1. Posts : 8
    Windows Version 10.0.19642 Build 19042


    This was a one off event, but my system has never hung like this before.
    I am running an Oracle version of Windows, and they are fussy about what updates get applied.
    The specific Version: 10.0.16299 Build 16299 (Full system specs in my profile).

    When I started from a cold boot this morning, the system hung and I had to press the power button, which caused a shutdown and power off. On power up, a stop code dialog popped up with the message SYSTEM THREAD EXCEPTION NOT HANDLED dxgmm2.sys. There was no crash dump, as the system didn't bluescreen.
    There was a link to, but it just redirected to a generic site.

    This laptop just has an embedded Intel graphics display device, Adapter Description Intel(R) UHD Graphics 620.

    The original log collector just returned an empty archive, but the new powershell script worked (log zip attached).
    I don't have a minidump to look at, so just wondered if this was a known problem.
      My Computer

  2. Posts : 5,169
    64bit Win 10 Pro ver 21H2

    Hello and welcome to TenForums

    The event log shows that a memory.dmp file might have been created. If so you could share it with us via OneDrive or Dropbox. It will be too large to zip and upload here.

    Attachment 214873
      My Computers

  3. Posts : 8
    Windows Version 10.0.19642 Build 19042
    Thread Starter

    Unfortunately I did not find a MEMORY.DMP file; I don't think it would have cleared implicitly on a reboot.

    My CrashDumpEnable was set to 7, meaning automatic memory dump. I researched this and found this information from
    An Automatic Memory Dump contains the same information as a Kernel Memory Dump. The difference between the two is not in the dump file itself, but in the way that Windows sets the size of the system paging file.

    If the system paging file size is set to System managed size, and the kernel-mode crash dump is set to Automatic Memory Dump, then Windows can set the size of the paging file to less than the size of RAM. In this case, Windows sets the size of the paging file large enough to ensure that a kernel memory dump can be captured most of the time.

    If the computer crashes and the paging file is not large enough to capture a kernel memory dump, Windows increases the size of the paging file to at least the size of RAM. The time of this event is recorded here in the Registry:


    I confirmed this was set to a non-zero value.

    The increased paging file size stays in place for 4 weeks and then returns to the smaller size. If you want to return to the smaller paging file before 4 weeks, you can delete the Registry entry.

    To see the paging file settings, go to Control Panel > System and Security > System > Advanced system settings. Under Performance, click Settings. On the Advanced tab, under Virtual memory, click Change. In the Virtual Memory dialog box, you can see the paging file settings.
    This Lenovo laptop came with a 238.47 GB (256GiB) hard drive. I have on hand an SSD that is 512GiB, which will help, though I may want to set the page size directly, as I have 16.0 GB of physical memory.

    After the crash dump, control panel reports C:\pagefile.sys pagefile was set to 2432 MB. Is 2.4GiB enough for a compressed MEMORY.DMP file?

    Here are the settings for crashdump creation from the log bundle:

    ########################## Crash Dump Settings #########################

    AutoReboot : 0
    CrashDumpEnabled : 7
    DumpFile : C:\windows\MEMORY.DMP
    DumpFilters : {MfeEpeHb.sys, dumpfve.sys}
    LogEvent : 1
    MinidumpDir : C:\windows\Minidump
    MinidumpsCount : 5
    Overwrite : 1
    PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
    PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
    PSChildName : CrashControl
    PSDrive : HKLM
    PSProvider : Microsoft.PowerShell.Core\Registry
    ######################## Crash Dump Type Matrix ########################
    CrashDumpEnabled FilterPages
    Disabled 0 <does not exist>
    Complete 1 <does not exist>
    Active 1 1
    Kernel 2 <does not exist>
    Small 3 <does not exist>
    Automatic 7 <does not exist>

    From the ITpro website, here is an explanation of the settings in Control. I will state what these are set to.

    The CrashOnAuditFail value entry at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa is a type REG_DWORD that determines system behavior when the Security log (Event Viewer) is full. The default is 0, the system does not halt. An entry of 1 causes the system to halt and display c0000244 (STATUS_AUDIT_FAILED). The system then sets this entry to 2 so only Administrators can log on until the Security log is cleared.

    Control\Lsa\CrashOnAuditFail is 0.

    Other crash control entries are located at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl:

    AutoReboot is a REG_DWORD that controls if the system will automatically reboot upon failure. A value of 0 (default for Workstation) does not cause reboot whereas a value of 1 (default for Server) does.

    CrashDumpEnabled is a REG_DWORD that specifies whether a dump will be written (value 1, default for Server) or not (value 0, default for Workstation).

    CrashDumpEnabled is set to 7 This is the automatic memory dump setting.

    DumpFile is a type REG_EXPAND_SZ that contains the path and file name of the dump file. The default is %SystemRoot%\Memory.log.

    Same except the name is MEMORY.DMP

    LogEvent is a REG_DWORD that indicates if a System log entry is written when abnormal termination occurs. The default for Workstation is 0 (no) while Server defaults to 1 (yes).

    LogEvent is set to 1.

    Overwrite is a REG_DWORD that controls whether a new dump file is created if one already exists. A 0 is no, which is the default for Workstation. A 1 is yes, which is the default for Server.

    Overwrite is set to 1 I think this means I won't lose older crash dumps.

    SendAlert is a REG_DWORD that specifies if the logged on user will receive an administrative alert when the DumpFile is full and LogEvent is 1 and Overwrite is 0. The default for Workstation is 0 (no) and for Server is 1 (yes). If the value is 1 and the DumpFile is full, a user acknowledgement is required to proceed.

