finish

windows/client-management/TOC.md

@@ -22,6 +22,10 @@
 ##### [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md)
 ##### [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md)
 ### [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md)
+#### [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md)
+#### [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md)
+#### [Introduction of page file](introduction-of-page-file.md)
+#### [Configure system failure and recovery options in Windows](system-failure-recovery-options.md)
 #### [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
 #### [Advanced troubleshooting for Windows-based computer freeze](troubleshoot-windows-freeze.md)
 #### [Advanced troubleshooting for stop error or blue screen error](troubleshoot-stop-errors.md)

windows/client-management/determine-appropriate-page-file-size.md

@@ -0,0 +1,128 @@
+---
+title: How to determine the appropriate page file size for 64-bit versions of Windows
+description: Learn how to determine the appropriate page file size for 64-bit versions of Windows.
+ms.prod: w10
+ms.sitesec: library
+ms.topic: troubleshooting
+author: Deland-Han
+ms.localizationpriority: medium
+ms.author: delhan
+ms.date: 8/28/2019
+ms.reviewer: 
+manager: dcscontentpm
+---
+
+# How to determine the appropriate page file size for 64-bit versions of Windows
+
+In summary, page file sizing depends on the system crash dump setting requirements and the system commit charge peak usage or expected usage. Both considerations are unique to each system, even for systems that are identical to other systems. This means that page file sizing is unique to each system and cannot be generalized.
+
+## Determine the appropriate page file size
+
+Use the following considerations for page file sizing for all versions of Windows and Windows Server:
+
+### Crash dump setting
+
+If you want a crash dump file to be created during a system crash, a page file or a dedicated dump file must exist and be large enough to back the system crash dump setting. Otherwise, a system memory dump file is not created.
+
+For more information, see [Support for system crash dumps](introduction-of-page-file.md#support-for-system-crash-dumps) section.
+
+### Peak system commit charge
+
+The system commit charge cannot exceed the system commit limit. This limit is the sum of physical memory (RAM) and all page files combined. If no page files exist, the system commit limit is slightly less than the physical memory installed. Peak system-committed memory usage can vary greatly between systems. Therefore, physical memory and page file sizing also varies.
+
+### Quantity of infrequently accessed pages
+
+The purpose of a page file is to back infrequently accessed modified pages so that they can be removed from physical memory. This provides more available space for more frequently accessed pages. The "\Memory\Modified Page List Bytes" performance counter measures, in part, the number of infrequently accessed modified pages that are destined for the hard disk. However, be aware that not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. Therefore, consider extending or adding a page file if all the following conditions are true:
+
+- More available physical memory (\Memory\Available MBytes) is required.
+
+- The modified page list contains a significant amount of memory.
+
+- The existing page files are fairly full (\Paging Files(*)\% Usage).
+
+## Support for system crash dumps
+
+A system crash (also known as a “bug check” or a "Stop error") occurs when the system cannot run correctly. The dump file that is produced from this event is called a system crash dump. A page file or dedicated dump file is used to write a crash dump file (memory.dmp) to disk. Therefore, a page file or a dedicated dump file must be large enough to support the kind of crash dump selected. Otherwise, the system cannot create the crash dump file.
+
+>[!Note]
+>During startup, system-managed page files are sized respective to the system crash dump settings. This assumes that enough free disk space exists.
+
+|System crash dump setting	|Minimum page file size requirement|
+|-----------|-------------------|
+|Small memory dump (256 KB)	|1 MB|
+|Kernel memory dump	|Depends on kernel virtual memory usage|
+|Complete memory dump	|1 x RAM plus 257 MB*|
+|Automatic memory dump	|Depends on kernel virtual memory usage. For details, see Automatic memory dump.|
+
+\* 1 MB of header data and device drivers can total 256 MB of secondary crash dump data.
+
+The **Automatic memory dump** setting is enabled by default. This is a setting instead of a kind of crash dump. This setting automatically selects the best page file size, depending on the frequency of system crashes. 
+
+The Automatic memory dump feature at first selects a small paging file size. It would accommodate the kernel memory most of the time. If the system crashes again within four weeks, the Automatic memory dump feature selects the page file size as either the RAM size or 32 GB, whichever is smaller. 
+
