Published by
Better Call Saul
Location: Wolves, England
Posts: 1,628
|
|
How to Configure Windows 10 to Create Dump Files on BSOD
Information
A blue screen (aka: BSOD) error (also called a stop error) can occur if a problem causes your PC to shut down or restart unexpectedly. When you experience this type of error, you won’t be able to see things like the Start menu or the taskbar on the screen when your PC is turned on. Instead you might see a blue screen with a message that your PC ran into a problem and needs to restart.
In the event of your PC encountering a BSOD (Blue Screen of Death) a
Dump File will be required for debugging purposes by a BSOD analyst. By default
Windows 10 is set to write Automatic memory dumps, this tutorial will show you how to configure
Windows 10 to write
Minidumps (Small memory dumps),
Kernel memory dumps,
Complete memory dumps,
Automatic memory dumps and
Active memory dumps.
For more information about crash dump files, please see:
Understanding Crash Dump Files - Ask the Performance Team - Site Home - TechNet Blogs
You must be logged in as an
administrator to be able to perform any of the steps in this tutorial.
Note
Automatic memory dump
An Automatic Memory Dump contains the same information as a Kernel memory dump. The difference between the two is in the way that Windows sets the size of the system paging file. If the system paging file size is set to System managed size, and the kernel-mode crash dump is set to Automatic Memory Dump, then Windows can set the size of the paging file to less than the size of RAM. In this case Windows sets the size of the paging file large enough to ensure that a kernel memory dump can be captured most of the time.
Complete memory dump
A complete memory dump records all the contents of physical memory (RAM) at the time of the crash. A complete memory dump may contain data from processes that were running when the memory dump was collected. If a second crash occurs and another complete memory dump (or kernel memory dump) file is created, the previous contents of the C:\Windows\MEMORY.DMP file are overwritten.
By default, the complete memory dump option is not available in
Startup and Recovery on computers that have 2 gigabytes (GB) or more of RAM installed. You can still set Windows to create a Complete memory dump using the REG file in step 4 of
Option Two if you wish.
The complete memory dump will require that there is a page file set to at least the size of physical memory installed plus 1MB (for the header).
Active memory dump
An active memory dump is smaller than a Complete memory dump, however it still contains active memory in both kernel and user mode. You can now obtain kernel information as well as user information without having to dump the complete memory.
Kernel memory dump
A kernel dump contains only the kernel-mode read / write pages present in physical memory at the time of the crash. Since this is a kernel-mode only dump, there are no pages belonging to user-mode processes. However, it is unlikely that the user-mode process pages would be required since a system crash (bugcheck) is usually caused by kernel-mode code. The list of running processes, state of the current thread and list of loaded drivers are stored in nonpaged memory that saves in a kernel memory dump. The size of a kernel memory dump will vary based on the amount of kernel-mode memory allocated by Windows and the drivers that are present on the system.
If a second crash occurs and another kernel memory dump (or complete memory dump) file is created, the previous contents of the C:\Windows\MEMORY.DMP file are overwritten.
Small memory dump
A small memory dump (Minidump) is a C:\Windows\Minidump dump file that contains the stop code, parameters, list of loaded device drivers, information about the current process and thread, and the kernel stack for the thread that caused the crash.
INTRODUCTION
List of Contents
Option One: Configure Dump File Settings in Start-up and Recovery
Option Two: Configure Dump File Settings with a REG file download
Option Three: Configure Dump File Settings in Elevated Command Prompt
OPTION ONE
Configure Dump File Settings in Start-up and Recovery
3: Click/tap on System
4: Click/tap on Advanced System Settings, the System Properties window will open.
5: In the Start-up and Recovery section click/tap on Settings...
6: In the
System failure section ensure both
Write an event to the system log and
Automatically restart options are checked. In the
Write debugging information section click on the dropdown box and select either of the options below then click/tap
OK:
No Dump Files
Have Windows NOT Create a
Dump File on BSOD
Small Memory Dumps
Have Windows Create a
Small Memory Dump (Minidump) on BSOD
Kernel Memory Dumps
Have Windows Create a
Kernel Memory Dump on BSOD
Complete Memory Dumps
Have Windows Create a
Complete Memory Dump on BSOD
Automatic Memory Dumps
Have Windows Create an
Automatic Memory Dump on BSOD
Active Memory Dumps
Have Windows Create an
Active Memory Dump on BSOD
Note
Ensure the
Small dump directory: for Small memory dumps (
Dump file: for all other dump types) save location box underneath the dropdown box reads the following for each selected dump:
| Dump Type |
Save Location |
| (none) |
%SystemRoot%\MEMORY.DMP (Greyed out) |
| Small memory dump (256kb) |
%SystemRoot%\Minidump |
| Kernel memory dump |
%SystemRoot%\MEMORY.DMP |
| Complete memory dump |
%SystemRoot%\MEMORY.DMP |
| Automatic memory dump |
%SystemRoot%\MEMORY.DMP |
| Active memory dump |
%SystemRoot%\MEMORY.DMP |
7: You can now close Control Panel.
