What's the "UserNotPresentTraceSession" under Event Trace Sessions after the Anniversary Update?

I had a problem with "UserNotPresentSession.etl". It was overloading my SSD (100% activity, ~50MB/s writing) for example when I was playing GTA V. I didn't find any information how to disable it, but I found this reddit post: https://www.reddit.com/r/techsupport/comments/524d4s/disk_usage_raising_to_100/d7h7xwt/ where somebody described the same problem.

I found a solution for this problem, by setting "UserNotPresentSession.etl" to Read-only.

  1. Go to: "C:\Windows\System32\SleepStudy".
  2. Click the right mouse button on file: "UserNotPresentSession.etl" and then "Properties" from the list.
  3. Check "Read-only" checkbox and save changes.
  4. IMPORTANT: Restart your computer.

After that the disk is not longer abused. I experienced this problem on Windows 10 builds 14393 and 15063.

I hope this post will help people with the same issue.


Looking at the properties it captures Power related data (Sleepstudy, AdaptiveStandby) when no user is actively using the device.

Logger Name           : UserNotPresentTraceSession
Logger Id             : 14
Logger Thread Id      : 0000000000000354
Buffer Size           : 64
Maximum Buffers       : 24
Minimum Buffers       : 2
Number of Buffers     : 2
Free Buffers          : 1
Buffers Written       : 1
Events Lost           : 0
Log Buffers Lost      : 0
Real Time Buffers Lost: 0
Flush Timer           : 0
Age Limit             : 0
Log File Mode         : Circular PersistOnHybridShutdown NoPerProcessorBuffering
Maximum File Size     : 2
Log Filename          : C:\Windows\system32\SleepStudy\UserNotPresentSession.etl
Trace Flags           : "Microsoft-Windows-UserModePowerService":0x2c:0x4+"Microsoft-Windows-Kernel-Power":0xe03:0x4