-System audit policy -Category/Subcategory Setting -Logon/Logoff - Network Policy Server Success and Failure -- -If it says, "No auditing," you can run this command to enable it: -```console -auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable -``` - -Even if audit policy appears to be fully enabled, it sometimes helps to disable and then re-enable this setting. You can also enable Network Policy Server logon/logoff auditing by using Group Policy. To get to the success/failure setting, select **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Advanced Audit Policy Configuration** > **Audit Policies** > **Logon/Logoff** > **Audit Network Policy Server**. - -## More references - -[Troubleshooting Windows Vista 802.11 Wireless Connections](/previous-versions/windows/it-pro/windows-vista/cc766215(v=ws.10))
Try our Virtual Agent - It can help you quickly identify and fix common Windows boot issues. - -> [!NOTE] -> This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/windows/recovery-options-in-windows-31ce2444-7de3-818c-d626-e3b5a3024da5). - -## Summary - -There are several reasons why a Windows-based computer may have problems during startup. To troubleshoot boot problems, first determine in which of the following phases the computer gets stuck: - -| Phase | Boot Process | BIOS | UEFI | -|-----------|----------------------|------------------------------------|-----------------------------------| -| 1 | PreBoot | MBR/PBR (Bootstrap Code) | UEFI Firmware | -| 2 | Windows Boot Manager | %SystemDrive%\bootmgr | \EFI\Microsoft\Boot\bootmgfw.efi | -| 3 | Windows OS Loader | %SystemRoot%\system32\winload.exe | %SystemRoot%\system32\winload.efi | -| 4 | Windows NT OS Kernel | %SystemRoot%\system32\ntoskrnl.exe | | - -1. **PreBoot**: The PC's firmware initiates a power-on self test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot Manager. - -2. **Windows Boot Manager**: Windows Boot Manager finds and starts the Windows loader (Winload.exe) on the Windows boot partition. - -3. **Windows operating system loader**: Essential drivers required to start the Windows kernel are loaded and the kernel starts to run. - -4. **Windows NT OS Kernel**: The kernel loads into memory the system registry hive and other drivers that are marked as BOOT_START. - - The kernel passes control to the session manager process (Smss.exe) which initializes the system session, and loads and starts the devices and drivers that aren't marked BOOT_START. - - - -Here's a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before you start troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement. Select the thumbnail to view it larger. - -:::image type="content" source="images/boot-sequence-thumb.png" alt-text="Diagram of the boot sequence flowchart." lightbox="images/boot-sequence.png"::: - -Each phase has a different approach to troubleshooting. This article provides troubleshooting techniques for problems that occur during the first three phases. - -> [!NOTE] -> If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: -> -> `Bcdedit /set {default} recoveryenabled no` -> -> If the F8 options don't work, run the following command: -> -> `Bcdedit /set {default} bootmenupolicy legacy` - -## BIOS phase - -To determine whether the system has passed the BIOS phase, follow these steps: - -1. If there are any external peripherals connected to the computer, disconnect them. - -2. Check whether the hard disk drive light on the physical computer is working. If it's not working, this dysfunction indicates that the startup process is stuck at the BIOS phase. - -3. Press the NumLock key to see whether the indicator light toggles on and off. If it doesn't toggle, this dysfunction indicates that the startup process is stuck at BIOS. - - If the system is stuck at the BIOS phase, there may be a hardware problem. - -## Boot loader phase - -If the screen is black except for a blinking cursor, or if you receive one of the following error codes, this status indicates that the boot process is stuck in the Boot Loader phase: - -- Boot Configuration Data (BCD) missing or corrupted -- Boot file or MBR corrupted -- Operating system Missing -- Boot sector missing or corrupted -- Bootmgr missing or corrupted -- Unable to boot due to system hive missing or corrupted - -To troubleshoot this problem, use Windows installation media to start the computer, press **Shift** + **F10** for a command prompt, and then use any of the following methods. - -### Method 1: Startup Repair tool - -The Startup Repair tool automatically fixes many common problems. The tool also lets you quickly diagnose and repair more complex startup problems. When the computer detects a startup problem, the computer starts the Startup Repair tool. When the tool starts, it performs diagnostics. These diagnostics include analyzing startup log files to determine the cause of the problem. When the Startup Repair tool determines the cause, the tool tries to fix the problem automatically. - -To do this task of invoking the Startup Repair tool, follow these steps. - -> [!NOTE] -> For additional methods to start WinRE, see [Windows Recovery Environment (Windows RE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#entry-points-into-winre). - -1. Start the system to the installation media for the installed version of Windows. For more information, see [Create installation media for Windows](https://support.microsoft.com/windows/create-installation-media-for-windows-99a58364-8c02-206f-aa6f-40c3b507420d). - -2. On the **Install Windows** screen, select **Next** > **Repair your computer**. - -3. On the **Choose an option** screen, select **Troubleshoot**. - -4. On the **Advanced options** screen, select **Startup Repair**. - -5. After Startup Repair, select **Shutdown**, then turn on your PC to see if Windows can boot properly. - -The Startup Repair tool generates a log file to help you understand the startup problems and the repairs that were made. You can find the log file in the following location: - -`%windir%\System32\LogFiles\Srt\Srttrail.txt` - -For more information, see [Troubleshoot blue screen errors](https://support.microsoft.com/sbs/windows/troubleshoot-blue-screen-errors-5c62726c-6489-52da-a372-3f73142c14ad). - -### Method 2: Repair Boot Codes - -To repair boot codes, run the following command: - -```command -BOOTREC /FIXMBR -``` - -To repair the boot sector, run the following command: - -```command -BOOTREC /FIXBOOT -``` - -> [!NOTE] -> Running `BOOTREC` together with `Fixmbr` overwrites only the master boot code. If the corruption in the MBR affects the partition table, running `Fixmbr` may not fix the problem. - -### Method 3: Fix BCD errors - -If you receive BCD-related errors, follow these steps: - -1. Scan for all the systems that are installed. To do this step, run the following command: - - ```command - Bootrec /ScanOS - ``` - -2. Restart the computer to check whether the problem is fixed. - -3. If the problem isn't fixed, run the following commands: - - ```command - bcdedit /export c:\bcdbackup - - attrib c:\boot\bcd -r -s -h - - ren c:\boot\bcd bcd.old - - bootrec /rebuildbcd - ``` - -4. Restart the system. - -### Method 4: Replace Bootmgr - -If methods 1, 2 and 3 don't fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this replacement, follow these steps: - -1. At a command prompt, change the directory to the System Reserved partition. - -2. Run the `attrib` command to unhide the file: - - ```command - attrib -r -s -h - ``` - -3. Navigate to the system drive and run the same command: - - ```command - attrib -r -s -h - ``` - -4. Rename the `bootmgr` file as `bootmgr.old`: - - ```command - ren c:\bootmgr bootmgr.old - ``` - -5. Navigate to the system drive. - -6. Copy the `bootmgr` file, and then paste it to the System Reserved partition. - -7. Restart the computer. - -### Method 5: Restore system hive - -If Windows can't load the system registry hive into memory, you must restore the system hive. To do this step, use the Windows Recovery Environment or use the Emergency Repair Disk (ERD) to copy the files from the `C:\Windows\System32\config\RegBack` directory to `C:\Windows\System32\config`. - -If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced. - -> [!NOTE] -> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more information, see [The system registry is no longer backed up to the RegBack folder starting in Windows 10 version 1803](/troubleshoot/windows-client/deployment/system-registry-no-backed-up-regback-folder). - -## Kernel Phase - -If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These error messages include, but aren't limited to, the following examples: - -- A Stop error appears after the splash screen (Windows Logo screen). - -- Specific error code is displayed. For example, `0x00000C2` , `0x0000007B` , or `inaccessible boot device`. - - [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](./troubleshoot-inaccessible-boot-device.md) - - [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) - -- The screen is stuck at the "spinning wheel" (rolling dots) "system busy" icon. - -- A black screen appears after the splash screen. - -To troubleshoot these problems, try the following recovery boot options one at a time. - -### Scenario 1: Try to start the computer in Safe mode or Last Known Good Configuration - -On the **Advanced Boot Options** screen, try to start the computer in **Safe Mode** or **Safe Mode with Networking**. If either of these options works, use Event Viewer to help identify and diagnose the cause of the boot problem. To view events that are recorded in the event logs, follow these steps: - -1. Use one of the following methods to open Event Viewer: - - - Go to the **Start** menu, select **Administrative Tools**, and then select **Event Viewer**. - - - Start the Event Viewer snap-in in Microsoft Management Console (MMC). - -2. In the console tree, expand Event Viewer, and then select the log that you want to view. For example, choose **System log** or **Application log**. - -3. In the details pane, open the event that you want to view. - -4. On the **Edit** menu, select **Copy**. Open a new document in the program in which you want to paste the event. For example, Microsoft Word. Then select **Paste**. - -5. Use the up arrow or down arrow key to view the description of the previous or next event. - -### Clean boot - -To troubleshoot problems that affect services, do a clean boot by using System Configuration (`msconfig`). -Select **Selective startup** to test the services one at a time to determine which one is causing the problem. If you can't find the cause, try including system services. However, in most cases, the problematic service is third-party. - -Disable any service that you find to be faulty, and try to start the computer again by selecting **Normal startup**. - -For detailed instructions, see [How to perform a clean boot in Windows](https://support.microsoft.com/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd). - -If the computer starts in Disable Driver Signature mode, start the computer in Disable Driver Signature Enforcement mode, and then follow the steps that are documented in the following article to determine which drivers or files require driver signature enforcement: -[Troubleshooting boot problem caused by missing driver signature (x64)](/archive/blogs/askcore/troubleshooting-boot-issues-due-to-missing-driver-signature-x64) - -> [!NOTE] -> If the computer is a domain controller, try Directory Services Restore mode (DSRM). -> -> This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" - -#### Examples - -> [!WARNING] -> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft can't guarantee that these problems can be solved. Modify the registry at your own risk. - -*Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)* - -To troubleshoot this Stop error, follow these steps to filter the drivers: - -1. Go to Windows Recovery Environment (WinRE) by putting an ISO disk of the system in the disk drive. The ISO should be of the same version of Windows or a later version. - -2. Open the registry. - -3. Load the system hive, and name it **test**. - -4. Under the following registry subkey, check for lower filter and upper filter items for non-Microsoft drivers: - - `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class` - -5. For each third-party driver that you locate, select the upper or lower filter, and then delete the value data. - -6. Search through the whole registry for similar items. Process as appropriate, and then unload the registry hive. - -7. Restart the server in Normal mode. - -For more troubleshooting steps, see [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](./troubleshoot-inaccessible-boot-device.md). - -To fix problems that occur after you install Windows updates, check for pending updates by using these steps: - -1. Open a Command Prompt window in WinRE. - -2. Run the command: - - ```command - DISM /image:C:\ /get-packages - ``` - -3. If there are any pending updates, uninstall them by running the following commands: - - ```command - DISM /image:C:\ /remove-package /packagename: name of the package - - DISM /Image:C:\ /Cleanup-Image /RevertPendingActions - ``` - - Try to start the computer. - -If the computer doesn't start, follow these steps: - -1. Open a command prompt window in WinRE, and start a text editor, such as Notepad. - -2. Navigate to the system drive, and search for `windows\winsxs\pending.xml`. - -3. If the