OPTION TWO
Configure Dump File Settings with a REG file download
1: Download the relevant .reg file from the list below for which Memory Dump you want Windows to create:
No Memory Dumps
Have Windows NOT Create a Memory Dump on BSOD
Click the download button below to download Create_NO_dump_file_on_BSOD.reg
Small Memory Dumps (Minidumps)
Have Windows Create a Small Memory Dump (Minidump) on BSOD
Click the download button below to download
Create_Minidump_on_BSOD.reg
Go to
Step 2
Kernel Memory Dumps
Have Windows Create a Kernel Memory Dump on BSOD
Click the download button below to download
Create_Kernel_memory_dump_on_BSOD.reg
Go to
Step 2
Complete Memory Dumps
Have Windows Create a Complete Memory Dump on BSOD
Click the download button below to download
Create_Complete_memory_dump_on_BSOD.reg
Go to
Step 2
Automatic Memory Dumps
Have Windows Create an Automatic Memory Dump on BSOD
NOTE: This is the default setting
Click the download button below to download
Automatic_memory_dump.reg
Go to
Step 2
Active Memory Dumps
Have Windows Create an Active Memory Dump on BSOD
Click the download button below to download Active_memory_dump.reg
2: Save the .reg file to your desktop or other convenient location
3: Double click on the downloaded .reg file to merge it.
4: When prompted, click on
Run,
Yes,
Yes, and
OK to approve merging the .reg file.
5: Restart the computer to apply.
6: You can now delete the downloaded .reg file if you wish.
OPTION THREE
Configure Dump File Settings in Elevated Command Prompt
1: Open an
Elevated Command Prompt
2: Enter the relevant command from the list below to set the type of dump file you wish to set
No Memory Dumps
Have Window NOT Create a Dump File
A) Copy and paste the command below into the elevated command prompt, and press Enter. (see screenshot
below the command list)
wmic RECOVEROS set DebugInfoType = 0
B) Go to
Step 3
Small Memory Dumps
Have Windows Create a
Small Memory Dump (Minidump) on BSOD
A) Copy and paste the command below into the elevated command prompt, and press Enter. (see screenshot
below the command list)
wmic RECOVEROS set DebugInfoType = 3
B) Go to
Step 3
Kernel Memory Dumps
Have Windows Create a
Kernel Memory Dump on BSOD
A) Copy and paste the command below into the elevated command prompt, and press Enter. (see screenshot
below the command list)
wmic RECOVEROS set DebugInfoType = 2
B) Go to
Step 3
Complete Memory Dumps
Have Windows Create a
Complete Memory Dump on BSOD
WARNING: Ensure you read the
important information regarding page file requirements in order for this type of dump to be created.
A) Copy and paste the command below into the elevated command prompt, and press Enter. (see screenshot
below the command list)
wmic RECOVEROS set DebugInfoType = 1
B) Go to
Step 3
Automatic Memory Dumps
Have Windows Create an
Automatic Memory Dump on BSOD
NOTE: This is the default setting
A) Copy and paste the command below into the elevated command prompt, and press Enter. (see screenshot
below the command list)
wmic RECOVEROS set DebugInfoType = 7
B) Go to
Step 3
Active Memory Dumps
Have Windows Create an
Active Memory Dump on BSOD
A) Copy and paste the command below into the elevated command prompt, and press Enter. (see screenshot
below the command list)
wmic RECOVEROS set DebugInfoType = 1
B) Go to
Step 3
3: Close the Elevated Command Prompt
4: Restart the computer to apply the settings
View the Current Memory Dump Type Setting
To view the current Memory Dump type setting
A) Open an
Elevated Command Prompt
B) Copy and paste the command below into the elevated command prompt, and press Enter
wmic RECOVEROS get DebugInfoType
Note
The example below shows the system set to 3 for a Small Memory Dump (minidump)
That's it,
Gav.
Massive thanks to Brink for the huge amount of help in making this tutorial as complete as it is.
Quote
does this mean I forgot to un-tick the box before I clicked OK and I wiped them out? I have had a couple of BSOD in the last month caused by my anti virus security and the tech team wants my dump files ...hence finding out they are gone 
also in the pic will these settings be OK for system failure : overwrite any existing file....and.....disable automatic deletion of memory dumps when disk space is low is it OK to leave un-ticked ? 