+Kernel memory crash dumps require enough page file space or dedicated dump file space to accommodate the kernel mode side of virtual memory usage. If the system crashes again within four weeks of the previous crash, a Complete memory dump is selected at restart. This requires a page file or dedicated dump file of at least the size of physical memory (RAM) plus 1 MB for header information plus 256 MB for potential driver data to support all the potential data that is dumped from memory. Again, the system-managed page file will be increased to back this kind of crash dump. If the system is configured to have a page file or a dedicated dump file of a specific size, make sure that the size is sufficient to back the crash dump setting that is listed in the table earlier in this section together with and the peak system commit charge.
+
+### Dedicated dump files
+
+Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead.
+A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file when you want a system crash dump, but you do not want a page file.
+
+## System-managed page files
+
+By default, page files are system managed. This means that the page files increase and decrease based on many factors, such as the amount of physical memory installed, the process of accommodating the system commit charge, and the process of accommodating a system crash dump.
+
+For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth.
+
+The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10.
+
+|Minimum page file size	|Maximum page file size|
+|---------------|------------------|
+|Varies based on page file usage history, amount of RAM (RAM ÷ 8, max 32 GB) and crash dump settings.	|3 × RAM or 4 GB, whichever is larger.  This is then limited to the volume size ÷ 8.  However, it can grow to within 1 GB of free space on the volume if required for crash dump settings.|
+
+## Performance counters
+
+Several performance counters are related to page files. This section describes the counters and what they measure.
+
+### \Memory\Page/sec and other hard page fault counters
+
+The following performance counters measure hard page faults (which include, but are not limited to, page file reads):
+
+- \Memory\Page/sec
+
+- \Memory\Page Reads/sec
+
+- \Memory\Page Inputs/sec
+
+The following performance counters measure page file writes:
+
+- \Memory\Page Writes/sec
+
+- \Memory\Page Output/sec
+
+Hard page faults are faults that must be resolved by retrieving the data from disk. Such data can include portions of DLLs, .exe files, memory-mapped files, and page files. These faults might or might not be related to a page file or to a low-memory condition. Hard page faults are a standard function of the operating system. They occur when the following items are read:
+
+- Parts of image files (.dll and .exe files) as they are used
+
+- Memory-mapped files
+
+- A page file
+
+High values for these counters (excessive paging) indicate disk access of generally 4 KB per page fault on x86 and x64 versions of Windows and Windows Server. This disk access might or might not be related to page file activity but may contribute to poor disk performance that can cause system-wide delays if the related disks are overwhelmed.
+
+Therefore, we recommend that you monitor the disk performance of the logical disks that host a page file in correlation with these counters. Be aware that a system that has a sustained 100 hard page faults per second experiences 400 KB per second disk transfers. Most 7200 RPM disk drives can handle about 5 MB per second at an IO size of 16 KB or 800 KB per second at an IO size of 4 KB. No performance counter directly measures which logical disk the hard page faults are resolved for.
+
+### \Paging File(*)\% Usage
+
+The \Paging File(*)\% Usage performance counter measures the percentage of usage of each page file. 100 percent usage of a page file does not indicate a performance problem as long as the system commit limit is not reached by the system commit charge, and if a significant amount of memory is not waiting to be written to a page file.
+
+>[!Note]
+>The size of the Modified Page List (\Memory\Modified Page List Bytes) is the total of modified data that is waiting to be written to disk.
+
+If the Modified Page List (a list of physical memory pages that are the least frequently accessed) contains a lot of memory, and if the % Usage value of all page files is greater than 90, you can make more physical memory available for more frequently access pages by increasing or adding a page file.
+
+>[!Note]
+>Not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list.
+
+## Multiple page files and disk considerations
+
+If a system is configured to have more than one page files, the page file that responds first is the one that is used. This means that page files that are on faster disks are used more frequently. Also, putting a page file on a “fast” or “slow” disk is important only if the page file is frequently accessed and if the disk that is hosting the respective page file is overwhelmed. Be aware that actual page file usage depends greatly on the amount of modified memory that the system is managing. This means that files that already exist on disk (such as .txt, .doc, .dll, and .exe) are not written to a page file. Only modified data that does not already exist on disk (for example, unsaved text in Notepad ) is memory that could potentially be backed by a page file. After the unsaved data is saved to disk as a file, it is backed by the disk and not by a page file.