pending.xml file is found, rename the file as `pending.xml.old`. - -4. Open the registry, and then load the component hive in HKEY_LOCAL_MACHINE as test. - -5. Highlight the loaded test hive, and then search for the `pendingxmlidentifier` value. - -6. If the `pendingxmlidentifier` value exists, delete it. - -7. Unload the test hive. - -8. Load the system hive, name it **test**. - -9. Navigate to the following subkey: - - `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TrustedInstaller` - -10. Change the **Start** value from `1` to `4`. - -11. Unload the hive. - -12. Try to start the computer. - -If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For more information, see [Generate a kernel or complete crash dump](./generate-kernel-or-complete-crash-dump.md). - -For more information about page file problems in Windows 10 or Windows Server 2016, see [Introduction to page files](./introduction-page-file.md). - -For more information about Stop errors, see [Advanced troubleshooting for Stop error or blue screen error issue](./troubleshoot-stop-errors.md). - -Sometimes the dump file shows an error that's related to a driver. For example, `windows\system32\drivers\stcvsm.sys` is missing or corrupted. In this instance, follow these guidelines: - -- Check the functionality that's provided by the driver. If the driver is a third-party boot driver, make sure that you understand what it does. - -- If the driver isn't important and has no dependencies, load the system hive, and then disable the driver. - -- If the stop error indicates system file corruption, run the system file checker in offline mode. - - - To do this action, open WinRE, open a command prompt, and then run the following command: - - ```command - SFC /Scannow /OffBootDir=C:\ /OffWinDir=C:\Windows - ``` - - For more information, see [Using system file checker (SFC) to fix issues](/archive/blogs/askcore/using-system-file-checker-sfc-to-fix-issues). - - - If there's disk corruption, run the check disk command: - - ```command - chkdsk /f /r - ``` - -- If the Stop error indicates general registry corruption, or if you believe that new drivers or services were installed, follow these steps: - - 1. Start WinRE, and open a command prompt window. - 2. Start a text editor, such as Notepad. - 3. Navigate to `C:\Windows\System32\Config\`. - 4. Rename the all five hives by appending `.old` to the name. - 5. Copy all the hives from the `Regback` folder, paste them in the `Config` folder, and then try to start the computer in Normal mode. - -> [!NOTE] -> Starting in Windows 10, version 1803, Windows no longer automatically backs up the system registry to the RegBack folder.This change is by design, and is intended to help reduce the overall disk footprint size of Windows. To recover a system with a corrupt registry hive, Microsoft recommends that you use a system restore point. For more information, see [The system registry is no longer backed up to the RegBack folder starting in Windows 10 version 1803](/troubleshoot/windows-client/deployment/system-registry-no-backed-up-regback-folder). diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md deleted file mode 100644 index 35484e641a..0000000000 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ /dev/null @@ -1,324 +0,0 @@ ---- -title: Advanced Troubleshooting Wireless Network Connectivity -ms.reviewer: -manager: dougeby -description: Learn how to troubleshoot Wi-Fi connections. Troubleshooting Wi-Fi connections requires understanding the basic flow of the Wi-Fi autoconnect state machine. -ms.prod: w10 -author: aczechowski -ms.localizationpriority: medium -ms.author: aaroncz -ms.topic: troubleshooting ---- - -# Advanced troubleshooting wireless network connectivity - -> [!NOTE] -> Home users: This article is intended for use by support agents and IT professionals. If you're looking for more general information about Wi-Fi problems in Windows 10, check out this [Windows 10 Wi-Fi fix article](https://support.microsoft.com/en-in/help/4000432/windows-10-fix-wi-fi-problems). - -## Overview - -This overview describes the general troubleshooting of establishing Wi-Fi connections from Windows clients. -Troubleshooting Wi-Fi connections requires understanding the basic flow of the Wi-Fi autoconnect state machine. Understanding this flow makes it easier to determine the starting point in a repro scenario in which a different behavior is found. -This workflow involves knowledge and use of [TextAnalysisTool](https://github.com/TextAnalysisTool/Releases), an extensive text filtering tool that is useful with complex traces with numerous ETW providers such as wireless_dbg trace scenario. - -## Scenarios - -This article applies to any scenario in which Wi-Fi connections fail to establish. The troubleshooter is developed with Windows 10 clients in focus, but also may be useful with traces as far back as Windows 7. - -> [!NOTE] -> This troubleshooter uses examples that demonstrate a general strategy for navigating and interpreting wireless component [Event Tracing for Windows](/windows/desktop/etw/event-tracing-portal) (ETW). It's not meant to be representative of every wireless problem scenario. - -Wireless ETW is incredibly verbose and calls out many innocuous errors (rather flagged behaviors that have little or nothing to do with the problem scenario). Searching for or filtering on "err", "error", and "fail" will seldom lead you to the root cause of a problematic Wi-Fi scenario. Instead it will flood the screen with meaningless logs that will obfuscate the context of the actual problem. - -It's important to understand the different Wi-Fi components involved, their expected behaviors, and how the problem scenario deviates from those expected behaviors. -The intention of this troubleshooter is to show how to find a starting point in the verbosity of wireless_dbg ETW and home in on the responsible components that are causing the connection problem. - -### Known Issues and fixes - -| OS version | Fixed in | -| --- | --- | -| **Windows 10, version 1803** | [KB4284848](https://support.microsoft.com/help/4284848) | -| **Windows 10, version 1709** | [KB4284822](https://support.microsoft.com/help/4284822) | -| **Windows 10, version 1703** | [KB4338827](https://support.microsoft.com/help/4338827) | - -Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update-history webpage for your system: -- [Windows 10 version 1809](https://support.microsoft.com/help/4464619) -- [Windows 10 version 1803](https://support.microsoft.com/help/4099479) -- [Windows 10 version 1709](https://support.microsoft.com/en-us/help/4043454) -- [Windows 10 version 1703](https://support.microsoft.com/help/4018124) -- [Windows 10 version 1607 and Windows Server 2016](https://support.microsoft.com/help/4000825) -- [Windows 10 version 1511](https://support.microsoft.com/help/4000824) -- [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470) -- [Windows Server 2012](https://support.microsoft.com/help/4009471) -- [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/4009469) - -## Data Collection - -1. Network Capture with ETW. Enter the following command at an elevated command prompt: - - ```console - netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl - ``` -2. Reproduce the issue. - - If there's a failure to establish connection, try to manually connect. - - If it's intermittent but easily reproducible, try to manually connect until it fails. Record the time of each connection attempt, and whether it was a success or failure. - - If the issue is intermittent but rare, netsh trace stop command needs to be triggered automatically (or at least alerted to admin quickly) to ensure trace doesn’t overwrite the repro data. - - If intermittent connection drops trigger stop command on a script (ping or test network constantly until fail, then netsh trace stop). -3. Stop the trace by entering the following command: - - ```console - netsh trace stop - ``` -4. To convert the output file to text format: - - ```console - netsh trace convert c:\tmp\wireless.etl - ``` - -See the [example ETW capture](#example-etw-capture) at the bottom of this article for an example of the command output. After running these commands, you'll have three files: wireless.cab, wireless.etl, and wireless.txt. - -## Troubleshooting - -The following view is a high-level one of the main wifi components in Windows. - -|Wi-fi Components|Description| -|--- |--- | -||The Windows Connection Manager (Wcmsvc) is closely associated with the UI controls (taskbar icon) to connect to various networks, including wireless networks. It accepts and processes input from the user and feeds it to the core wireless service.| -||The WLAN Autoconfig Service (WlanSvc) handles the following core functions of wireless networks in windows:
Try our Virtual Agent - It can help you quickly identify and fix common Windows boot issues
-
-> [!NOTE]
-> If you're not a support agent or IT professional, you'll find more helpful information about stop error ("blue screen") messages in [Troubleshoot blue screen errors](https://support.microsoft.com/sbs/windows/troubleshoot-blue-screen-errors-5c62726c-6489-52da-a372-3f73142c14ad).
-
-## What causes stop errors?
-
-A stop error is displayed as a blue screen that contains the name of the faulty driver, such as any of the following example drivers:
-
-- `atikmpag.sys`
-- `igdkmd64.sys`
-- `nvlddmkm.sys`
-
-There's no simple explanation for the cause of stop errors (also known as blue screen errors or bug check errors). Many different factors can be involved. However, various studies indicate that stop errors usually aren't caused by Microsoft Windows components. Instead, these errors are related to malfunctioning hardware drivers or drivers that are installed by third-party software. These drivers include video cards, wireless network cards, security programs, and so on.
-
-Our analysis of the root causes of crashes indicates that:
-
-- 70% are caused by third-party driver code.
-- 10% are caused by hardware issues.
-- 5% are caused by Microsoft code.
-- 15% have unknown causes, because the memory is too corrupted to analyze.
-
-> [!NOTE]
-> The root cause of stop errors is never a user-mode process. While a user-mode process (such as Notepad or Slack) may trigger a stop error, it is merely exposing the underlying bug which is always in a driver, hardware, or the OS.
-
-## General troubleshooting steps
-
-To troubleshoot stop error messages, follow these general steps:
-
-1. Review the stop error code that you find in the event logs. Search online for the specific stop error codes to see whether there are any known issues, resolutions, or workarounds for the problem.
-
-1. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system. For example:
-
- - [Windows 10, version 21H2](https://support.microsoft.com/topic/windows-10-update-history-857b8ccb-71e4-49e5-b3f6-7073197d98fb)
- - [Windows 10, version 21H1](https://support.microsoft.com/topic/windows-10-update-history-1b6aac92-bf01-42b5-b158-f80c6d93eb11)
- - [Windows 10, version 20H2](https://support.microsoft.com/topic/windows-10-update-history-7dd3071a-3906-fa2c-c342-f7f86728a6e3)
-
-1. Make sure that the BIOS and firmware are up-to-date.
-
-1. Run any relevant hardware and memory tests.
-
-1. Run [Microsoft Safety Scanner](/microsoft-365/security/intelligence/safety-scanner-download) or any other virus detection program that includes checks of the MBR for infections.
-
-1. Make sure that there's sufficient free space on the hard disk. The exact requirement varies, but we recommend 10-15 percent free disk space.
-
-1. Contact the respective hardware or software vendor to update the drivers and applications in the following scenarios:
-
- - The error message indicates that a specific driver is causing the problem.
- - You're seeing an indication of a service that is starting or stopping before the crash occurred. In this situation, determine whether the service behavior is consistent across all instances of the crash.
- - You have made any software or hardware changes.
-
- > [!NOTE]
- > If there are no updates available from a specific manufacturer, we recommend that you disable the related service.
- >
- > For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/topic/how-to-perform-a-clean-boot-in-windows-da2f9573-6eec-00ad-2f8a-a97a1807f3dd).
- >
- > You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](/troubleshoot/windows-server/performance/deactivate-kernel-mode-filter-driver).
- >
- > You may also want to consider the option of rolling back changes or reverting to the last-known working state. For more information, see [Roll back a device driver to a previous version](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732648(v=ws.11)).
-
-### Memory dump collection
-
-To configure the system for memory dump files, follow these steps:
-
-1. Select the Taskbar search box, type **Advanced system settings**, and then press **Enter**.
-
-2. On the **Advanced** tab on the System Properties box, select the **Settings** button that appears in the section **Startup and Recovery**.
-
-3. In the new window, select the drop-down below the option **Write debugging information**.
-
-4. Choose **Automatic memory dump**.
-
-5. Select **OK**.
-
-6. Restart the computer for the setting to take effect.
-
-7. If the server is virtualized, disable auto reboot after the memory dump file is created. This disablement lets you take a snapshot of the server in-state and also if the problem recurs.
