deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 05:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #10608 from MaratMussabekov/patch-322

Browse Source 
added missing options
This commit is contained in:
Aaron Czechowski 2022-07-12 16:35:13 -07:00 committed by GitHub
commit 5e3b66d155
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 60 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
windows/client-management/system-failure-recovery-options.md
View File

@ -6,7 +6,7 @@ ms.topic: troubleshooting
author: Deland-Han
ms.localizationpriority: medium
ms.author: delhan
ms.date: 8/22/2019
ms.date: 07/12/2022
ms.reviewer: dcscontentpm
manager: dansimp
---
@ -183,6 +183,63 @@ To specify that you don't want to overwrite any previous kernel or complete memo
- Set the **Overwrite** DWORD value to **0**.
#### Automatic Memory Dump
This is the default option. An Automatic Memory Dump contains the same information as a Kernel Memory Dump. The difference between the two is in the way that Windows sets the size of the system paging file. If the system paging file size is set to **System managed size**, and the kernel-mode crash dump is set to **Automatic Memory Dump**, then Windows can set the size of the paging file to less than the size of RAM. In this case, Windows sets the size of the paging file large enough to ensure that a kernel memory dump can be captured most of the time.
If the computer crashes and the paging file is not large enough to capture a kernel memory dump, Windows increases the size of the paging file to at least the size of RAM. For more information, see [Automatic Memory Dump](/windows-hardware/drivers/debugger/automatic-memory-dump).
To specify that you want to use an automatic memory dump file, run the following command or modify the registry value:
- ```cmd
wmic recoveros set DebugInfoType = 7
```
- Set the **CrashDumpEnabled** DWORD value to **7**.
To specify that you want to use a file as your memory dump file, run the following command or modify the registry value:
- ```cmd
wmic recoveros set DebugFilePath = <filepath>
```
- Set the **DumpFile** Expandable String Value to \<filepath\>.
To specify that you don't want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value:
- ```cmd
wmic recoveros set OverwriteExistingDebugFile = 0
```
- Set the **Overwrite** DWORD value to **0**.
#### Active Memory Dump
An Active Memory Dump is similar to a Complete Memory Dump, but it filters out pages that are not likely to be relevant to troubleshooting problems on the host machine. Because of this filtering, it is typically significantly smaller than a Complete Memory Dump.
This dump file includes any memory allocated to user-mode applications. It also includes memory allocated to the Windows kernel and hardware abstraction layer, as well as memory allocated to kernel-mode drivers and other kernel-mode programs. The dump includes active pages mapped into the kernel or user space that are useful for debugging, as well as selected Pagefile-backed Transition, Standby, and Modified pages such as the memory allocated with VirtualAlloc or page-file-backed sections. Active dumps do not include pages on the free and zeroed lists, the file cache, guest VM pages, and various other types of memory that are not likely to be useful during debugging. For more information, see [Active Memory Dump](/windows-hardware/drivers/debugger/active-memory-dump).
To specify that you want to use an active memory dump file, modify the registry value:
- Set the **CrashDumpEnabled** DWORD value to **1**.
- Set the **FilterPages** DWORD value to **1**.
To specify that you want to use a file as your memory dump file, run the following command or modify the registry value:
- ```cmd
wmic recoveros set DebugFilePath = <filepath>
```
- Set the DumpFile Expandable String Value to \<filepath\>.
To specify that you don't want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value:
- ```cmd
wmic recoveros set OverwriteExistingDebugFile = 0
```
- Set the **Overwrite** DWORD value to **0**.
>[!Note]
>If you contact Microsoft Support about a Stop error, you might be asked for the memory dump file that is generated by the Write Debugging Information option.
@ -191,6 +248,7 @@ To view system failure and recovery settings for your local computer, type **wmi
>[!Note]
>To successfully use these Wmic.exe command line examples, you must be logged on by using a user account that has administrative rights on the computer. If you are not logged on by using a user account that has administrative rights on the computer, use the **/user:user_name** and **/password:password** switches.
### Tips
- To take advantage of the dump file feature, your paging file must be on the boot volume. If you've moved the paging file to another volume, you must move it back to the boot volume before you use this feature.
@ -201,4 +259,4 @@ To view system failure and recovery settings for your local computer, type **wmi
## References
[Varieties of Kernel-Mode Dump Files](/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files)
[Varieties of Kernel-Mode Dump Files](/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files)