How to create a Windows Kernel Dump file to troubleshoot a system crash

Technical Articles ID: KB69402
Last Modified: 12/23/2021

Environment

McAfee File and Removable Media Protection (FRP) 5.x

For details of FRP supported environments, see KB81149.

Summary

This article describes how to create and retrieve a kernel dump file from Windows.

The article covers situations where either of the following occurs, because of a conflict with FRP:

System stop errors (system crash or blue screen)
Deadlock (system becomes unresponsive)

Solution 1

Creating the Windows kernel dump file after the system crashes (blue screen)

Configure the dump file settings on the problem computer:
1. Click Control Panel, System, Security, System.
2. Click Advanced system settings (on the left).
3. Under Startup and Recovery, click Settings.
4. From the Write debugging information drop-down list, select Kernel dump.
Optional: For both the above, deselect the option Automatically restart. This option makes sure the computer stops after the dump file has been written to the disk, which allows you time to start in Safe Mode.
Reproduce the problem and capture the dump:
1. Reproduce the problem where the system crash (blue screen) occurs.
2. When the dump file has been written to the disk, press Ctrl+Alt+Delete.
3. Start the system up in Safe Mode by pressing F8 at startup.
  
  IMPORTANT: Make sure you select Safe Mode, and not Safe Mode with networking. You need to start in Safe Mode because FRP encrypts the pagefile.sys, which is partially used for the dump file. In normal Windows mode, it would not be possible to recognize the dump, but in Safe Mode, the FRP driver is not active and does not encrypt the Windows pagefile.
4. After the computer has started in Safe Mode, restart the computer and allow the computer to return to Windows normal mode.
5. Copy the c:\windows\memory.dmp to a temporary location and place it in a ZIP file.

IMPORTANT: The following files are required for Technical Support:

Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each McAfee Enterprise product, see KB59385 - How to use MER tools with supported McAfee Enterprise products.
Other files and logs, as requested by Technical Support.

Solution 2

Creating the Windows dump file manually after a deadlock, where the system becomes unresponsive.
This procedure must be used only to capture deadlocks (system becomes unresponsive) when FRP is installed.

Reproduce the issue with FRP installed.
Wait for the deadlock situation to occur.
Example: When the system stalls, you can't close the applications, and would need to push the power button [hard reset] to restart the client.
Instead of pushing the power button, hold down the right Ctrl key and press the Scroll Lock key twice.

A dump file is produced that can be sent to McAfee Engineering for analysis.

IMPORTANT: The following files are required for Technical Support:

Minimum Escalation Requirements (MER) files for your specific product. For information about downloading the MERs for each McAfee Enterprise product, see KB59385 - How to use MER tools with supported McAfee Enterprise products.
Other files and logs, as requested by Technical Support.

Related Information

For basic information related to memory dump analysis of Kernel and User dumps, see KB52258.
For information about how to use the Windows Debug Diagnostics Tool to troubleshoot performance/crash issues with FRP, see KB69569.

Microsoft-related information:

Understanding crash dump files:
http://blogs.technet.com/b/askperf/archive/2008/01/08/understanding-crash-dump-files.aspx

Contacting Technical Support:

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Diagnostic Data Collection
File and Removable Media Protection 5.4.x
File and Removable Media Protection 5.3.x
File and Removable Media Protection 5.2.x
File and Removable Media Protection 5.1.x
File and Removable Media Protection 5.0.x (EOL)
Troubleshooting

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to create a Windows Kernel Dump file to troubleshoot a system crash

Environment

Summary

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

How to create a Windows Kernel Dump file to troubleshoot a system crash

Environment

Summary

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title