-
-The memory dump file is saved at the following locations:
-
-| Dump file type | Location |
-|---------------------------------|-----------------------------------------------------|
-| (none) | `%SystemRoot%\MEMORY.DMP` (inactive, or grayed out) |
-| Small memory dump file (256 kb) | `%SystemRoot%\Minidump` |
-| Kernel memory dump file | `%SystemRoot%\MEMORY.DMP` |
-| Complete memory dump file | `%SystemRoot%\MEMORY.DMP` |
-| Automatic memory dump file | `%SystemRoot%\MEMORY.DMP` |
-| Active memory dump file | `%SystemRoot%\MEMORY.DMP` |
-
-You can use the Microsoft Crash Dump File Checker (DumpChk) tool to verify that the memory dump files aren't corrupted or invalid. For more information, see the following video:
-
-> [!VIDEO https://www.youtube.com/embed/xN7tOfgNKag]
-
-For more information on how to use Dumpchk.exe to check your dump files, see the following articles:
-
-- [Using DumpChk](/windows-hardware/drivers/debugger/dumpchk)
-- [Download DumpChk](https://developer.microsoft.com/windows/downloads/windows-10-sdk)
-
-### Pagefile settings
-
-For more information on pagefile settings, see the following articles:
-
-- [Introduction to page files](introduction-page-file.md)
-- [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md)
-- [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md)
-
-### Memory dump analysis
-
-Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in various symptoms.
-
-When a stop error occurs, you should first isolate the problematic components, and then try to cause them to trigger the stop error again. If you can replicate the problem, you can usually determine the cause.
-
-You can use the tools such as Windows Software Development Kit (SDK) and symbols to diagnose dump logs. The next section discusses how to use this tool.
-
-## Advanced troubleshooting steps
-
-> [!NOTE]
-> Advanced troubleshooting of crash dumps can be very challenging if you aren't experienced with programming and internal Windows mechanisms. We have attempted to provide a brief insight here into some of the techniques used, including some examples. However, to really be effective at troubleshooting a crash dump, you should spend time becoming familiar with advanced debugging techniques. For a video overview, [Debugging kernel mode crashes and hangs](/shows/defrag-tools/defragtools-137-debugging-kernel-mode-dumps). Also see the advanced references listed below.
-
-### Advanced debugging references
-
-- [Advanced Windows Debugging, first edition book](https://www.amazon.com/Advanced-Windows-Debugging-Mario-Hewardt/dp/0321374460)
-- [Debugging Tools for Windows (WinDbg, KD, CDB, NTSD)](/windows-hardware/drivers/debugger/)
-
-### Debugging steps
-
-1. Verify that the computer is set up to generate a complete memory dump file when a crash occurs. For more information, see [Method 1: Memory dump](troubleshoot-windows-freeze.md#method-1-memory-dump).
-
-2. Locate the memory.dmp file in your Windows directory on the computer that is crashing, and copy that file to another computer.
-
-3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk).
-
-4. Start the install and choose **Debugging Tools for Windows**. The WinDbg tool is installed.
-
-5. Go to the **File** menu and select **Symbol File Path** to open the WinDbg tool and set the symbol path.
-
- 1. If the computer is connected to the internet, enter the [Microsoft public symbol server](/windows-hardware/drivers/debugger/microsoft-public-symbols): `https://msdl.microsoft.com/download/symbols` and select **OK**. This method is recommended.
-
- 1. If the computer isn't connected to the internet, specify a local [symbol path](/windows-hardware/drivers/debugger/symbol-path).
-
-6. Select **Open Crash Dump**, and then open the memory.dmp file that you copied.
-
- :::image type="content" alt-text="Example output in WinDbg when opening a crash dump file." source="images/windbg.png" lightbox="images/windbg.png":::
-
-7. Under **Bugcheck Analysis**, select **`!analyze -v`**. The command `!analyze -v` is entered in the prompt at the bottom of the page.
-
-8. A detailed bug check analysis appears.
-
- :::image type="content" alt-text="An example detailed bug check analysis." source="images/bugcheck-analysis.png" lightbox="images/bugcheck-analysis.png":::
-
-9. Scroll down to the **STACK_TEXT** section. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash. If applicable, it also says what service is crashing the DLL.
-
-10. For more information about how to interpret the STACK_TEXT output, see [Using the !analyze Extension](/windows-hardware/drivers/debugger/using-the--analyze-extension).
-
-There are many possible causes of a bug check and each case is unique. In the example provided above, the important lines that can be identified from the STACK_TEXT are 20, 21, and 22:
-
-> [!NOTE]
-> HEX data is removed here and lines are numbered for clarity.
-
-```console
-1 : nt!KeBugCheckEx
-2 : nt!PspCatchCriticalBreak+0xff
-3 : nt!PspTerminateAllThreads+0x1134cf
-4 : nt!PspTerminateProcess+0xe0
-5 : nt!NtTerminateProcess+0xa9
-6 : nt!KiSystemServiceCopyEnd+0x13
-7 : nt!KiServiceLinkage
-8 : nt!KiDispatchException+0x1107fe
-9 : nt!KiFastFailDispatch+0xe4
-10 : nt!KiRaiseSecurityCheckFailure+0x3d3
-11 : ntdll!RtlpHpFreeWithExceptionProtection$filt$0+0x44
-12 : ntdll!_C_specific_handler+0x96
-13 : ntdll!RtlpExecuteHandlerForException+0xd
-14 : ntdll!RtlDispatchException+0x358
-15 : ntdll!KiUserExceptionDispatch+0x2e
-16 : ntdll!RtlpHpVsContextFree+0x11e
-17 : ntdll!RtlpHpFreeHeap+0x48c
-18 : ntdll!RtlpHpFreeWithExceptionProtection+0xda
-19 : ntdll!RtlFreeHeap+0x24a
-20 : FWPolicyIOMgr!FwBinariesFree+0xa7c2
-21 : mpssvc!FwMoneisDiagEdpPolicyUpdate+0x1584f
-22 : mpssvc!FwEdpMonUpdate+0x6c
-23 : ntdll!RtlpWnfWalkUserSubscriptionList+0x29b
-24 : ntdll!RtlpWnfProcessCurrentDescriptor+0x105
-25 : ntdll!RtlpWnfNotificationThread+0x80
-26 : ntdll!TppExecuteWaitCallback+0xe1
-27 : ntdll!TppWorkerThread+0x8d0
-28 : KERNEL32!BaseThreadInitThunk+0x14
-29 : ntdll!RtlUserThreadStart+0x21
-```
-
-This issue is because of the **mpssvc** service, which is a component of the Windows Firewall. The problem was repaired by disabling the firewall temporarily and then resetting firewall policies.
-
-For more examples, see [Debugging examples](#debugging-examples).
-
-## Video resources
-
-The following videos illustrate various troubleshooting techniques for analyzing dump files.
-
-- [Analyze dump file](https://www.youtube.com/watch?v=s5Vwnmi_TEY)
-- [Installing debugging tool for Windows (x64 and x86)](/shows/defrag-tools/building-your-usb-thumbdrive)
-- [Debugging kernel mode crash memory dumps](/shows/defrag-tools/defragtools-137-debugging-kernel-mode-dumps)
-- [Special pool](https://www.youtube.com/watch?v=vHXYS9KdU1k)
-
-## Advanced troubleshooting using Driver Verifier
-
-We estimate that about 75 percent of all stop errors are caused by faulty drivers. The Driver Verifier tool provides several methods to help you troubleshoot. These include running drivers in an isolated memory pool (without sharing memory with other components), generating extreme memory pressure, and validating parameters. If the tool encounters errors in the execution of driver code, it proactively creates an exception. It can then further examine that part of the code.
-
-> [!WARNING]
-> Driver Verifier consumes lots of CPU and can slow down the computer significantly. You may also experience additional crashes. Verifier disables faulty drivers after a stop error occurs, and continues to do this until you can successfully restart the system and access the desktop. You can also expect to see several dump files created.
->
-> Don't try to verify all the drivers at one time. This action can degrade performance and make the system unusable. It also limits the effectiveness of the tool.
-
-Use the following guidelines when you use Driver Verifier:
-
-- Test any "suspicious" drivers. For example, drivers that were recently updated or that are known to be problematic.
-
-- If you continue to experience non-analyzable crashes, try enabling verification on all third-party and unsigned drivers.
-
-- Enable concurrent verification on groups of 10-20 drivers.
-
-- Additionally, if the computer can't boot into the desktop because of Driver Verifier, you can disable the tool by starting in Safe mode. This solution is because the tool can't run in Safe mode.
-
-For more information, see [Driver Verifier](/windows-hardware/drivers/devtest/driver-verifier).
-
-## Common Windows stop errors
-
-This section doesn't contain a list of all error codes, but since many error codes have the same potential resolutions, your best bet is to follow the steps below to troubleshoot your error.
-
-The following sections list general troubleshooting procedures for common stop error codes.
-
-### VIDEO_ENGINE_TIMEOUT_DETECTED or VIDEO_TDR_TIMEOUT_DETECTED
-
-Stop error code 0x00000141, or 0x00000117
-
-Contact the vendor of the listed display driver to get an appropriate update for that driver.
-
-### DRIVER_IRQL_NOT_LESS_OR_EQUAL
-
-Stop error code 0x0000000D1
-
-Apply the latest updates for the driver by applying the latest cumulative updates for the system through the Microsoft Update Catalog website. Update an outdated network driver. Virtualized VMware systems often run "Intel(R) PRO/1000 MT Network Connection" (e1g6032e.sys). You can download this driver from the [Intel Download Drivers & Software website](https://downloadcenter.intel.com). Contact the hardware vendor to update the network driver for a resolution. For VMware systems, use the VMware integrated network driver instead of Intel's e1g6032e.sys. For example, use VMware types `VMXNET`, `VMXNET2`, or `VMXNET3`.
-
-### PAGE_FAULT_IN_NONPAGED_AREA
-
-Stop error code 0x000000050
-
-If a driver is identified in the stop error message, contact the manufacturer for an update. If no updates are available, disable the driver, and monitor the system for stability. Run `chkdsk /f /r` to detect and repair disk errors. Restart the system before the disk scan begins on a system partition. Contact the manufacturer for any diagnostic tools that they may provide for the hard disk subsystem. Try to reinstall any application or service that was recently installed or updated. It's possible that the crash was triggered while the system was starting applications and reading the registry for preference settings. Reinstalling the application can fix corrupted registry keys. If the problem persists, and you have run a recent system state backup, try to restore the registry hives from the backup.
-
-### SYSTEM_SERVICE_EXCEPTION
-
-Stop error code c000021a {Fatal System Error} The Windows SubSystem system process terminated unexpectedly with a status of 0xc0000005. The system has been shut down.
-
-Use the System File Checker tool to repair missing or corrupted system files. The System File Checker lets users scan for corruptions in Windows system files and restore corrupted files. For more information, see [Use the System File Checker tool](https://support.microsoft.com/topic/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system-files-79aa86cb-ca52-166a-92a3-966e85d4094e).
-
-### NTFS_FILE_SYSTEM
-
-Stop error code 0x000000024
-
-This stop error is commonly caused by corruption in the NTFS file system or bad blocks (sectors) on the hard disk. Corrupted drivers for hard disks (SATA or IDE) can also adversely affect the system's ability to read and write to disk. Run any hardware diagnostics that are provided by the manufacturer of the storage subsystem. Use the scan disk tool to verify that there are no file system errors. To do this step, right-click the drive that you want to scan, select Properties, select Tools, and then select the Check now button. Update the NTFS file system driver (Ntfs.sys). Apply the latest cumulative updates for the current operating system that's experiencing the problem.
-
-### KMODE_EXCEPTION_NOT_HANDLED
-
-Stop error code 0x0000001E
-
-If a driver is identified in the stop error message, disable or remove that driver. Disable or remove any drivers or services that were recently added.
-
-If the error occurs during the startup sequence, and the system partition is formatted by using the NTFS file system, you might be able to use safe mode to disable the driver in Device Manager. To disable the driver, follow these steps:
-
-1. Go to **Settings > Update & security > Recovery**.