windows/client-management/generate-kernel-or-complete-crash-dump.md

@@ -0,0 +1,110 @@
+---
+title: Generate a kernel or complete crash dump
+description: Learn how to generate a kernel or complete crash dump.
+ms.prod: w10
+ms.sitesec: library
+ms.topic: troubleshooting
+author: Deland-Han
+ms.localizationpriority: medium
+ms.author: delhan
+ms.date: 8/28/2019
+ms.reviewer: 
+manager: dcscontentpm
+---
+
+# Generate a kernel or complete crash dump 
+
+A system crash (also known as a “bug check” or a "Stop error") occurs when Windows can't run correctly. The dump file that is produced from this event is called a system crash dump.
+
+A manual kernel or complete memory dump file is useful when troubleshooting a number of issues because the process captures a record of system memory at the time of a crash.
+
+## Set up page files
+
+See [Support for system crash dumps](determine-appropriate-page-file-size.md#support-for-system-crash-dumps) for the page file size requirement for system crash dump.
+
+## Enable memory dump setting
+
+You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure.
+
+To enable memory dump setting, follow these steps:
+
+1. In **Control Panel**, click **System and Security** -> **System**, or click **System** directly if control panel is viewed by icons.
+
+2. Click **Advanced system settings**, and then click the **Advanced** tab.
+
+3. Under **Startup and Recovery**, click **Settings**.
+
+4. Make sure that **Kernel memory dump** or **Complete memory dump** is selected under **Writing Debugging Information**.
+
+5. Restart the computer.
+
+>[!Note]
+> You can change the dump file path by edit the **Dump file** field. In other words, you can change the path from %SystemRoot%\Memory.dmp to point to a local drive that has enough disk space, such as E:\Memory.dmp. 
+
+### Tips for memory dump
+
+When computer crashes and restarts, the contents of physical RAM are written to the paging file that is located on the partition on which the operating system is installed.
+
+Depending on the speed of the hard drive on which Windows is installed, dumping more than 2 gigabytes (GB) of memory may take a long time. Even in a best case scenario, where the dump file is configured to reside on another local hard drive, there will be a significant amount of data being read and written to the hard drives. This can cause a prolonged server outage.
+
+>[!Note]
+>Use this method to generate complete memory dump files with caution. Ideally, you should only do this only when you are explicitly requested to by the Microsoft Customer Support Services Engineer. Any kernel or complete memory dump file debugging should be the last resort when all the standard troubleshooting methods have been completely exhausted.
+
+## Manually generate a memory dump file
+
+### Use the NotMyFault tool
+
+If you can log on while the problem is occurring, you can use the Microsoft Sysinternals NotMyFault tool. To do this, follow these steps:
+
+1. Download the [NotMyFault](https://download.sysinternals.com/files/NotMyFault.zip) tool.
+
+2. Click **Start**, and then click **Command Prompt**.
+3. At the command line, run the following command:
+
+   ```cmd
+   notMyfault.exe /crash
+   ```
+
+>[!Note]
+>This operation generates a memory dump file and a D1 stop error.
+
+### Use NMI
+
+On some computers, you cannot use keyboard to generate a crash dump file. For example, Hewlett-Packard (HP) BladeSystem servers from the Hewlett-Packard Development Company are managed through a browser-based graphical user interface (GUI). A keyboard is not attached to the HP BladeSystem server.
+
+In these cases, you must generate a complete crash dump file or a kernel crash dump file by using the Non-Maskable Interrupt (NMI) switch that causes an NMI on the system processor. 
+
+To do this, follow these steps:
+
+> [!IMPORTANT]  
+> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur.
+
+1. In Registry Editor, locate the following registry subkey:
+   **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl**
+
+2. Right-click **CrashControl**, point to **New**, and then click **DWORD Value**.
+
+3. Type NMICrashDump, and then press Enter.
+
+4. Right-click **NMICrashDump**, and then click **Modify**.
+
+5. In the **Value data** box, type 1, and then click **OK**.
+
+6. Restart the computer.
+
+7. Hardware vendors, such as HP, IBM, and Dell, may provide an Automatic System Recovery (ASR) feature. You should disable this feature during troubleshooting. For example, if HP and Compaq's ASR feature is enabled in the BIOS, disable this feature while you are troubleshooting to generate a complete memory.dmp file. For the exact steps, contact your hardware vendor.
+
+8. Enable the NMI switch in the BIOS or by using the Integrated Lights Out (iLO) Web interface. 
+
+   >[!Note]
+   >For the exact steps, see the BIOS reference manual or contact your hardware vendor.
+
+9. Test this method on the server by using the NMI switch to generate a dump file. You will see a STOP 0x00000080 hardware malfunction.
+
+### Use the keyboard
+
+[Forcing a System Crash from the Keyboard](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard)
+
+### Use Debugger
+
+[Forcing a System Crash from the Debugger](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-debugger)

