Preparation Before You Contact Microsoft After Receiving a STOP Message on a Blue Screen

This article describes several procedures that will assist you in identifying the cause of a STOP message before you contact Microsoft Product Support.

When a STOP error (a fatal system error) occurs in Windows, Windows enters debug mode for troubleshooting purposes. A blue screen appears and typically displays information that is similar to the following error message:

Error Reporting

Windows XP provides a feature called Error Reporting that enables you to upload information to Microsoft when errors occur. This information is used to determine what problems you are encountering in Windows XP. Using the Error Reporting feature can reveal details about the specific cause of the error that you encountered.

For additional information about Error Reporting in Windows XP, click the article number below to view the article in the Microsoft Knowledge Base:

Knowledge Base

The Microsoft Knowledge Base contains many articles that explain the reason for a specific STOP message. The articles often suggest a resolution of the problem or a way to work around the problem.

On the Microsoft Web site, you can search the Knowledge Base for information about a specific STOP message. When you set up a search, use at least the first hexadecimal number as a term to search for. For example, in the Summary's illustration of a STOP message, the first hexadecimal number is "0x0000001e." You can also use the identified file name ("Ntoskrnl.exe" in the illustration) and other hexadecimal numbers as search terms.

Memory "Dumps"

You can configure Windows to save STOP message information to a "dump" file. If you need to contact Microsoft Product Support, having a dump file helps you give the Support Professional the specific information needed to identify the problem.

By default, saving STOP message information to a file is enabled in Windows XP. Three types of memory dumps are available:

• A small memory dump (64 kilobytes), which is written to the %SystemRoot%\Minidump folder. The paging file on the boot volume must be at least 2 megabytes (MB) in size.
• A kernel memory dump, which is written to the %SystemRoot%\Memory.dmp folder. The paging file on the boot volume must be at least 50 to 800 MB in size, depending on the amount of RAM.
• A complete memory dump, which is written to the %SystemRoot%\Memory.dmp folder. The paging file on the boot volume must be large enough to hold all of the physical RAM plus 1 MB.

The default type of memory dump is the small memory dump. To change or view the settings for the type of memory dump, follow these steps:

1. Click Start, and then click Control Panel.
2. In Control Panel, double-click System, and then click the Advanced tab.
3. Click Settings in the Startup and Recovery area.
4. View or change the type of memory dump under Write debugging information.

Memory.dmp or Minidump File

If a STOP message appears and a Memory.dmp or minidump file is created, a Support Professional may be able to debug the dump file. Call Microsoft Product Support, describe the STOP message for the Support Professional, and explain that you have a dump file.

You may be asked to send your dump file to Microsoft if the Support Professional is not able to solve the problem over the phone. If you are asked to send the dump file, use a program like PKZIP to compress the file. Dump files usually can be significantly compressed. Use one of the following methods to upload the file to Microsoft:

• Send your compressed dump file by File Transfer Protocol (FTP) to Ftp.microsoft.com. This method requires FTP access to the Internet. The Support Professional will explain how to place your file on the FTP server. The server TCP/IP address is:
  207.46.133.140

• Use the NTBackup utility to back up your dump file to tape, and then mail the tape to the Support Professional.
• Copy the file to a writeable compact disc, and then mail the compact disc to the Support Professional.
• Use the Dumpflop utility, which is located on the Windows XP compact disc in the Support\Debug\i386 folder.

• If the preceding options are not feasible, a Microsoft Support Professional may be able to use Remote Access Service (RAS) to connect with your computer and examine or copy the dump file. Follow these steps to prepare your computer so that a Support Professional can connect to it by using RAS:
  1. Create a temporary user account for the Support Professional.
  2. On another server, create a share, and then give this new user account permissions to this share.
  3. Copy the newly created dump file to this new share.
  4. If you do not have RAS installed at your site, install RAS on a Windows XP-based computer. For security, you can install RAS on one computer and allow remote clients to connect only to that computer, not to the network. If you use this method, create the new network share on the designated computer and copy the dump file to the share.
  5. Grant the Support Professional user ID permissions to dial in to the RAS server.
  6. Give the Support Professional the user name, password, domain name, server name, and share name, and the phone number for the modem line.