-1. Under **Advanced startup**, select **Restart now**.
-1. After your PC restarts to the **Choose an option** screen, select **Troubleshoot > Advanced options > Startup Settings > Restart**.
-1. After the computer restarts, you'll see a list of options. Press **4** or **F4** to start the computer in safe mode. If you intend to use the internet while in safe mode, press **5** or **F5** for the **Safe Mode with Networking** option.
-
-### DPC_WATCHDOG_VIOLATION
-
-Stop error code 0x00000133
-
-This stop error code is caused by a faulty driver that doesn't complete its work within the allotted time frame in certain conditions. To help mitigate this error, collect the memory dump file from the system, and then use the Windows Debugger to find the faulty driver. If a driver is identified in the stop error message, disable the driver to isolate the problem. Check with the manufacturer for driver updates. Check the system log in Event Viewer for other error messages that might help identify the device or driver that's causing stop error 0x133. Verify that any new hardware that's installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications. If Windows Debugger is installed, and you have access to public symbols, you can load the `c:\windows\memory.dmp` file into the debugger. Then refer to [Determining the source of Bug Check 0x133 (DPC_WATCHDOG_VIOLATION) errors on Windows Server 2012](/archive/blogs/ntdebugging/determining-the-source-of-bug-check-0x133-dpc_watchdog_violation-errors-on-windows-server-2012) to find the problematic driver from the memory dump.
-
-### USER_MODE_HEALTH_MONITOR
-
-Stop error code 0x0000009E
-
-This stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.
-
-This stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe. Check the event logs for any storage failures to identify the failing process. Try to update the component or process that's indicated in the event logs. You should see the following event recorded:
-
-- Event ID: 4870
-- Source: Microsoft-Windows-FailoverClustering
-- Description: User mode health monitoring has detected that the system isn't being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID '%1', for '%2' seconds. Recovery action is taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang.
-
-For more information, see ["0x0000009E" Stop error on cluster nodes in a Windows Server-based multi-node failover cluster environment](https://support.microsoft.com/topic/-0x0000009e-stop-error-on-cluster-nodes-in-a-windows-server-based-multi-node-failover-cluster-environment-7e0acceb-b498-47f8-e004-96de6e497cba) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw).
-
-## Debugging examples
-
-### Example 1
-
-This bug check is caused by a driver hang during upgrade, resulting in a bug check D1 in NDIS.sys, which is a Microsoft driver. The **IMAGE_NAME** tells you the faulting driver, but since this driver is s Microsoft driver, it can't be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again.
-
-```console
-2: kd> !analyze -v
-*******************************************************************************
-* *
-* Bugcheck Analysis *
-* *
-*******************************************************************************
-
-DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
-An attempt was made to access a pageable (or completely invalid) address at an
-interrupt request level (IRQL) that is too high. This is usually
-caused by drivers using improper addresses.
-If kernel debugger is available get stack backtrace.
-Arguments:
-Arg1: 000000000011092a, memory referenced
-Arg2: 0000000000000002, IRQL
-Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
-Arg4: fffff807aa74f4c4, address which referenced memory
-Debugging Details:
-------------------
-
-KEY_VALUES_STRING: 1
-STACKHASH_ANALYSIS: 1
-TIMELINE_ANALYSIS: 1
-DUMP_CLASS: 1
-DUMP_QUALIFIER: 400
-SIMULTANEOUS_TELSVC_INSTANCES: 0
-SIMULTANEOUS_TELWP_INSTANCES: 0
-BUILD_VERSION_STRING: 16299.15.amd64fre.rs3_release.170928-1534
-SYSTEM_MANUFACTURER: Alienware
-SYSTEM_PRODUCT_NAME: Alienware 15 R2
-SYSTEM_SKU: Alienware 15 R2
-SYSTEM_VERSION: 1.2.8
-BIOS_VENDOR: Alienware
-BIOS_VERSION: 1.2.8
-BIOS_DATE: 01/29/2016
-BASEBOARD_MANUFACTURER: Alienware
-BASEBOARD_PRODUCT: Alienware 15 R2
-BASEBOARD_VERSION: A00
-DUMP_TYPE: 2
-BUGCHECK_P1: 11092a
-BUGCHECK_P2: 2
-BUGCHECK_P3: 1
-BUGCHECK_P4: fffff807aa74f4c4
-WRITE_ADDRESS: fffff80060602380: Unable to get MiVisibleState
-Unable to get NonPagedPoolStart
-Unable to get NonPagedPoolEnd
-Unable to get PagedPoolStart
-Unable to get PagedPoolEnd
-000000000011092a
-CURRENT_IRQL: 2
-FAULTING_IP:
-NDIS!NdisQueueIoWorkItem+4 [minio\ndis\sys\miniport.c @ 9708]
-fffff807`aa74f4c4 48895120 mov qword ptr [rcx+20h],rdx
-CPU_COUNT: 8
-CPU_MHZ: a20
-CPU_VENDOR: GenuineIntel
-CPU_FAMILY: 6
-CPU_MODEL: 5e
-CPU_STEPPING: 3
-CPU_MICROCODE: 6,5e,3,0 (F,M,S,R) SIG: BA'00000000 (cache) BA'00000000 (init)
-BLACKBOXPNP: 1 (!blackboxpnp)
-DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
-BUGCHECK_STR: AV
-PROCESS_NAME: System
-ANALYSIS_SESSION_HOST: SHENDRIX-DEV0
-ANALYSIS_SESSION_TIME: 01-17-2019 11:06:05.0653
-ANALYSIS_VERSION: 10.0.18248.1001 amd64fre
-TRAP_FRAME: ffffa884c0c3f6b0 -- (.trap 0xffffa884c0c3f6b0)
-NOTE: The trap frame doesn't contain all registers.
-Some register values may be zeroed or incorrect.
-rax=fffff807ad018bf0 rbx=0000000000000000 rcx=000000000011090a
-rdx=fffff807ad018c10 rsi=0000000000000000 rdi=0000000000000000
-rip=fffff807aa74f4c4 rsp=ffffa884c0c3f840 rbp=000000002408fd00
-r8=ffffb30e0e99ea30 r9=0000000001d371c1 r10=0000000020000080
-r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
-r14=0000000000000000 r15=0000000000000000
-iopl=0 nv up ei ng nz na pe nc
-NDIS!NdisQueueIoWorkItem+0x4:
-fffff807`aa74f4c4 48895120 mov qword ptr [rcx+20h],rdx ds:00000000`0011092a=????????????????
-Resetting default scope
-
-LAST_CONTROL_TRANSFER: from fffff800603799e9 to fffff8006036e0e0
-
-STACK_TEXT:
-ffffa884`c0c3f568 fffff800`603799e9 : 00000000`0000000a 00000000`0011092a 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx [minkernel\ntos\ke\amd64\procstat.asm @ 134]
-ffffa884`c0c3f570 fffff800`60377d7d : fffff78a`4000a150 ffffb30e`03fba001 ffff8180`f0b5d180 00000000`000000ff : nt!KiBugCheckDispatch+0x69 [minkernel\ntos\ke\amd64\trap.asm @ 2998]
-ffffa884`c0c3f6b0 fffff807`aa74f4c4 : 00000000`00000002 ffff8180`f0754180 00000000`00269fb1 ffff8180`f0754180 : nt!KiPageFault+0x23d [minkernel\ntos\ke\amd64\trap.asm @ 1248]
-ffffa884`c0c3f840 fffff800`60256b63 : ffffb30e`0e18f710 ffff8180`f0754180 ffffa884`c0c3fa18 00000000`00000002 : NDIS!NdisQueueIoWorkItem+0x4 [minio\ndis\sys\miniport.c @ 9708]
-ffffa884`c0c3f870 fffff800`60257bfd : 00000000`00000008 00000000`00000000 00000000`00269fb1 ffff8180`f0754180 : nt!KiProcessExpiredTimerList+0x153 [minkernel\ntos\ke\dpcsup.c @ 2078]
-ffffa884`c0c3f960 fffff800`6037123a : 00000000`00000000 ffff8180`f0754180 00000000`00000000 ffff8180`f0760cc0 : nt!KiRetireDpcList+0x43d [minkernel\ntos\ke\dpcsup.c @ 1512]
-ffffa884`c0c3fb60 00000000`00000000 : ffffa884`c0c40000 ffffa884`c0c39000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x5a [minkernel\ntos\ke\amd64\idle.asm @ 166]
-
-RETRACER_ANALYSIS_TAG_STATUS: Failed in getting KPCR for core 2
-THREAD_SHA1_HASH_MOD_FUNC: 5b59a784f22d4b5cbd5a8452fe39914b8fd7961d
-THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 5643383f9cae3ca39073f7721b53f0c633bfb948
-THREAD_SHA1_HASH_MOD: 20edda059578820e64b723e466deea47f59bd675
-FOLLOWUP_IP:
-NDIS!NdisQueueIoWorkItem+4 [minio\ndis\sys\miniport.c @ 9708]
-fffff807`aa74f4c4 48895120 mov qword ptr [rcx+20h],rdx
-FAULT_INSTR_CODE: 20518948
-FAULTING_SOURCE_LINE: minio\ndis\sys\miniport.c
-FAULTING_SOURCE_FILE: minio\ndis\sys\miniport.c
-FAULTING_SOURCE_LINE_NUMBER: 9708
-FAULTING_SOURCE_CODE:
- 9704: _In_ _Points_to_data_ PVOID WorkItemContext
- 9705: )
- 9706: {
- 9707:
-> 9708: ((PNDIS_IO_WORK_ITEM)NdisIoWorkItemHandle)->Routine = Routine;
- 9709: ((PNDIS_IO_WORK_ITEM)NdisIoWorkItemHandle)->WorkItemContext = WorkItemContext;
- 9710:
- 9711: IoQueueWorkItem(((PNDIS_IO_WORK_ITEM)NdisIoWorkItemHandle)->IoWorkItem,
- 9712: ndisDispatchIoWorkItem,
- 9713: CriticalWorkQueue,
-
-SYMBOL_STACK_INDEX: 3
-SYMBOL_NAME: NDIS!NdisQueueIoWorkItem+4
-FOLLOWUP_NAME: ndiscore
-MODULE_NAME: NDIS
-IMAGE_NAME: NDIS.SYS
-DEBUG_FLR_IMAGE_TIMESTAMP: 0
-IMAGE_VERSION: 10.0.16299.99
-DXGANALYZE_ANALYSIS_TAG_PORT_GLOBAL_INFO_STR: Hybrid_FALSE
-DXGANALYZE_ANALYSIS_TAG_ADAPTER_INFO_STR: GPU0_VenId0x1414_DevId0x8d_WDDM1.3_Active;
-STACK_COMMAND: .thread ; .cxr ; kb
-BUCKET_ID_FUNC_OFFSET: 4
-FAILURE_BUCKET_ID: AV_NDIS!NdisQueueIoWorkItem
-BUCKET_ID: AV_NDIS!NdisQueueIoWorkItem
-PRIMARY_PROBLEM_CLASS: AV_NDIS!NdisQueueIoWorkItem
-TARGET_TIME: 2017-12-10T14:16:08.000Z
-OSBUILD: 16299
-OSSERVICEPACK: 98
-SERVICEPACK_NUMBER: 0
-OS_REVISION: 0
-SUITE_MASK: 784
-PRODUCT_TYPE: 1
-OSPLATFORM_TYPE: x64
-OSNAME: Windows 10
-OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
-OS_LOCALE:
-USER_LCID: 0
-OSBUILD_TIMESTAMP: 2017-11-26 03:49:20
-BUILDDATESTAMP_STR: 170928-1534
-BUILDLAB_STR: rs3_release
-BUILDOSVER_STR: 10.0.16299.15.amd64fre.rs3_release.170928-1534
-ANALYSIS_SESSION_ELAPSED_TIME: 8377
-ANALYSIS_SOURCE: KM
-FAILURE_ID_HASH_STRING: km:av_ndis!ndisqueueioworkitem
-FAILURE_ID_HASH: {10686423-afa1-4852-ad1b-9324ac44ac96}
-FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96
-Followup: ndiscore
----------
-```
-
-### Example 2
-
-In this example, a non-Microsoft driver caused page fault, so we don't have symbols for this driver. However, looking at **IMAGE_NAME** and or **MODULE_NAME** indicates it's **WwanUsbMP.sys** that caused the issue. Disconnecting the device and retrying the upgrade is a possible solution.