windows/client-management/introduction-of-page-file.md

@@ -0,0 +1,74 @@
+---
+title: Introduction of page file
+description: Learn about the page files in Windows.
+ms.prod: w10
+ms.sitesec: library
+ms.topic: troubleshooting
+author: Deland-Han
+ms.localizationpriority: medium
+ms.author: delhan
+ms.date: 8/22/2019
+ms.reviewer: 
+manager: dcscontentpm
+---
+
+# Introduction of page file
+
+A page file (also known as a "paging file") is an optional, hidden system file on a hard disk.
+
+## Functionality
+
+Page files have the following functionalities:
+
+### Physical extension of RAM
+
+Page files enable the system to remove infrequently accessed modified pages from physical memory to let the system use physical memory more efficiently for more frequently accessed pages.
+
+### Application requirements
+
+Some products or services require a page file for various reasons. For specific information, check the product documentation.
+
+For example, the following Windows servers requires page files:
+
+- Windows Server domain controllers
+
+- DFS Replication (DFS-R) servers
+
+- Certificate servers
+
+- ADAM/LDS servers
+
+This is because the algorithm of the database cache for Extensible Storage Engine (ESENT, or ESE in Microsoft Exchange Server) depends on the "\Memory\Transition Pages RePurposed/sec" performance monitor counter. A page file is required to make sure that the database cache can release memory if other services or applications request memory.
+
+For Windows Server 2012 Hyper-V and Windows Server 2012 R2 Hyper-V, the page file of the management OS (commonly called the host OS) should be left at the default of setting of "System Managed" .
+
+### Support for system crash dumps
+
+Page files can be used to "back" (or support) system crash dumps and extend how much system-committed memory (also known as “virtual memory”) a system can back. 
+
+For more information about system crash dumps, see [system crash dump options](system-failure-recovery-options.md#under-write-debugging-information).
+
+## Page files in Windows with large physical memory
+
+When large physical memory is installed, a page file might not be required to support the system commit charge during peak usage. For example, 64-bit versions of Windows and Windows Server support more physical memory (RAM) than 32-bit versions support. The available physical memory alone might be large enough. 
+
+However, the reason to configure the page file size has not changed. It has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. For example, when a lot of physical memory is installed, a page file might not be required to back the system commit charge during peak usage. The available physical memory alone might be large enough to do this. However, a page file or a dedicated dump file might still be required to back a system crash dump.
+
+## System committed memory
+
+Page files extend how much "Committed memory" (also known as "Virtual Memory") is used to store modified data.
+
+The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support.
+
+![Task manager](images/task-manager.png)
+ 
+The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage.
+
+![Out of memory](images/out-of-memory.png)
+
+![Task manager](images/task-manager-commit.png)
+
+The system committed charge and system committed limit can be measured on the Performance tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of  \Memory\Committed Bytes to \Memory\Commit Limit values.
+
+>[!Note]
+>System-managed page files automatically grow up to three times physical memory or 4 GB (whichever is larger) when the system commit charge reaches 90 percent of the system commit limit. This assumes that enough free disk space is available to accommodate the growth.

