0

Sign in

Overview of memory dump file options for Windows

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your
software updates and security options. Learn what this means for you and how to stay
protected.

Support for Windows Server 2003 ended on

July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected
your software updates and security options. Learn what this means for you and how to stay
protected.

Summary
You can configure the following operating systems to write debugging information:
Windows 2000
Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2
Windows 8

Windows 8
Windows Server 2012
Windows 8.1
Windows Server 2012 R2
The debugging information can be written to different file formats also known as memory dump
files when your computer stops unexpectedly because of a Stop error also known as a "blue
screen," system crash, or bug check. You can also configure Windows not to write debugging
information to a memory dump file.
Windows can generate any one of the following memory dump file types:
Complete memory dump
Kernel memory dump
Small memory dump 64 KB
Automatic memory dump

More information
Complete memory dump
A complete memory dump records all the contents of system memory when your computer stops
unexpectedly. A complete memory dump may contain data from processes that were running
when the memory dump was collected.
If you select the Complete memory dump option, you must have a paging file on the boot
volume that is sufficient to hold all the physical RAM plus 1 megabyte MB.
If a second problem occurs and another complete memory dump or kernel memory dump file is
created, the previous file is overwritten.
Notes
In Windows Vista, in Windows 7, in Windows Server 2008, and in Windows Server 2008 R2,
the paging file can be on a partition that differs from the partition on which the operating
system is installed.
In Windows Vista and in Windows Server 2008, to put a paging file on another partition,
you must create a new registry entry that is named DedicatedDumpFile. You can define the
size of the paging file by using a new registry entry that is named DumpFileSize.
For more information about how to do this, visit the following Microsoft Web site:

For more information about how to do this, visit the following Microsoft Web site:
969028 How to generate a kernel or a complete memory dump file in Windows Server
2008
In Windows 7 and in Windows Server 2008 R2, you do not have to use the
DedicatedDumpFile registry entry to put a paging file onto another partition.
The Complete memory dump option is not available on computers that are running a 32
bit operating system and that have 2 gigabytes GB or more of RAM. For more information,
see the "Specify what happens when the system stops unexpectedly" topic on the following
Microsoft TechNet Web site:
http://technet.microsoft.com/enus/library/cc778968WS.10.aspx

Kernel memory dump

A kernel memory dump records only the kernel memory. This speeds up the process of recording
information in a log when your computer stops unexpectedly. You must have a pagefile large
enough to accommodate your kernel memory. For 32bit systems, kernel memory is usually
between150MB and 2GB. Additionally, on Windows 2003 and Windows XP, the page file must be
on the boot volume. Otherwise, a memory dump cannot be created.
This dump file does not include unallocated memory or any memory that is allocated to User
mode programs. It includes only memory that is allocated to the kernel and hardware abstraction
layer HAL in Windows 2000 and later, and memory allocated to Kernelmode drivers and other
Kernelmode programs. For most purposes, this dump file is the most useful. It is significantly
smaller than the complete memory dump file, but it omits only those parts of memory that are
unlikely to have been involved in the problem.
If a second problem occurs and another kernel memory dump file or a complete memory dump
file is created, the previous file is overwritten when the 'Overwrite any existing file' setting is
checked.

Small memory dump

A small memory dump records the smallest set of useful information that may help identify why
your computer stopped unexpectedly. This option requires a paging file of at least 2 MB on the
boot volume and specifies that Windows 2000 and later create a new file every time your
computer stops unexpectedly. A history of these files is stored in a folder.
This dump file type includes the following information:
The Stop message and its parameters and other data
A list of loaded drivers
The processor context PRCB for the processor that stopped
The process information and kernel context EPROCESS for the process that stopped
The process information and kernel context ETHREAD for the thread that stopped

The process information and kernel context ETHREAD for the thread that stopped
The Kernelmode call stack for the thread that stopped
This kind of dump file can be useful when space is limited. However, because of the limited
information included, errors that were not directly caused by the thread that was running at the
time of the problem may not be discovered by an analysis of this file.
If a second problem occurs and a second small memory dump file is created, the previous file is
preserved. Each additional file is given a distinct name. The date is encoded in the file name. For
example, Mini02290001.dmp is the first memory dump generated on February 29, 2000. A list of
all small memory dump files is kept in the %SystemRoot%\Minidump folder.

Configure the dump type

To configure startup and recovery options including the dump type, follow these steps.
Note Because there are several versions of Microsoft Windows, the following steps may be
different on your computer. If they are, see your product documentation to complete these steps.
1. Click Start, and then click Control Panel.
2. Click Performance and Maintenance, and then click System.
3. On the Advanced tab, click Settings under Startup and Recovery.
NOTE: You must restart Windows in order for your changes to take affect.

Tools for the various dump types

You can load complete memory dumps and kernel memory dumps with standard symbolic
debuggers, such as I386kd.exe. I386kd.exe is included with the Windows 2000 Support CDROM.
Load small memory dumps by using Dumpchk.exe. Dumpchk.exe is included with the Support
Tools for Windows 2000 and Windows XP. You can also use Dumpchk.exe to verify that a memory
dump file has been created correctly.
For more information about how to use Dumpchk.exe in Windows XP, click the following article
number to view the article in the Microsoft Knowledge Base:
315271 How to use Dumpchk.exe to check a memory dump file
For more information about how to use Dumpchk.exe in Windows 2000, click the following article
number to view the article in the Microsoft Knowledge Base:
156280 How to use Dumpchk.exe to check a memory dump file
For more information about Windows debugging tools, visit the following Microsoft Web site:
http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Definitions

Definitions
Boot volume: The volume that contains the Windows operating system and its support files.
The boot volume can be, but does not have to be, the same as the system volume.
System volume: The volume that contains the hardwarespecific files that you must have to
load Windows. The system volume can be, but does not have to be, the same as the boot
volume. The Boot.ini, Ntdetect.com, and Ntbootdd.sys files are examples of files that are
located on the system volume.