-
-```console
-1: kd> !analyze -v
-*******************************************************************************
-* *
-* Bugcheck Analysis *
-* *
-*******************************************************************************
-
-PAGE_FAULT_IN_NONPAGED_AREA (50)
-Invalid system memory was referenced. This can't be protected by try-except.
-Typically the address is just plain bad or it is pointing at freed memory.
-Arguments:
-Arg1: 8ba10000, memory referenced.
-Arg2: 00000000, value 0 = read operation, 1 = write operation.
-Arg3: 82154573, If non-zero, the instruction address which referenced the bad memory
- address.
-Arg4: 00000000, (reserved)
-
-Debugging Details:
-------------------
-
-*** WARNING: Unable to verify timestamp for WwanUsbMp.sys
-*** ERROR: Module load completed but symbols could not be loaded for WwanUsbMp.sys
-
-KEY_VALUES_STRING: 1
-STACKHASH_ANALYSIS: 1
-TIMELINE_ANALYSIS: 1
-DUMP_CLASS: 1
-DUMP_QUALIFIER: 400
-BUILD_VERSION_STRING: 16299.15.x86fre.rs3_release.170928-1534
-MARKER_MODULE_NAME: IBM_ibmpmdrv
-SYSTEM_MANUFACTURER: LENOVO
-SYSTEM_PRODUCT_NAME: 20AWS07H00
-SYSTEM_SKU: LENOVO_MT_20AW_BU_Think_FM_ThinkPad T440p
-SYSTEM_VERSION: ThinkPad T440p
-BIOS_VENDOR: LENOVO
-BIOS_VERSION: GLET85WW (2.39 )
-BIOS_DATE: 09/29/2016
-BASEBOARD_MANUFACTURER: LENOVO
-BASEBOARD_PRODUCT: 20AWS07H00
-BASEBOARD_VERSION: Not Defined
-DUMP_TYPE: 2
-BUGCHECK_P1: ffffffff8ba10000
-BUGCHECK_P2: 0
-BUGCHECK_P3: ffffffff82154573
-BUGCHECK_P4: 0
-READ_ADDRESS: 822821d0: Unable to get MiVisibleState
-8ba10000
-FAULTING_IP:
-nt!memcpy+33 [minkernel\crts\crtw32\string\i386\memcpy.asm @ 213
-82154573 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
-MM_INTERNAL_CODE: 0
-CPU_COUNT: 4
-CPU_MHZ: 95a
-CPU_VENDOR: GenuineIntel
-CPU_FAMILY: 6
-CPU_MODEL: 3c
-CPU_STEPPING: 3
-CPU_MICROCODE: 6,3c,3,0 (F,M,S,R) SIG: 21'00000000 (cache) 21'00000000 (init)
-BLACKBOXBSD: 1 (!blackboxbsd)
-BLACKBOXPNP: 1 (!blackboxpnp)
-DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
-BUGCHECK_STR: AV
-PROCESS_NAME: System
-CURRENT_IRQL: 2
-ANALYSIS_SESSION_HOST: SHENDRIX-DEV0
-ANALYSIS_SESSION_TIME: 01-17-2019 10:54:53.0780
-ANALYSIS_VERSION: 10.0.18248.1001 amd64fre
-TRAP_FRAME: 8ba0efa8 -- (.trap 0xffffffff8ba0efa8)
-ErrCode = 00000000
-eax=8ba1759e ebx=a2bfd314 ecx=00001d67 edx=00000002 esi=8ba10000 edi=a2bfe280
-eip=82154573 esp=8ba0f01c ebp=8ba0f024 iopl=0 nv up ei pl nz ac pe nc
-cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010216
-nt!memcpy+0x33:
-82154573 f3a5 rep movs dword ptr es:[edi],dword ptr [esi]
-Resetting default scope
-LOCK_ADDRESS: 8226c6e0 -- (!locks 8226c6e0)
-Cannot get _ERESOURCE type
-Resource @ nt!PiEngineLock (0x8226c6e0) Available
-1 total locks
-PNP_TRIAGE_DATA:
- Lock address : 0x8226c6e0
- Thread Count : 0
- Thread address: 0x00000000
- Thread wait : 0x0
-
-LAST_CONTROL_TRANSFER: from 82076708 to 821507e8
-
-STACK_TEXT:
-8ba0ede4 82076708 00000050 8ba10000 00000000 nt!KeBugCheckEx [minkernel\ntos\ke\i386\procstat.asm @ 114]
-8ba0ee40 8207771e 8ba0efa8 8ba10000 8ba0eea0 nt!MiSystemFault+0x13c8 [minkernel\ntos\mm\mmfault.c @ 4755]
-8ba0ef08 821652ac 00000000 8ba10000 00000000 nt!MmAccessFault+0x83e [minkernel\ntos\mm\mmfault.c @ 6868]
-8ba0ef08 82154573 00000000 8ba10000 00000000 nt!_KiTrap0E+0xec [minkernel\ntos\ke\i386\trap.asm @ 5153]
-8ba0f024 86692866 a2bfd314 8ba0f094 0000850a nt!memcpy+0x33 [minkernel\crts\crtw32\string\i386\memcpy.asm @ 213]
-8ba0f040 866961bc 8ba0f19c a2bfd0e8 00000000 NDIS!ndisMSetPowerManagementCapabilities+0x8a [minio\ndis\sys\miniport.c @ 7969]
-8ba0f060 866e1f66 866e1caf adfb9000 00000000 NDIS!ndisMSetGeneralAttributes+0x23d [minio\ndis\sys\miniport.c @ 8198]
-8ba0f078 ac50c15f a2bfd0e8 0000009f 00000001 NDIS!NdisMSetMiniportAttributes+0x2b7 [minio\ndis\sys\miniport.c @ 7184]
-WARNING: Stack unwind information not available. Following frames may be wrong.
-8ba0f270 ac526f96 adfb9000 a2bfd0e8 8269b9b0 WwanUsbMp+0x1c15f
-8ba0f3cc 866e368a a2bfd0e8 00000000 8ba0f4c0 WwanUsbMp+0x36f96
-8ba0f410 867004b0 a2bfd0e8 a2bfd0e8 a2be2a70 NDIS!ndisMInvokeInitialize+0x60 [minio\ndis\sys\miniport.c @ 13834]
-8ba0f7ac 866dbc8e a2acf730 866b807c 00000000 NDIS!ndisMInitializeAdapter+0xa23 [minio\ndis\sys\miniport.c @ 601]
-8ba0f7d8 866e687d a2bfd0e8 00000000 00000000 NDIS!ndisInitializeAdapter+0x4c [minio\ndis\sys\initpnp.c @ 931]
-8ba0f800 866e90bb adfb64d8 00000000 a2bfd0e8 NDIS!ndisPnPStartDevice+0x118 [minio\ndis\sys\configm.c @ 4235]
-8ba0f820 866e8a58 adfb64d8 a2bfd0e8 00000000 NDIS!ndisStartDeviceSynchronous+0xbd [minio\ndis\sys\ndispnp.c @ 3096]
-8ba0f838 866e81df adfb64d8 8ba0f85e 8ba0f85f NDIS!ndisPnPIrpStartDevice+0xb4 [minio\ndis\sys\ndispnp.c @ 1067]
-8ba0f860 820a7e98 a2bfd030 adfb64d8 8ba0f910 NDIS!ndisPnPDispatch+0x108 [minio\ndis\sys\ndispnp.c @ 2429]
-8ba0f878 8231f07e 8ba0f8ec adf5d4c8 872e2eb8 nt!IofCallDriver+0x48 [minkernel\ntos\io\iomgr\iosubs.c @ 3149]
-8ba0f898 820b8569 820c92b8 872e2eb8 8ba0f910 nt!PnpAsynchronousCall+0x9e [minkernel\ntos\io\pnpmgr\irp.c @ 3005]
-8ba0f8cc 820c9a76 00000000 820c92b8 872e2eb8 nt!PnpSendIrp+0x67 [minkernel\ntos\io\pnpmgr\irp.h @ 286]
-8ba0f914 8234577b 872e2eb8 adf638b0 adf638b0 nt!PnpStartDevice+0x60 [minkernel\ntos\io\pnpmgr\irp.c @ 3187]
-8ba0f94c 82346cc7 872e2eb8 adf638b0 adf638b0 nt!PnpStartDeviceNode+0xc3 [minkernel\ntos\io\pnpmgr\start.c @ 1712]
-8ba0f96c 82343c68 00000000 a2bdb3d8 adf638b0 nt!PipProcessStartPhase1+0x4d [minkernel\ntos\io\pnpmgr\start.c @ 114]
-8ba0fb5c 824db885 8ba0fb80 00000000 00000000 nt!PipProcessDevNodeTree+0x386 [minkernel\ntos\io\pnpmgr\enum.c @ 6129]
-8ba0fb88 8219571b 85852520 8c601040 8226ba90 nt!PiRestartDevice+0x91 [minkernel\ntos\io\pnpmgr\enum.c @ 4743]
-8ba0fbe8 820804af 00000000 00000000 8c601040 nt!PnpDeviceActionWorker+0xdb4b7 [minkernel\ntos\io\pnpmgr\action.c @ 674]
-8ba0fc38 8211485c 85852520 421de295 00000000 nt!ExpWorkerThread+0xcf [minkernel\ntos\ex\worker.c @ 4270]
-8ba0fc70 82166785 820803e0 85852520 00000000 nt!PspSystemThreadStartup+0x4a [minkernel\ntos\ps\psexec.c @ 7756]
-8ba0fc88 82051e07 85943940 8ba0fcd8 82051bb9 nt!KiThreadStartup+0x15 [minkernel\ntos\ke\i386\threadbg.asm @ 82]
-8ba0fc94 82051bb9 8b9cc600 8ba10000 8ba0d000 nt!KiProcessDeferredReadyList+0x17 [minkernel\ntos\ke\thredsup.c @ 5309]
-8ba0fcd8 00000000 00000000 00000000 00000000 nt!KeSetPriorityThread+0x249 [minkernel\ntos\ke\thredobj.c @ 3881]
-
-
-RETRACER_ANALYSIS_TAG_STATUS: Failed in getting KPCR for core 1
-THREAD_SHA1_HASH_MOD_FUNC: e029276c66aea80ba36903e89947127118d31128
-THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 012389f065d31c8eedd6204846a560146a38099b
-THREAD_SHA1_HASH_MOD: 44dc639eb162a28d47eaeeae4afe6f9eeccced3d
-FOLLOWUP_IP:
-WwanUsbMp+1c15f
-ac50c15f 8bf0 mov esi,eax
-FAULT_INSTR_CODE: f33bf08b
-SYMBOL_STACK_INDEX: 8
-SYMBOL_NAME: WwanUsbMp+1c15f
-FOLLOWUP_NAME: MachineOwner
-MODULE_NAME: WwanUsbMp
-IMAGE_NAME: WwanUsbMp.sys
-DEBUG_FLR_IMAGE_TIMESTAMP: 5211bb0c
-DXGANALYZE_ANALYSIS_TAG_PORT_GLOBAL_INFO_STR: Hybrid_FALSE
-DXGANALYZE_ANALYSIS_TAG_ADAPTER_INFO_STR: GPU0_VenId0x1414_DevId0x8d_WDDM1.3_NotActive;GPU1_VenId0x8086_DevId0x416_WDDM1.3_Active_Post;
-STACK_COMMAND: .thread ; .cxr ; kb
-BUCKET_ID_FUNC_OFFSET: 1c15f
-FAILURE_BUCKET_ID: AV_R_INVALID_WwanUsbMp!unknown_function
-BUCKET_ID: AV_R_INVALID_WwanUsbMp!unknown_function
-PRIMARY_PROBLEM_CLASS: AV_R_INVALID_WwanUsbMp!unknown_function
-TARGET_TIME: 2018-02-12T11:33:51.000Z
-OSBUILD: 16299
-OSSERVICEPACK: 15
-SERVICEPACK_NUMBER: 0
-OS_REVISION: 0
-SUITE_MASK: 272
-PRODUCT_TYPE: 1
-OSPLATFORM_TYPE: x86
-OSNAME: Windows 10
-OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
-OS_LOCALE:
-USER_LCID: 0
-OSBUILD_TIMESTAMP: 2017-09-28 18:32:28
-BUILDDATESTAMP_STR: 170928-1534
-BUILDLAB_STR: rs3_release
-BUILDOSVER_STR: 10.0.16299.15.x86fre.rs3_release.170928-1534
-ANALYSIS_SESSION_ELAPSED_TIME: 162bd
-ANALYSIS_SOURCE: KM
-FAILURE_ID_HASH_STRING: km:av_r_invalid_wwanusbmp!unknown_function
-FAILURE_ID_HASH: {31e4d053-0758-e43a-06a7-55f69b072cb3}
-FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3
-
-Followup: MachineOwner
----------
-
-ReadVirtual: 812d1248 not properly sign extended
-```
-
-## References
-
-[Bug check code reference](/windows-hardware/drivers/debugger/bug-check-code-reference2)
diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md
deleted file mode 100644
index a04d75d606..0000000000
--- a/windows/client-management/troubleshoot-tcpip-connectivity.md
+++ /dev/null
@@ -1,117 +0,0 @@
----
-title: Troubleshoot TCP/IP connectivity
-description: Learn how to troubleshoot TCP/IP connectivity and what you should do if you come across TCP reset in a network capture.
