A Quick Tip To Create A Kernel Memory Dump File Manually

by [Published on 24 June 2009 / Last Updated on 28 Feb. 2009]

This article explains how you can create a Kernel Memory dump file for diagnostic purpose.

Sometimes you might need to generate a Kernel Memory dump file to troubleshoot the issues related to Kernel Mode components. There are three methods you can use to do so as described below:

  • Crash.exe
  • CrashOnCTRLScroll
  • NMI (NMICrashDump)

The Crash.exe is available in both command line and GUI version.

To use CrashOnCTRLScroll, you need to create a registry entry at the following location in the registry:

  • KEY Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
  • Entry Name: CrashOnCTRLScroll
  • Type: DWORD
  • Value: 1(enabled), 0(disabled)

You need to restart the server for changes to take effect. After you have restarted the server, use the "CTRL+Scroll Lock Scroll Lock" to crash the server. A memory dump file will be generated at the default location on system drive.

To use the third method (NMI), you need to make sure that your server support the Non-Maskable Interrupt (NMI) capabilities. To use this method you need to create a registry entry at the following location and then press a switch located on the server to crash and generate a Kernel Memory dump file:

  • KEY Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
  • Entry Name: NMICrashDump
  • Type: DWORD
  • Value: 1

See Also

The Author — Nirmal Sharma

Nirmal Sharma avatar

Nirmal Sharma is a MCSEx3, MCITP, and was awarded Microsoft MVP in Directory Services. In his spare time, he likes to help others and share some of his knowledge by writing tips and articles for various online communities. Nirmal can also be found contributing to PowerShell based Dynamic Packs for ADHealthProf.ITDynamicPacks.Net solutions.

Featured Links