SYSTEM THREAD EXCEPTION NOT HANDLED Intel UHC 620 + dxgmm2.sys

This was a one off event, but my system has never hung like this before.
I am running an Oracle version of Windows 10.0.0.4, and they are fussy about what updates get applied.
The specific Version: 10.0.16299 Build 16299 (Full system specs in my profile).

When I started from a cold boot this morning, the system hung and I had to press the power button, which caused a shutdown and power off. On power up, a stop code dialog popped up with the message SYSTEM THREAD EXCEPTION NOT HANDLED dxgmm2.sys. There was no crash dump, as the system didn't bluescreen.
There was a link to https://windows.com/stopcode, but it just redirected to a generic site.

This laptop just has an embedded Intel graphics display device, Adapter Description Intel(R) UHD Graphics 620.

The original log collector just returned an empty archive, but the new powershell script worked (log zip attached).
I don't have a minidump to look at, so just wondered if this was a known problem.

Hello and welcome to TenForums

The event log shows that a memory.dmp file might have been created. If so you could share it with us via OneDrive or Dropbox. It will be too large to zip and upload here.

Attachment 214873

Unfortunately I did not find a MEMORY.DMP file; I don't think it would have cleared implicitly on a reboot.

My CrashDumpEnable was set to 7, meaning automatic memory dump. I researched this and found this information from https://docs.microsoft.com/en-us/win...ic-memory-dump
---
An Automatic Memory Dump contains the same information as a Kernel Memory Dump. The difference between the two is not in the dump file itself, but in the way that Windows sets the size of the system paging file.

If the system paging file size is set to System managed size, and the kernel-mode crash dump is set to Automatic Memory Dump, then Windows can set the size of the paging file to less than the size of RAM. In this case, Windows sets the size of the paging file large enough to ensure that a kernel memory dump can be captured most of the time.

If the computer crashes and the paging file is not large enough to capture a kernel memory dump, Windows increases the size of the paging file to at least the size of RAM. The time of this event is recorded here in the Registry:

HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\LastCrashTime

I confirmed this was set to a non-zero value.

The increased paging file size stays in place for 4 weeks and then returns to the smaller size. If you want to return to the smaller paging file before 4 weeks, you can delete the Registry entry.

To see the paging file settings, go to Control Panel > System and Security > System > Advanced system settings. Under Performance, click Settings. On the Advanced tab, under Virtual memory, click Change. In the Virtual Memory dialog box, you can see the paging file settings.
---
This Lenovo laptop came with a 238.47 GB (256GiB) hard drive. I have on hand an SSD that is 512GiB, which will help, though I may want to set the page size directly, as I have 16.0 GB of physical memory.

After the crash dump, control panel reports C:\pagefile.sys pagefile was set to 2432 MB. Is 2.4GiB enough for a compressed MEMORY.DMP file?

Here are the settings for crashdump creation from the log bundle:

########################## Crash Dump Settings #########################

AutoReboot : 0
CrashDumpEnabled : 7
DumpFile : C:\windows\MEMORY.DMP
DumpFilters : {MfeEpeHb.sys, dumpfve.sys}
LogEvent : 1
MinidumpDir : C:\windows\Minidump
MinidumpsCount : 5
Overwrite : 1
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
PSChildName : CrashControl
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
######################## Crash Dump Type Matrix ########################
CrashDumpEnabled FilterPages
Disabled 0 <does not exist>
Complete 1 <does not exist>
Active 1 1
Kernel 2 <does not exist>
Small 3 <does not exist>
Automatic 7 <does not exist>


From the ITpro website, here is an explanation of the settings in Control. I will state what these are set to.


The CrashOnAuditFail value entry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa is a type REG_DWORD that determines system behavior when the Security log (Event Viewer) is full. The default is 0, the system does not halt. An entry of 1 causes the system to halt and display c0000244 (STATUS_AUDIT_FAILED). The system then sets this entry to 2 so only Administrators can log on until the Security log is cleared.

Control\Lsa\CrashOnAuditFail is 0.

Other crash control entries are located at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl:

AutoReboot is a REG_DWORD that controls if the system will automatically reboot upon failure. A value of 0 (default for Workstation) does not cause reboot whereas a value of 1 (default for Server) does.

CrashDumpEnabled is a REG_DWORD that specifies whether a dump will be written (value 1, default for Server) or not (value 0, default for Workstation).

CrashDumpEnabled is set to 7 This is the automatic memory dump setting.

DumpFile is a type REG_EXPAND_SZ that contains the path and file name of the dump file. The default is %SystemRoot%\Memory.log.

Same except the name is MEMORY.DMP

LogEvent is a REG_DWORD that indicates if a System log entry is written when abnormal termination occurs. The default for Workstation is 0 (no) while Server defaults to 1 (yes).

LogEvent is set to 1.

Overwrite is a REG_DWORD that controls whether a new dump file is created if one already exists. A 0 is no, which is the default for Workstation. A 1 is yes, which is the default for Server.

Overwrite is set to 1 I think this means I won't lose older crash dumps.