-ms.prod: w10
-ms.topic: troubleshooting
-author: dansimp
-ms.localizationpriority: medium
-ms.author: dansimp
-ms.date: 12/06/2018
-ms.reviewer:
-manager: dansimp
-ms.collection: highpri
----
-
-# Troubleshoot TCP/IP connectivity
-
-You might come across connectivity errors on the application end or timeout errors. The following are the most common scenarios:
-- Application connectivity to a database server
-- SQL timeout errors
-- BizTalk application timeout errors
-- Remote Desktop Protocol (RDP) failures
-- File share access failures
-- General connectivity
-
-When you suspect that the issue is on the network, you collect a network trace. The network trace would then be filtered. During troubleshooting connectivity errors, you might come across TCP reset in a network capture that could indicate a network issue.
-
-* TCP is defined as connection-oriented and reliable protocol. One of the ways in which TCP ensures reliability is through the handshake process. Establishing a TCP session would begin with a three-way handshake, followed by data transfer, and then a four-way closure. The four-way closure where both sender and receiver agree on closing the session is termed as *graceful closure*. After the four-way closure, the server will allow 4 minutes of time (default), during which any pending packets on the network are to be processed, this period is the TIME_WAIT state. After the TIME_WAIT state completes, all the resources allocated for this connection are released.
-
-* TCP reset is an abrupt closure of the session; it causes the resources allocated to the connection to be immediately released and all other information about the connection is erased.
-
-* TCP reset is identified by the RESET flag in the TCP header set to `1`.
-
-A network trace on the source and the destination helps you to determine the flow of the traffic and see at what point the failure is observed.
-
-The following sections describe some of the scenarios when you'll see a RESET.
-
-## Packet drops
-
-When one TCP peer is sending out TCP packets for which there's no response received from the other end, the TCP peer would end up retransmitting the data and when there's no response received, it would end the session by sending an ACK RESET (thisACK RESET means that the application acknowledges whatever data is exchanged so far, but because of packet drop, the connection is closed).
-
-The simultaneous network traces on source and destination will help you verify this behavior where on the source side you would see the packets being retransmitted and on the destination none of these packets are seen. This scenario denotes that the network device between the source and destination is dropping the packets.
-
-If the initial TCP handshake is failing because of packet drops, then you would see that the TCP SYN packet is retransmitted only three times.
-
-Source side connecting on port 445:
-
-
-
-Destination side: applying the same filter, you don't see any packets.
-
-
-
-For the rest of the data, TCP will retransmit the packets five times.
-
-**Source 192.168.1.62 side trace:**
-
-
-
-**Destination 192.168.1.2 side trace:**
-
-You wouldn't see any of the above packets. Engage your network team to investigate with the different hops and see if any of them are potentially causing drops in the network.
-
-If you're seeing that the SYN packets are reaching the destination, but the destination is still not responding, then verify if the port that you're trying to connect to is in the listening state. (Netstat output will help). If the port is listening and still there's no response, then there could be a wfp drop.
-
-## Incorrect parameter in the TCP header
-
-You see this behavior when the packets are modified in the network by middle devices and TCP on the receiving end is unable to accept the packet, such as the sequence number being modified, or packets being replayed by middle device by changing the sequence number. Again, the simultaneous network trace on the source and destination will be able to tell you if any of the TCP headers are modified. Start by comparing the source trace and destination trace, you'll be able to notice if there's a change in the packets itself or if any new packets are reaching the destination on behalf of the source.
-
-In this case, you'll again need help from the network team to identify any device that's modifying packets or replaying packets to the destination. The most common ones are RiverBed devices or WAN accelerators.
-
-
-## Application side reset
-
-When you've identified that the resets aren't due to retransmits or incorrect parameter or packets being modified with the help of network trace, then you've narrowed it down to application level reset.
-
-The application resets are the ones where you see the Acknowledgment flag set to `1` along with the reset flag. This setting would mean that the server is acknowledging the receipt of the packet but for some reason it will not accept the connection. This stage is when the application that received the packet didn't like something it received.
-
-In the below screenshots, you see that the packets seen on the source and the destination are the same without any modification or any drops, but you see an explicit reset sent by the destination to the source.
-
-**Source Side**
-
-
-
-**On the destination-side trace**
-
-
-
-You also see an ACK+RST flag packet in a case when the TCP establishment packet SYN is sent out. The TCP SYN packet is sent when the client wants to connect on a particular port, but if the destination/server for some reason doesn't want to accept the packet, it would send an ACK+RST packet.
-
-
-
-The application that's causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection.
-
->[!Note]
->The above information is about resets from a TCP standpoint and not UDP. UDP is a connectionless protocol and the packets are sent unreliably. You wouldn't see retransmission or resets when using UDP as a transport protocol. However, UDP makes use of ICMP as a error reporting protocol. When you've the UDP packet sent out on a port and the destination does not have port listed, you'll see the destination sending out **ICMP Destination host unreachable: Port unreachable** message immediately after the UDP packet
-
-
-```
-10.10.10.1 10.10.10.2 UDP UDP:SrcPort=49875,DstPort=3343
-
-10.10.10.2 10.10.10.1 ICMP ICMP:Destination Unreachable Message, Port Unreachable,10.10.10.2:3343
-```
-
-
-During the troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but doesn't respond to. In such cases, there could be a drop at the server level. To understand whether the local firewall is dropping the packet, enable the firewall auditing on the machine.
-
-```
-auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
-```
-
-You can then review the Security event logs to see for a packet drop on a particular port-IP and a filter ID associated with it.
-
-
-
-Now, run the command `netsh wfp show state`, this execution will generate a wfpstate.xml file. After you open this file and filter for the ID that you find in the above event (2944008), you'll be able to see a firewall rule name that's associated with this ID that's blocking the connection.
-
-
diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md
deleted file mode 100644
index 18eff7c2dd..0000000000
--- a/windows/client-management/troubleshoot-tcpip-netmon.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-title: Collect data using Network Monitor
-description: Learn how to run Network Monitor to collect data for troubleshooting TCP/IP connectivity.
-ms.prod: w10
-ms.topic: troubleshooting
-author: dansimp
-ms.localizationpriority: medium
-ms.author: dansimp
-ms.date: 01/27/2022
-ms.reviewer:
-manager: dansimp
-ms.collection: highpri
----
-
-# Collect data using Network Monitor
-
-In this article, you'll learn how to use Microsoft Network Monitor 3.4, which is a tool for capturing network traffic.
-
-> [!NOTE]
-> Network Monitor is the archived protocol analyzer and is no longer under development. Also, Microsoft Message Analyzer (MMA) was retired and its download packages were removed from microsoft.com sites on November 25, 2019. There is currently no Microsoft replacement for Microsoft Message Analyzer in development at this time. For similar functionality, consider using another, non-Microsoft network protocol analyzer tool. For more information, see [Microsoft Message Analyzer Operating Guide](/message-analyzer/microsoft-message-analyzer-operating-guide).
-
-To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image:
-
-
-
-When the driver gets hooked to the network interface card (NIC) during installation, the NIC is reinitialized, which might cause a brief network glitch.
-
-**To capture traffic**
-
-1. Run netmon in an elevated status by choosing **Run as Administrator**.
-
- 
-
-2. Network Monitor opens with all network adapters displayed. Select the network adapters where you want to capture traffic, click **New Capture**, and then select **Start**.
-
- 
-
-3. Reproduce the issue, and you'll see that Network Monitor grabs the packets on the wire.
-
- 
-
-4. Select **Stop**, and go to **File > Save as** to save the results. By default, the file will be saved as a ".cap" file.
-
-The saved file has captured all the traffic that is flowing to and from the selected network adapters on the local computer. However, your interest is only to look into the traffic/packets that are related to the specific connectivity problem you're facing. So you'll need to filter the network capture to see only the related traffic.
-
-**Commonly used filters**
-
-- Ipv4.address=="client ip" and ipv4.address=="server ip"
-- Tcp.port==
-- Udp.port==
-- Icmp
-- Arp
-- Property.tcpretranmits
-- Property.tcprequestfastretransmits
-- Tcp.flags.syn==1
-
->[!TIP]
->If you want to filter the capture for a specific field and do not know the syntax for that filter, just right-click that field and select **Add *the selected value* to Display Filter**.
-
-Network traces that are collected using the **netsh** commands built in to Windows are of the extension "ETL". However, these ETL files can be opened using Network Monitor for further analysis.
-
-## More information
-
-[Intro to Filtering with Network Monitor 3.0](/archive/blogs/netmon/intro-to-filtering-with-network-monitor-3-0) Try our Virtual Agent - It can help you quickly identify and fix common Windows boot issues
-
-In these topics, you will learn how to troubleshoot common problems that are related to Windows startup.
-
-## How it works
-
-When Microsoft Windows experiences a condition that compromises safe system operation, the system halts. These Windows startup problems are categorized in the following groups:
-
-- Bug check: Also commonly known as a system crash, a kernel error, or a Stop error.
-
-- No boot: The system may not produce a bug check but is unable to start up into Windows.
-
-- Freeze: Also known as "system hang".