windows/client-management/system-failure-recovery-options.md

@@ -0,0 +1,209 @@
+---
+title: Configure system failure and recovery options in Windows
+description: Learn about the system failure and recovery options in Windows.
+ms.prod: w10
+ms.sitesec: library
+ms.topic: troubleshooting
+author: Deland-Han
+ms.localizationpriority: medium
+ms.author: delhan
+ms.date: 8/22/2019
+ms.reviewer: 
+manager: dcscontentpm
+---
+
+# Configure system failure and recovery options in Windows
+
+This article introduces on how to configure the actions that Windows takes when a system error (also referred to as a bug check, system crash, fatal system error, or stop error) occurs. You can configure the following actions: 
+
+- Write an event to the System log.
+
+- Alert administrators (if you have set up administrative alerts).
+
+- Put system memory in a file that advanced users can use for debugging.
+
+- Automatically restart the computer.
+
+>[!Note]
+> You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure.
+
+## Configuring System Failure and Recovery Options
+
+> [!IMPORTANT]  
+> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur.
+
+The options are available in the Startup and Recovery. You can also use the following methods:
+
+- Modify the values under the following registry key
+
+  **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl**
+
+- To modify the option on your local computer, use the command-line utility (Wmic.exe) to access Windows Management Instrumentation (WMI).
+
+Follow these steps to view the options in Startup and Recovery. The registry value and wmic commands are also listed for each option:
+
+1. In Control Panel, click System and Security -> System, or click System directly if control panel is viewed by icons.
+
+2. Click Advanced system settings, click the Advanced tab, under Startup and Recovery, and then click Settings.
+
+### Under "System failure"
+
+Click to select the check boxes for the actions that you want Windows to perform when a system error occurs.
+
+#### Write an event to the System log
+
+The option specifies that event information is recorded in the System log. By default, this option is turned on.
+
+To turn off this option, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set WriteToSystemLog = False
+  ```
+
+- Set the **LogEvent** DWORD value to **0**.
+
+#### Send an administrative alert
+
+The option specifies that administrators are notified of the system error if you configured administrative alerts. By default, this option is turned on. 
+
+To turn off this option, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set SendAdminAlert = False
+  ```
+
+- Set the **SendAlert** DWORD value to **0**.
+
+#### Automatically restart
+
+The option specifies that Windows automatically restarts your computer. By default, this option is enabled.
+
+To turn off this option, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set AutoReboot = False
+  ```
+
+- Set the **AutoReboot** DWORD value to **0**.
+
+### Under "Write debugging information"
+
+Select the type of information that you want Windows to record in a memory dump file if the computer stops unexpectedly:
+
+#### (none) 
+
+The option does not record any information in a memory dump file.
+
+To specify that you do not want Windows to record information in a memory dump file, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set DebugInfoType = 0
+  ```
+- Set the **CrashDumpEnabled** DWORD value to **0**.
+
+#### Small Memory Dump
+
+The option records the smallest amount of information to help identify the problem. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of your computer and specifies that Windows will create a new file each time the system stops unexpectedly. A history of these files is stored in the folder that is listed under Small Dump Directory (%SystemRoot%\Minidump). In Windows XP and Windows Server 2003, the small memory dump file is used with the Windows Error Reporting feature. 
+
+To specify that you want to use a small memory dump file, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set DebugInfoType = 3
+  ```
+
+- Set the **CrashDumpEnabled** DWORD value to **3**.
+
+To specify that you want to use a folder as your Small Dump Directory, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set MiniDumpDirectory = <folderpath>
+  ```
+
+- Set the **MinidumpDir** Expandable String Value to \<folderpath\>.
+
+#### Kernel Memory Dump
+
+The option records only kernel memory. This option stores more information than a small memory dump file, but it takes less time to complete than a complete memory dump file. The file is stored in %SystemRoot%\Memory.dmp by default, and any previous kernel or complete memory dump files are overwritten if the Overwrite any existing file check box is selected. If you set this option, you must have a sufficiently large paging file on the boot volume. The required size depends on the amount of RAM in your computer (although the maximum amount of space that must be available for a kernel memory dump on a 32-bit system is 2 GB plus 16 MB; on a 64-bit system, the maximum amount of space that must be available for a kernel memory dump is the size of the RAM plus 128 MB). The following table contains guidelines for the size of the paging file:
+
+|RAM size	|Paging file should be no smaller than|
+|-------|-----------------|
+|256 MB–1,373 MB	|1.5 times the RAM size|
+|1,374 MB or greater	|32-bit system: 2 GB plus 16 MB <br /> 64-bit system: size of the RAM plus 128 MB|
+
+To specify that you want to use a kernel memory dump file, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set DebugInfoType = 2
+  ```
+
+- Set the **CrashDumpEnabled** DWORD value to **2**.
+
+To specify that you want to use a file as your memory dump file, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set DebugFilePath = <filepath>
+  ```
+
+- Set the **DumpFile** Expandable String Value to \<filepath\>.
+
+To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set OverwriteExistingDebugFile = 0
+  ```
+
+- Set the **Overwrite** DWORD value to **0**.
+
+#### Complete Memory Dump
+
+The option records the contents of system memory when the computer stops unexpectedly. This option is not available on computers with 2 or more GB of RAM. If you select this option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 MB. The file is stored as specified in %SystemRoot%\Memory.dmp by default.
+
+The extra MB is required for a complete memory dump file because Windows writes a header in addition to dumping the memory contents. The header contains a crash dump signature and specifies the values of some kernel variables. The header information does not require a full MB of space, but Windows sizes your paging file in increments of MBs.
+
+To specify that you want to use a complete memory dump file, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set DebugInfoType = 1
+  ```
+
+- Set the **CrashDumpEnabled** DWORD value to **1**.
+
+To specify that you want to use a file as your memory dump file, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set DebugFilePath = <filepath>
+  ```
+
+- Set the DumpFile Expandable String Value to \<filepath\>.
+
+To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value:
+
+- ```cmd
+  wmic recoveros set OverwriteExistingDebugFile = 0
+  ```
+
+- Set the **Overwrite** DWORD value to **0**.
+
+>[!Note]
+>If you contact Microsoft Product Support Services about a stop error, you might be asked for the memory dump file that is generated by the Write Debugging Information option. 
+
+To view system failure and recovery settings for your local computer, type `wmic recoveros` at a command prompt, and then press Enter. To view system failure and recovery settings for a remote computer on your local area network, type `wmic /node:<computer_name> recoveros` at a command prompt, and then press Enter. 
+
+>[!Note]
+>To successfully use these Wmic.exe command line examples, you must be logged on by using a user account that has administrative rights on the computer. If you are not logged on by using a user account that has administrative rights on the computer, use the `/user:user_name` and `/password:password` switches.
+
+### Tips
+
+- To take advantage of the dump file feature, your paging file must be on the boot volume. If you have moved the paging file to another volume, you must move it back to the boot volume before you use this feature.
+
+- If you set the Kernel Memory Dump or the
+Complete Memory Dump option, and you select the
+Overwrite any existing file check box, Windows always writes to the same file name. To save individual dump files, click to clear the
+Overwrite any existing file check box, and then change the file name after each stop error.
+
+- You can save some memory if you click to clear the
+Write an event to the system log and Send an administrative alert check boxes. The memory that you save depends on the computer, but these features typically require about 60 to 70 KB.
+
+## Reference
+
+[Varieties of Kernel-Mode Dump Files](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files)