Registry values for startup and recovery

The following registry value is used:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
CrashDumpEnabled REG_DWORD 0x0 = None
CrashDumpEnabled REG_DWORD 0x1 = Complete memory dump
CrashDumpEnabled REG_DWORD 0x2 = Kernel memory dump
CrashDumpEnabled REG_DWORD 0x3 = Small memory dump 64KB
CrashDumpEnabled REG_DWORD 0x7 =Automatic memory dump
Additional registry values for CrashControl:
0x0 = Disabled
0x1 = Enabled
AutoReboot REG_DWORD 0x1
DumpFile REG_EXPAND_SZ %SystemRoot%\Memory.dmp
LogEvent REG_DWORD 0x1
MinidumpDir REG_EXPAND_SZ %SystemRoot%\Minidump
Overwrite REG_DWORD 0x1
SendAlert REG_DWORD 0x1
NOTE: You must restart Windows in order for your changes to take affect.

Test to make sure that a dump file can be created

For more information about how to configure your computer to generate a dump file for testing
purposes, click the following article number to view the article in the Microsoft Knowledge Base:
244139 Windows feature lets you generate a memory dump file by using the keyboard

Default dump type options

Windows 2000 Professional: Small memory dump 64 KB
Windows 2000 Server: Complete memory dump

Windows 2000 Server: Complete memory dump

Windows 2000 Advanced Server: Complete memory dump
Windows XP Professional and Home Edition: Small memory dump 64 KB
Windows Server 2003 All Editions: Complete memory dump
Windows Vista All Editions: Kernel memory dump
Windows Server 2008 All Editions: Kernel memory dump
Windows 7 All Editions: Kernel memory dump
Windows Server 2008 R2 All Editions: Kernel memory dump
Windows 8 and 8.1 All Editions: Automatic memory dump
Windows Server 2012 and 2012 R2 All Editions: Automatic memory.dmp

Maximum paging file size

Maximum paging file size is limited as follows:
x86

x64

IA64

Maximum size of a paging file

4 gigabytes non
PAE
16 terabytes PAE

16 terabytes

32 terabytes

Maximum number of paging

files

16

16

16

Total paging file size

64 gigabytes non
PAE
256 terabytes PAE

256
terabytes

512
terabytes

Technical support for x64based versions of Microsoft Windows

Your hardware manufacturer provides technical support and assistance for x64based versions of
Windows. Your hardware manufacturer provides support because an x64based version of
Windows was included with your hardware. Your hardware manufacturer might have customized
the installation of Windows with unique components. Unique components might include specific
device drivers or might include optional settings to maximize the performance of the hardware.

device drivers or might include optional settings to maximize the performance of the hardware.
Microsoft will provide reasonableeffort assistance if you need technical help with your x64based
version of Windows. However, you might have to contact your manufacturer directly. Your
manufacturer is best qualified to support the software that your manufacturer installed on the
hardware.
For product information about Microsoft Windows XP Professional x64 Edition, visit the following
Microsoft Web site:
http://www.microsoft.com/windowsxp/64bit/default.mspx
For product information about x64based versions of Microsoft Windows Server 2003, visit the
following Microsoft Web site:
http://www.microsoft.com/windowsserver2003/64bit/x64/editions.mspx

Properties
Article ID: 254649 Last Review: 01/04/2016 18:19:00 Revision: 26.0
Applies to
Microsoft Windows Server 2003, Standard x64 Edition
Microsoft Windows Server 2003, Datacenter x64 Edition
Microsoft Windows Server 2003, Enterprise x64 Edition
Microsoft Windows Server 2003, Datacenter Edition for ItaniumBased Systems
Microsoft Windows Server 2003, Enterprise Edition for Itaniumbased Systems
Microsoft Windows Server 2003, Standard Edition 32bit x86
Microsoft Windows Server 2003, Datacenter Edition 32bit x86
Microsoft Windows Server 2003, Enterprise Edition 32bit x86
Microsoft Windows Server 2003, Web Edition
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional
Microsoft Windows XP Home Edition
Microsoft Windows XP Media Center Edition 2005 Update Rollup 2
Microsoft Windows XP Tablet PC Edition

Microsoft Windows XP Tablet PC Edition

Microsoft Windows 2000 Server
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Professional Edition
Windows Server 2008 for ItaniumBased Systems
Windows Server 2008 Datacenter
Windows Server 2008 Enterprise
Windows Server 2008 Standard
Windows Web Server 2008
Windows Vista Business
Windows Vista Enterprise
Windows Vista Home Basic
Windows Vista Home Premium
Windows Vista Ultimate
Windows Server 2008 Datacenter without HyperV
Windows Server 2008 Enterprise without HyperV
Windows Server 2008 Foundation
Windows Server 2008 R2 Datacenter
Windows Server 2008 R2 Enterprise
Windows Server 2008 R2 Standard
Windows Web Server 2008 R2
Windows 7 Home Basic
Windows 7 Home Premium
Windows 7 Professional
Windows 7 Service Pack 1
Windows 7 Starter

Windows 7 Starter
Windows 7 Ultimate
Windows 7 Enterprise
Keywords:
kbenv kbinfo KB254649

Support

Security

Contact Us

English United States

Terms of use

Privacy & cookies

Trademarks

2016 Microsoft