-
-## Best practices
-
-To understand the underlying cause of Windows startup problems, it's important that the system be configured correctly. Here are some best practices for configuration:
-
-### Page file settings
-
-- [Introduction of page file](introduction-page-file.md)
-
-- [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md)
-
-### Memory dump settings
-
-- [Configure system failure and recovery options in Windows](system-failure-recovery-options.md)
-
-- [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md)
-
-## Troubleshooting
-
-These articles will walk you through the resources you need to troubleshoot Windows startup issues:
-
-- [Advanced troubleshooting for Windows boot problems](./advanced-troubleshooting-boot-problems.md)
-
-- [Advanced troubleshooting for Stop error or blue screen error](./troubleshoot-stop-errors.md)
-
-- [Advanced troubleshooting for Windows-based computer freeze issues](./troubleshoot-windows-freeze.md)
-
-- [Stop error occurs when you update the in-box Broadcom network adapter driver](troubleshoot-stop-error-on-broadcom-driver-update.md)
\ No newline at end of file
diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md
deleted file mode 100644
index 6dd2f0b24a..0000000000
--- a/windows/client-management/windows-10-support-solutions.md
+++ /dev/null
@@ -1,132 +0,0 @@
----
-title: Windows 10 support solutions
-description: Learn where to find information about troubleshooting Windows 10 issues, for example BitLocker issues and bugcheck errors.
-ms.reviewer: kaushika
-manager: aaroncz
-ms.prod: w10
-ms.author: vinpa
-author: vinaypamnani-msft
-ms.localizationpriority: medium
-ms.topic: troubleshooting
----
-
-# Windows 10 support solutions
-
-Microsoft regularly releases both updates for Windows Server. To ensure your servers can receive future updates, including security updates, it's important to keep your servers updated. Check out - [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/en-us/help/4000825/windows-10-windows-server-2016-update-history) for a complete list of released updates.
-
-This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 in an enterprise or IT pro environment. More topics will be added as they become available.
-
-## Troubleshoot 802.1x Authentication
-- [Advanced Troubleshooting 802.1X Authentication](./advanced-troubleshooting-802-authentication.md)
-- [Data collection for troubleshooting 802.1X authentication](./data-collection-for-802-authentication.md)
-
-## Troubleshoot BitLocker
-- [Guidelines for troubleshooting BitLocker](/windows/security/information-protection/bitlocker/troubleshoot-bitlocker)
-- [BitLocker can't encrypt a drive: known issues](/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues)
-- [Enforcing BitLocker policies by using Intune: known issues](/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues)
-- [BitLocker Network Unlock: known issues](/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues)
-- [BitLocker recovery: known issues](/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues)
-- [BitLocker configuration: known issues](/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues)
-- [BitLocker can't encrypt a drive: known TPM issues](/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues)
-- [BitLocker and TPM: other known issues](/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues)
-- [Decode Measured Boot logs to track PCR changes](/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs)
-- [BitLocker frequently asked questions (FAQ)](/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions)
-
-## Troubleshoot Bugcheck and Stop errors
-- [Introduction to the page file](./introduction-page-file.md)
-- [How to determine the appropriate page file size for 64-bit versions of Windows](./determine-appropriate-page-file-size.md)
-- [Configure system failure and recovery options in Windows](./system-failure-recovery-options.md)
-- [Generate a kernel or complete crash dump](./generate-kernel-or-complete-crash-dump.md)
-- [Advanced troubleshooting for Stop error or blue screen error issue](./troubleshoot-stop-errors.md)
-- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](./troubleshoot-inaccessible-boot-device.md)
-- [Blue Screen Data - Windows drivers](/windows-hardware/drivers/debugger/blue-screen-data)
-- [Bug Check Code Reference - Windows drivers](/windows-hardware/drivers/debugger/bug-check-code-reference2)
-
-## Troubleshoot Credential Guard
-- [Windows Defender Credential Guard - Known issues (Windows 10)](/windows/security/identity-protection/credential-guard/credential-guard-known-issues)
-
-## Troubleshoot Disks
-- [MBR2GPT](/windows/deployment/mbr-to-gpt)
-- [Windows and GPT FAQ](/windows-hardware/manufacture/desktop/windows-and-gpt-faq)
-
-## Troubleshoot Kiosk mode
-- [Troubleshoot kiosk mode issues](/windows/configuration/kiosk-troubleshoot)
-
-## Troubleshoot No Boot
-- [Advanced troubleshooting for Windows boot problems](./advanced-troubleshooting-boot-problems.md)
-
-## Troubleshoot Push Button Reset
-- [Push-button reset frequently-asked questions (FAQ)](/windows-hardware/manufacture/desktop/pbr-faq)
-- [Push-button reset frequently-asked questions (FAQ)](/windows-hardware/manufacture/desktop/pbr-validation)
-- [Recovery components](/windows-hardware/manufacture/desktop/recovery-strategy-for-common-customizations)
-
-### Troubleshoot Power Management
-- [Modern Standby FAQs](/windows-hardware/design/device-experiences/modern-standby-faqs)
-
-
-## Troubleshoot Secure Boot
-- [Secure Boot isn't configured correctly: troubleshooting](/windows-hardware/manufacture/desktop/secure-boot-isnt-configured-correctly-troubleshooting)
-
-
-## Troubleshoot Setup and Install
-- [Deployment Troubleshooting and Log Files](/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files)
-
-
-## Troubleshoot Start Menu
-- [Troubleshoot Start menu errors](/windows/configuration/start-layout-troubleshoot)
-
-
-## Troubleshoot Subscription Activation
-- [Deploy Windows 10 Enterprise licenses](/windows/deployment/deploy-enterprise-licenses)
-
-## Troubleshoot System Hang
-- [Advanced troubleshooting for Windows-based computer freeze issues](./troubleshoot-windows-freeze.md)
-
-## Troubleshoot TCP/IP Communication
-- [Collect data using Network Monitor](./troubleshoot-tcpip-netmon.md)
-- [Troubleshoot TCP/IP connectivity](./troubleshoot-tcpip-connectivity.md)
-- [Troubleshoot port exhaustion issues](./troubleshoot-tcpip-port-exhaust.md)
-- [Troubleshoot Remote Procedure Call (RPC) errors](./troubleshoot-tcpip-rpc-errors.md)
-
-## Troubleshoot User State Migration Toolkit (USMT)
-- [Common Issues](/windows/deployment/usmt/usmt-common-issues)
-- [Frequently Asked Questions](/windows/deployment/usmt/usmt-faq)
-- [Log Files](/windows/deployment/usmt/usmt-log-files)
-- [Return Codes](/windows/deployment/usmt/usmt-return-codes)
-
-## Troubleshoot Windows Hello for Business (WHFB)
-- [Windows Hello for Business Frequently Asked Questions](/windows/security/identity-protection/hello-for-business/hello-faq)
-- [Windows Hello errors during PIN creation (Windows 10)](/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation)
-- [Event ID 300 - Windows Hello successfully created (Windows 10)](/windows/security/identity-protection/hello-for-business/hello-event-300)
-
-
-## Troubleshoot Windows Analytics
-- [Frequently asked questions and troubleshooting Windows Analytics](/windows/deployment/update/windows-analytics-faq-troubleshooting)
-
-## Troubleshoot Windows Update
-- [How Windows Update works](/windows/deployment/update/how-windows-update-works)
-- [Windows Update log files](/windows/deployment/update/windows-update-logs)
-- [Windows Update troubleshooting](/windows/deployment/update/windows-update-troubleshooting)
-- [Windows Update common errors and mitigation](/windows/deployment/update/windows-update-errors)
-- [Windows Update - More resources](/windows/deployment/update/windows-update-resources)
-- [Get started with Windows Update](/windows/deployment/update/windows-update-overview)
-- [Servicing stack updates](/windows/deployment/update/servicing-stack-updates)
-
-## Troubleshoot Windows Upgrade
-- [Quick fixes - Windows IT Pro](/windows/deployment/upgrade/quick-fixes)
-- [SetupDiag](/windows/deployment/upgrade/setupdiag)
-- [Troubleshoot Windows 10 upgrade errors - Windows IT Pro](/windows/deployment/upgrade/troubleshoot-upgrade-errors)
-- [Windows error reporting - Windows IT Pro](/windows/deployment/upgrade/windows-error-reporting)
-- [Upgrade error codes - Windows IT Pro](/windows/deployment/upgrade/upgrade-error-codes)
-- [Log files - Windows IT Pro](/windows/deployment/upgrade/log-files)
-- [Resolution procedures - Windows IT Pro](/windows/deployment/upgrade/resolution-procedures)
-
-## Troubleshoot Windows Recovery (WinRE)
-- [Windows RE troubleshooting features](/windows-hardware/manufacture/desktop/windows-re-troubleshooting-features)
-
-## Troubleshoot Wireless Connection
-- [Advanced Troubleshooting Wireless Network Connectivity](./advanced-troubleshooting-wireless-network-connectivity.md)
-
-## Other Resources
-
-- [Troubleshooting Windows Server components](/windows-server/troubleshoot/windows-server-troubleshooting)
\ No newline at end of file
-[Network Monitor Filter Examples](https://blogs.technet.microsoft.com/rmilne/2016/08/11/network-monitor-filter-examples/)
-[Network Monitor Wireless Filtering](https://social.technet.microsoft.com/wiki/contents/articles/1900.network-monitor-wireless-filtering.aspx)
-[Network Monitor TCP Filtering](https://social.technet.microsoft.com/wiki/contents/articles/1134.network-monitor-tcp-filtering.aspx)
-[Network Monitor Conversation Filtering](https://social.technet.microsoft.com/wiki/contents/articles/1829.network-monitor-conversation-filtering.aspx)
-[How to setup and collect network capture using Network Monitor tool](/archive/blogs/msindiasupp/how-to-setup-and-collect-network-capture-using-network-monitor-tool)
diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md
deleted file mode 100644
index 6a732b7a1d..0000000000
--- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md
+++ /dev/null
@@ -1,199 +0,0 @@
----
-title: Troubleshoot port exhaustion issues
-description: Learn how to troubleshoot port exhaustion issues. Port exhaustion occurs when all the ports on a machine are used.
-ms.prod: w10
-ms.topic: troubleshooting
-author: dansimp
-ms.localizationpriority: medium
-ms.author: dansimp
-ms.date: 02/07/2022
-ms.reviewer:
-manager: dansimp
-ms.collection: highpri
----
-
-# Troubleshoot port exhaustion issues
-
-TCP and UDP protocols work based on port numbers used for establishing connection. Any application or a service that needs to establish a TCP/UDP connection will require a port on its side.
-
-There are two types of ports:
-
-- *Ephemeral ports*, which are dynamic ports, are the set of ports that every machine by default will have them to make an outbound connection.
-- *Well-known ports* are the defined port for a particular application or service. For example, file server service is on port 445, HTTPS is 443, HTTP is 80, and RPC is 135. Custom application will also have their defined port numbers.
-
-When a connection is being established with an application or service, client devices use an ephemeral port from the device to connect to a well-known port defined for that application or service. A browser on a client machine will use an ephemeral port to connect to `https://www.microsoft.com` on port 443.
-
-In a scenario where the same browser is creating many connections to multiple websites, for any new connection that the browser is attempting, an ephemeral port is used. After some time, you'll notice that the connections will start to fail and one high possibility for this failure would be because the browser has used all the available ports to make connections outside and any new attempt to establish a connection will fail as there are no more ports available. When all the ports on a machine are used, we term it as *port exhaustion*.
-
-## Default dynamic port range for TCP/IP
-
-To comply with [Internet Assigned Numbers Authority (IANA)](http://www.iana.org/assignments/port-numbers) recommendations, Microsoft has increased the dynamic client port range for outgoing connections. The new default start port is **49152**, and the new default end port is **65535**. This increase is a change from the configuration of earlier versions of Windows that used a default port range of **1025** through **5000**.