    This key is not in my registry.
      My Computer

  4. Posts : 41,532
    windows 10 professional version 1607 build 14393.969 64 bit

    The logs displayed methods to bypass the activation of Microsoft software.
    See rule #4
    Forum Rules - Windows 10 Help Forums
    Please remove all piracy / crack.
      My Computer

  5. Posts : 8
    Windows Version 10.0.19642 Build 19042
    Thread Starter

    I think zbook 's license violation flag is for another thread

    zbook, my system is legitimate. From my log bundle, the license check passed and there is a genuine.txt file, and there was no hiccup in transcript_main.txt. The only issue is autoruns can't execute, probably blocked by Oracle.

    I posted to this thread, where the log bundle does have a license issue.

    BSOD With No DMP Files Available? (Event Viewer Lists Kernal-Power)

    Here is the extract from my bundle
    Windows PowerShell transcript start
    Start time: 20181122134511
    Username: JHALLESY-US\jhallesy
    RunAs User: JHALLESY-US\jhallesy
    Configuration Name:
    Machine: JHALLESY-US (Microsoft Windows NT 10.0.16299.0)
    Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -NoExit -Command &'.\resources\main.ps1'
    Process ID: 15812
    PSVersion: 5.1.16299.785
    PSEdition: Desktop
    PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.16299.785
    BuildVersion: 10.0.16299.785
    CLRVersion: 4.0.30319.42000
    WSManStackVersion: 3.0
    PSRemotingProtocolVersion: 2.3
    Generating system information report, this may take a while...
    Downloading autorunsc...
    PS>TerminatingError(Invoke-WebRequest): "The underlying connection was closed: An unexpected error occurred on a send."
    WARNING: Failed to download autorunsc. Skipping...
    Launching elevated script...
    Running DirectX diagnostics...
    Exporting Application event Log...
    Exporting System event log...
    Exporting Kernel PnP event log...
    Gathering device driver information...
    Checking power settings...
    Getting hardware information...
    Listing installed software...
    Listing installed Windows updates...
    Finding network information...
    Examining hosts file...
    Creating Windows license report...
    Waiting for msinfo32.exe to finish...
    Windows PowerShell transcript end
    End time: 20181122134627

    ToolVersion : 10.0.16299.15
    LicensingStatusReason : 0x00000000
    LocalGenuineState : SL_GEN_STATE_IS_GENUINE
    LocalGenuineResultP : 1
    LastOnlineGenuineResult :
    GraceTimeMinutes : 250485
    TotalGraceDays : 0
    ValidityExpiration :
    ActivePartialProductKey : T83GX
    ActiveProductKeyPid2 : 00331-10000-00001-AA874
    OSVersion : 10.0.16299.2.00010100.0.0.048
    ProductName : Windows 10 Pro
    ProcessorArchitecture : x64
    EditionId : Professional
    BuildLab : 16299.rs3_release_svc.180808-1748
    TimeZone : Mountain Standard Time(GMT-07:00)
    ActiveSkuId : 2de67392-b7a7-462a-b1ca-108dd189f588
    ActiveSkuDescription : Windows(R) Operating System, VOLUME_KMSCLIENT channel
    ProductUniquenessGroups : 55c92734-d682-4d71-983e-d6ec3f16059f
    ActiveProductKeyPKeyId : 08e404fb-41f3-77ac-59ef-6e9f2d3f499d
    ActiveProductKeyPidEx : 03612-03311-000-000001-03-1033-16299.0000-2352018
    ActiveProductKeyChannel : Volume:GVLK
    ActiveVolumeCustomerPid : 06401-00206-491-605707-03-1033-9600.0000-2942016
    OfflineInstallationId : 652816506114510612121287969442681442079793568643508214200640885
    DomainJoined : false
    ComputerSid : S-1-5-21-2060204825-2393636820-513386675
    ProductLCID : 1033
    UserLCID : 1033
    SystemLCID : 1033
    ServiceAvailable : true
    OemMarkerVersion : 0x00020001
    OemId : LENOVO
    OemTableId : TP-R0S
    OA3ProductKey : Redacted
    Manufacturer : LENOVO
    Model : 20LJS2EV00
    InstallDate : 20180823111056.000000-420

    Result : PASS
    TamperedItems :

    ServerProps : Redacted

    And from the other thread's transcript.txt, I saw this, so zbook I think you must have looked at this bundle and busted the wrong poster! Let's get Mark to fix his licensing issue, because that may invalidate his ability to get updates.

    Waiting for licensingdiag.exe to finish...
    Killed licensingdiag.exe due to 60 second timeout.
    Creating Windows license report...
    WARNING: C:\Users\Mark Hawkins\AppData\Local\Temp\genuine.xml does not exist.
      My Computer

  6. Posts : 41,532
    windows 10 professional version 1607 build 14393.969 64 bit

    Is the computer a home or business computer?
      My Computer

  7. Posts : 8
    Windows Version 10.0.19642 Build 19042
    Thread Starter

    It is a business laptop running Windows 10 Pro Version 10.0.16299 Build 16299. All systems that access the Oracle LAN must use an Oracle Base Image, and we have versions for Windows 7, 10, and Linux (Linux OBI (based on Oracle Linux 7.2 64-bit). Windows 7 is being phased out as of October 2019, and there is an opportunity to upgrade to Windows internally as a beta. Oracle is very fussy about using approved equipment, and will seize a simple switch in your office if it is not on the approved hardware list, per my lab manager. Patches and Windows updates are tested thoroughly before they are released. So there is no way I could run an unlicensed laptop or system, as my manager would get notified.
      My Computer


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 08:03.
Find Us

Windows 10 Forums