windows/client-management/troubleshoot-windows-startup.md

@@ -16,6 +16,38 @@ manager: dansimp
 
 In these topics, you will learn how to troubleshoot common problems related to Windows start-up.
 
-- [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
+## How it works
-- [Advanced troubleshooting for Stop error or blue screen error](troubleshoot-stop-errors.md)
+
-- [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md)
+When Microsoft Windows encounters a condition that compromises safe system operation, the system halts. This condition is referred as Windows start-up problems. Furthermore, it is categorized in 3 buckets.
+ 
+- Bug check: It is also commonly referred to as a system crash, a kernel error, or a stop error.
+
+- No Boot: Here the system may not produce a bug check but is unable to boot into Windows.
+
+- Freeze: Also known as System Hang where 
+  
+## Best Practices
+
+To understand the underlaying cause of that lead to Windows start-up issues, it is important that the system is configured properly. Here are some best practices:
+ 
+### Page file settings
+ 
+- [Introduction of page file](introduction-of-page-file.md)
+
+- [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md)
+ 
+### Memory Dump settings
+
+- [Configure system failure and recovery options in Windows](system-failure-recovery-options.md)
+
+- [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md)
+ 
+## Troubleshooting  
+
+These articles will walk you through the resources you need to troubleshoot Windows start-up issue.
+
+- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/en-us/windows/client-management/advanced-troubleshooting-boot-problems)
+
+- [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-stop-errors)
+
+- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/en-us/windows/client-management/troubleshoot-windows-freeze)