When a STOP message (fatal system error) occurs in Windows, it enters
debug mode for troubleshooting purposes. This appears as a blue screen and
the first few lines look similar to the following:
Stop 0x0000001e (c000009a 80123f36 02000000 00000246)
Unhandled Kernel exception c000009a from 8123f26
Address 80123f36 has base at 80100000 - ntoskrnl.exe
The following are two procedures to assist you in identifying the cause of
the STOP message before you contact Microsoft Product Support.
The Knowledge Base contains many articles that explain specific STOP
messages and often, resolutions to or ways to work around the problem.
Search the Knowledge Base for at least the first hexadecimal number. For
example, in the example above, that is "0x0000001e". It also may be
helpful to search on the identified file name and other hexadecimal
Saving STOP Messages to File
You can configure Windows to save STOP message information to a "dump"
file, Memory.dmp. If you need to contact Microsoft Product Support, this
will help you give us the specific information we need to identify the
Saving STOP message information to file is enabled by default in Windows
NT Server. However, for Windows NT Workstation, you must enable the option
manually. This must be done prior to encountering a fatal error for the
information to be recorded. To enable this feature, follow these steps:
- In the System component of Control Panel, click the Recovery button.
- Select the Write Debugging Information To check box.
- Click OK until you are asked to restart the computer.
: The paging file must be at least as large as the amount of physical RAM that is installed in your computer, plus at least one megabyte (example: 32 megabytes of RAM is equal to a 33-megabyte paging file). Nominally, the paging file should be 11 megabytes larger than physical memory. The paging file must reside in the active partition. There must be enough free space in the selected location to write the memory dump file. By default, the memory dump file is written to the %SystemRoot%\Memory.dmp file. If there is not enough free space on the %SystemRoot% drive, you can redirect the dump file to another location that has enough free space. You can do this by changing the Dump File
path in the Startup and Recovery
options in Windows 2000 and Microsoft Windows XP, or by changing the Write Debugging Information To
path on the Startup/Shutdown
tab in Windows NT 4.0.
If a STOP message appears and a Memory.dmp file is created, a Microsoft
support professional may be able to debug the dump file. Call Microsoft
Product Support, describe the STOP message to the support professional and
explain that you have a dump file.
You may be asked to send your Memory.dmp file to Microsoft if the support
professional is not able to solve the problem over the phone. If so, compress
the file with an application such as PKZIP. Memory.dmp files usually
compress significantly. Use one of the following options to upload the
- Send your compressed Memory.dmp file by FTP to ftp.microsoft.com. This
requires FTP access to the Internet. The support professional will explain
how to place your file on the FTP server. The server TCP/IP address
- Back up your Memory.dmp file to tape using NTBackup and mail the tape
to the support professional.
- Copy the file to a writeable compact disc and mail it to the support
- If none of the above options are feasible, the support professional may be
able to use Remote Access Service (RAS) to access your computer and
examine or copy the Memory.dmp file. Follow these steps to prepare your
computer for a Microsoft Support Professional to access it with RAS:
- Create a temporary user account that a Microsoft support professional
can use when accessing the Memory.dmp file.
- On another server, create a share and give this new user account
access to this share.
- Copy the newly created Memory.dmp file to this new share.
- If you don't have RAS installed at your site, install RAS on an
Windows NT Server or Workstation. For security, you can install RAS
on a computer and allow remote clients to connect only to that
computer, not the network. If you do this, create the new network
share on this computer and copy the Memory.dmp file there.
- Allow the support professional user ID access to dial in to the RAS
- Give the support professional the user name, password, domain name,
server name, share name, and phone number for the modem line.
Article ID: 129845 - Last Review: March 27, 2007 - Revision: 2.5
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional Edition
- Microsoft Windows 2000 Datacenter Server
- Microsoft Windows NT Workstation 3.5
- Microsoft Windows NT Workstation 3.51
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Server 3.5
- Microsoft Windows NT Server 3.51
- Microsoft Windows NT Server 4.0 Standard Edition
- Microsoft BackOffice Small Business Server 4.0