-
-You can view the dynamic port range on a computer by using the following netsh commands:
-
-- `netsh int ipv4 show dynamicport tcp`
-- `netsh int ipv4 show dynamicport udp`
-- `netsh int ipv6 show dynamicport tcp`
-- `netsh int ipv6 show dynamicport udp`
-
-
-The range is set separately for each transport (TCP or UDP). The port range is now a range that has a starting point and an ending point. Microsoft customers who deploy servers that are running Windows Server may have problems that affect RPC communication between servers if firewalls are used on the internal network. In these situations, we recommend that you reconfigure the firewalls to allow traffic between servers in the dynamic port range of **49152** through **65535**. This range is in addition to well-known ports that are used by services and applications. Or, the port range that is used by the servers can be modified on each server. You adjust this range by using the netsh command, as follows. The above command sets the dynamic port range for TCP.
-
-```console
-netsh int
XenServer: Use method 1, 2, 3, or 4. These methods are listed later in this section.|
-|A virtual machine that is no longer frozen|Use method 1, 2, 3, or 4. These methods are listed later in this section.|
-
-### Method 1: Memory dump
-
-> [!IMPORTANT]
-> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad-e318-2a13-2829-d428a2ab0692) in case problems occur.
-
-A complete memory dump file records all the contents of system memory when the computer stops unexpectedly. A complete memory dump file may contain data from processes that were running when the memory dump file was collected.
-
-If the computer is no longer frozen and now is running in a good state, use the following steps to enable memory dump so that you can collect memory dump when the freeze issue occurs again. If the virtual machine is still running in a frozen state, use the following steps to enable and collect memory dump.
-
-> [!NOTE]
-> If you have a restart feature that's enabled on the computer, such as the Automatic System Restart (ASR) feature in Compaq computers, disable it. This setting is usually found in the BIOS. With this feature enabled, if the BIOS doesn't detect a heartbeat from the operating system, it will restart the computer. The restart can interrupt the dump process.
-
-1. Make sure that the computer is set up to get a complete memory dump file.
-
- 1. Go to **Run** and enter `Sysdm.cpl`, and then press enter.
-
- 1. In **System Properties**, on the **Advanced** tab, select **Performance** \> **Settings** \> **Advanced**. Select **Change** to check or change the virtual memory.
-
- 1. Go back to **System Properties** \> **Advanced** \> **Settings** in **Startup and Recovery**.
-
- 1. In the **Write Debugging Information** section, select **Complete Memory Dump**.
-
- 1. Select **Overwrite any existing file**.
-
- 1. Make sure that there's a paging file (pagefile.sys) on the system drive and that it's at least 100 MB over the installed RAM (Initial and Maximum Size).
-
- 1. Make sure that there's more available space on the system drive than there's physical RAM.
-
-1. To allow the system to generate a dump file by using the keyboard, enable the `CrashOnCtrlScroll` registry value.
-
- 1. Open the Registry Editor, and then locate the following registry keys:
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters`
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters`
-
- 1. Create the following `CrashOnCtrlScroll` registry entry in the two registry keys:
-
- - **Value Name**: `CrashOnCtrlScroll`
- - **Data Type**: `REG_DWORD`
- - **Value**: `1`
-
- 1. Close the Registry Editor and restart the computer.
-
-1. On some physical computers running earlier versions of Windows, you may generate a nonmakeable interruption (NMI) from a web interface feature such as DRAC, iLo, or RSA. However, by default, this setting will stop the system without creating a memory dump.
-
- > [!NOTE]
- > For currently supported versions of Windows, the `NMICrashDump` registry key is no longer required. An NMI causes a [Stop error that follows a memory dump data collection](/troubleshoot/windows-client/performance/nmi-hardware-failure-error).
-
-1. When the computer exhibits the problem, hold down the right **Ctrl** key, and press the **Scroll Lock** key two times to generate a memory dump file.
-
- > [!NOTE]
- > By default, the dump file is located in the following path: `%SystemRoot%\MEMORY.DMP`
-
-### Method 2: Data sanity check
-
-Use the Dump Check Utility (Dumpchk.exe) to read a memory dump file. It can also verify that the file was created correctly and isn't corrupted or invalid.
-
-- [Using DumpChk](/windows-hardware/drivers/debugger/dumpchk)
-- [Download DumpChk](https://developer.microsoft.com/windows/downloads/windows-10-sdk)
-
-Learn how to use Dumpchk.exe to check your dump files:
-
-> [!VIDEO https://www.youtube.com/embed/xN7tOfgNKag]
-
-### Method 3: Performance Monitor
-
-You can use Windows Performance Monitor to examine how programs that you run affect your computer's performance, both in real time and by collecting log data for later analysis. To create performance counter and event trace log collections on local and remote systems, run the following commands in a command prompt as administrator:
-
-```command
-Logman create counter LOGNAME_Long -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:05:00
-```
-
-```command
-Logman create counter LOGNAME_Short -u DOMAIN\USERNAME * -f bincirc -v mmddhhmm -max 500 -c "\\COMPUTERNAME\LogicalDisk(*)\*" "\\COMPUTERNAME\Memory\*" "\\COMPUTERNAME\Network Interface(*)\*" "\\COMPUTERNAME\Paging File(*)\*" "\\COMPUTERNAME\PhysicalDisk(*)\*" "\\COMPUTERNAME\Process(*)\*" "\\COMPUTERNAME\Redirector\*" "\\COMPUTERNAME\Server\*" "\\COMPUTERNAME\System\*" "\\COMPUTERNAME\Terminal Services\*" "\\COMPUTERNAME\Processor(*)\*" "\\COMPUTERNAME\Cache\*" -si 00:00:10
-```
-
-Then, you can start or stop the log by running the following commands:
-
-```command
-logman start LOGNAME_Long / LOGNAME_Short
-logman stop LOGNAME_Long / LOGNAME_Short
-```
-
-The Performance Monitor log is located in the path: `C:\PERFLOGS`
-
-### Other methods to collect data
-
-#### Use memory dump to collect data for the physical computer that's running in a frozen state
-
-> [!WARNING]
-> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/topic/how-to-back-up-and-restore-the-registry-in-windows-855140ad-e318-2a13-2829-d428a2ab0692) in case problems occur.
-
-If the physical computer is still running in a frozen state, follow these steps to enable and collect memory dump:
-
-1. Make sure that the computer is set up to get a complete memory dump file and that you can access it through the network.
-
- > [!NOTE]
- > If it isn't possible to access the affected computer through the network, try to generate a memory dump file through NMI. The result of the action may not collect a memory dump file if some of the following settings aren't qualified.
-
- 1. Try to access the desktop of the computer by any means.
-
- > [!NOTE]
- > In case accessing the OS isn't possible, try to remotely access Registry Editor on the computer. You can then check the type of memory dump file and page file with which the computer is currently configured.
-
- 1. From a remote computer that's preferably in the same network and subnet, go to **Registry Editor** \> **Connect Network Registry**. Then, connect to the affected computer, and verify the following settings:
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled`
-
- Make sure that the [CrashDumpEnabled](/previous-versions/windows/it-pro/windows-2000-server/cc976050(v=technet.10)) registry entry is `1`.
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\NMICrashDump`
-
- On some physical servers, if the NMICrashDump registry entry exists and its value is `1`, you may take advantage of the NMI from the remote management provider such as DRAC, iLo, and RSA.
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles and ExistingPageFiles`
-
- If the value of the **Pagefile** registry entry is system-managed, the size won't be reflected in the registry. For example, `?:\pagefile.sys)`
-
- If the page file is customized, the size will be reflected in the registry, such as `?:\pagefile.sys 1024 1124`. In this example, `1024` is the initial size and `1124` is the max size.
-
- > [!NOTE]
- > If the size isn't reflected in the Registry, try to access an administrative share where the page file is located. For example, `\\ServerName\C$`
-
- 1. Make sure that there's a paging file (pagefile.sys) on the system drive of the computer, and it's at least 100 MB over the installed RAM.
-
- 1. Make sure that there's more free space on the hard disk drives of the computer than there's physical RAM.
-
-1. Enable the **CrashOnCtrlScroll** registry value on the computer to allow the system to generate a dump file by using the keyboard.
-
- 1. From a remote computer preferably in the same network and subnet, go to Registry Editor \> Connect Network Registry. Connect to the affected computer and locate the following registry keys:
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters`
-
- - `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters`
-
- 1. Create the following `CrashOnCtrlScroll` registry entry in the two registry keys:
-
- **Value Name**: `CrashOnCtrlScroll`
- **Data Type**: `REG_DWORD`
- **Value**: `1`
-
- 1. Close the Registry Editor and restart the computer.
-
-1. When the computer exhibits the problem, hold down the right **CTRL** key, and press the **Scroll Lock** key two times to generate a memory dump.
-
- > [!NOTE]
- > By default, the dump file is located in the path: `%SystemRoot%\MEMORY.DMP`
-
-### Use Pool Monitor to collect data for the physical computer that is no longer frozen
-
-Pool Monitor shows you the number of allocations and outstanding bytes of allocation by type of pool and the tag that is passed into calls of ExAllocatePoolWithTag.
-
-For more information, see [Using PoolMon to Find a Kernel-Mode Memory Leak](/windows-hardware/drivers/debugger/using-poolmon-to-find-a-kernel-mode-memory-leak) and [PoolMon Examples](/windows-hardware/drivers/devtest/poolmon-examples).
-
-### Use memory dump to collect data for the virtual machine that's running in a frozen state
-
-Use the one of the following methods for the application on which the virtual machine is running.
-
-#### Microsoft Hyper-V
-
-You can also use the built-in NMI feature through a [Debug-VM](/powershell/module/hyper-v/debug-vm) cmdlet to debug and get a memory dump.
-
-To debug the virtual machines on Hyper-V, run the following cmdlet in Windows PowerShell:
-
-```powershell
-Debug-VM -Name "VM Name" -InjectNonMaskableInterrupt -ComputerName Hostname
-```
-
-#### VMware
-
-You can use VMware snapshots or suspend state and extract a memory dump file equivalent to a complete memory dump file. Use VMware's [Checkpoint To Core Tool (vmss2core)](https://flings.vmware.com/vmss2core) to convert both suspend (`.vmss`) and snapshot (`.vmsn`) state files to a dump file. Then analyze the file by using the standard Windows debugging tools.
-
-#### Citrix XenServer
-
-The memory dump process occurs by pressing the RIGHT CTRL + SCROLL LOCK + SCROLL LOCK keyboard combination. For more information, see Method 1 of [How to Trigger a Memory Dump from a Windows Virtual Machine Running on XenServer](https://support.citrix.com/article/ctx123177) from Citrix.
-
-## Space limitations on the system drive in Windows Server
-
-On a Windows Server, you may not have enough free disk space to generate a complete memory dump file on the system volume.
-There's a second option if the system drive doesn't have sufficient space. You can use the DedicatedDumpFile registry entry. For more information, see [Configure the destination path for a memory dump](/windows-server/administration/server-core/server-core-memory-dump#step-2-configure-the-destination-path-for-a-memory-dump).
-
-For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](/archive/blogs/ntdebugging/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump).
diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md
deleted file mode 100644
index 6747a6a240..0000000000
--- a/windows/client-management/troubleshoot-windows-startup.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-title: Advanced troubleshooting for Windows start-up issues
-description: Learn advanced options for how to troubleshoot common Windows start-up issues, like system crashes and freezes.
-ms.prod: w10
-ms.topic: troubleshooting
-author: dansimp
-ms.localizationpriority: medium
-ms.author: dansimp
-ms.date: 2/3/2020
-ms.reviewer:
-manager: dansimp
----
-
-# Advanced troubleshooting for Windows start-up issues
-
-