keeping Magic Packet enabled resolves unwanted wake transitions while preserving remote management.

Inspecting Network Adapters in PowerShell

To inspect physical network adapters and evaluate power management properties, launch Windows PowerShell as an Administrator.

Query all physical network adapters active on the system:

Get-NetAdapter -Physical | Select-Object Name, InterfaceDescription, MediaType, Status

Identify the interface name representing your primary network connection (e.g., Ethernet or Wi-Fi).

Querying Current Pattern Match Configuration

Query the active power management configuration using the Get-NetAdapterPowerManagement cmdlet:

Get-NetAdapterPowerManagement -Name "Ethernet" | Format-List Name, WakeOnMagicPacket, WakeOnPattern, AllowComputerToTurnOffDevice

PowerShell outputs the current status of wake triggers:

Name                          : Ethernet
WakeOnMagicPacket             : Enabled
WakeOnPattern                 : Enabled
AllowComputerToTurnOffDevice  : Enabled

If WakeOnPattern is set to Enabled, ambient local subnet traffic can wake the computer from ACPI sleep (S3) or Modern Standby (S0).

Disabling Wake on Pattern Match to Eliminate Random Wake-Ups

To stop ambient network broadcasts from waking the operating system while retaining intentional Magic Packet wake-ups, disable Pattern Match using Set-NetAdapterPowerManagement:

Set-NetAdapterPowerManagement -Name "Ethernet" -WakeOnPattern Disabled

To apply this configuration across all physical wired and wireless network adapters across an entire enterprise fleet, pipe the adapter list directly:

Get-NetAdapter -Physical | Set-NetAdapterPowerManagement -WakeOnPattern Disabled

The network connection will momentarily re-initialize its hardware registers to apply the updated power filter.

Enabling Wake on Pattern Match for Remote Wake Workflows

In specific enterprise scenarios—such as automated staging labs where remote monitoring consoles must wake systems by initiating standard TCP/IP connections or SMB file share accesses—you can re-enable the feature:

Set-NetAdapterPowerManagement -Name "Ethernet" -WakeOnPattern Enabled

Confirm the updated setting:

(Get-NetAdapterPowerManagement -Name "Ethernet").WakeOnPattern

Auditing Advanced Hardware Adapter Properties

Certain network card chipsets (such as Intel I219/I225/I226 and Realtek GbE controllers) also maintain independent driver-level registry settings that mirror or override NDIS settings.

Query advanced adapter properties for vendor-specific pattern match entries:

Get-NetAdapterAdvancedProperty -Name "Ethernet" | Where-Object { $_.DisplayName -match "Pattern|Wake on" }

If an advanced property such as Wake on Pattern Match is present in the driver table, synchronize its state using Set-NetAdapterAdvancedProperty:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Wake on Pattern Match" -DisplayValue "Disabled" -ErrorAction SilentlyContinue

Auditing System Wake Sources Using PowerCFG

To verify that network adapters are no longer triggering unscheduled wake transitions, test system sleep behaviour. Put the machine to sleep and let it remain idle. If it wakes unexpectedly, query the immediate prior wake source in PowerShell:

powercfg -lastwake

If the wake source previously reported the Network Adapter (e.g., Intel(R) Ethernet Connection), it will now confirm that the network adapter is no longer generating wake interrupts from routine ambient broadcast traffic.