SendAlert is a REG_DWORD that specifies if the logged on user will receive an administrative alert when the DumpFile is full and LogEvent is 1 and Overwrite is 0. The default for Workstation is 0 (no) and for Server is 1 (yes). If the value is 1 and the DumpFile is full, a user acknowledgement is required to proceed.

This key is not in my registry.

The logs displayed methods to bypass the activation of Microsoft software.
See rule #4
Forum Rules - Windows 10 Help Forums
Please remove all piracy / crack.

zbook, my system is legitimate. From my log bundle, the license check passed and there is a genuine.txt file, and there was no hiccup in transcript_main.txt. The only issue is autoruns can't execute, probably blocked by Oracle.

I posted to this thread, where the log bundle does have a license issue.

BSOD With No DMP Files Available? (Event Viewer Lists Kernal-Power)

Here is the extract from my bundle
**********************
Windows PowerShell transcript start
Start time: 20181122134511
Username: JHALLESY-US\jhallesy
RunAs User: JHALLESY-US\jhallesy
Configuration Name:
Machine: JHALLESY-US (Microsoft Windows NT 10.0.16299.0)
Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -NoExit -Command &'.\resources\main.ps1'
Process ID: 15812
PSVersion: 5.1.16299.785
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.16299.785
BuildVersion: 10.0.16299.785
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Generating system information report, this may take a while...
Downloading autorunsc...
PS>TerminatingError(Invoke-WebRequest): "The underlying connection was closed: An unexpected error occurred on a send."
WARNING: Failed to download autorunsc. Skipping...
Launching elevated script...
Running DirectX diagnostics...
Exporting Application event Log...
Exporting System event log...
Exporting Kernel PnP event log...
Gathering device driver information...
Checking power settings...
Getting hardware information...
Listing installed software...
Listing installed Windows updates...
Finding network information...
Examining hosts file...
Creating Windows license report...
Waiting for msinfo32.exe to finish...
**********************
Windows PowerShell transcript end
End time: 20181122134627
**********************

ToolVersion : 10.0.16299.15
LicensingStatus : SL_LICENSING_STATUS_LICENSED
LicensingStatusReason : 0x00000000
LocalGenuineState : SL_GEN_STATE_IS_GENUINE
LocalGenuineResultP : 1
LastOnlineGenuineResult :
GraceTimeMinutes : 250485
TotalGraceDays : 0
ValidityExpiration :
ActivePartialProductKey : T83GX
ActiveProductKeyPid2 : 00331-10000-00001-AA874
OSVersion : 10.0.16299.2.00010100.0.0.048
ProductName : Windows 10 Pro
ProcessorArchitecture : x64
EditionId : Professional
BuildLab : 16299.rs3_release_svc.180808-1748
TimeZone : Mountain Standard Time(GMT-07:00)
ActiveSkuId : 2de67392-b7a7-462a-b1ca-108dd189f588
ActiveSkuDescription : Windows(R) Operating System, VOLUME_KMSCLIENT channel
ProductUniquenessGroups : 55c92734-d682-4d71-983e-d6ec3f16059f
ActiveProductKeyPKeyId : 08e404fb-41f3-77ac-59ef-6e9f2d3f499d
ActiveProductKeyPidEx : 03612-03311-000-000001-03-1033-16299.0000-2352018
ActiveProductKeyChannel : Volume:GVLK
ActiveVolumeCustomerPid : 06401-00206-491-605707-03-1033-9600.0000-2942016
OfflineInstallationId : 652816506114510612121287969442681442079793568643508214200640885
DomainJoined : false
ComputerSid : S-1-5-21-2060204825-2393636820-513386675
ProductLCID : 1033
UserLCID : 1033
SystemLCID : 1033
CodeSigning : SIGNED_INFO_PRS_SIGNED
ServiceAvailable : true
OemMarkerVersion : 0x00020001
OemId : LENOVO
OemTableId : TP-R0S
OA3ProductKey : Redacted
Manufacturer : LENOVO
Model : 20LJS2EV00
InstallDate : 20180823111056.000000-420

Result : PASS
TamperedItems :

ServerProps : Redacted

And from the other thread's transcript.txt, I saw this, so zbook I think you must have looked at this bundle and busted the wrong poster! Let's get Mark to fix his licensing issue, because that may invalidate his ability to get updates.

Waiting for licensingdiag.exe to finish...
Killed licensingdiag.exe due to 60 second timeout.
Creating Windows license report...
WARNING: C:\Users\Mark Hawkins\AppData\Local\Temp\genuine.xml does not exist.

Is the computer a home or business computer?

It is a business laptop running Windows 10 Pro Version 10.0.16299 Build 16299. All systems that access the Oracle LAN must use an Oracle Base Image, and we have versions for Windows 7, 10, and Linux (Linux OBI 7.2.64.1 (based on Oracle Linux 7.2 64-bit). Windows 7 is being phased out as of October 2019, and there is an opportunity to upgrade to Windows 10.0.0.4 internally as a beta. Oracle is very fussy about using approved equipment, and will seize a simple switch in your office if it is not on the approved hardware list, per my lab manager. Patches and Windows updates are tested thoroughly before they are released. So there is no way I could run an unlicensed laptop or system, as my manager would get notified.