"Kernel Memory Dump" is displayed in Startup and Recovery, but a complete memory dump is performed in Windows 2000 or in Windows Server 2003

View products that this article applies to.

SYMPTOMS

You may experience one or more of the following symptoms:

When you try to view a memory dump on your Microsoft Windows 2000-based computer, the memory dump file may be corrupted, and you cannot open the file.
The Write debugging information list setting in the Startup and Recovery dialog box is set to Kernel Memory Dump, but a complete memory dump is performed on your Windows 2000-based computer or on your Microsoft Windows Server 2003-based computer.

Back to the top

CAUSE

This issue may occur if all the following conditions are true:

You have increased the amount of memory in your computer to 2 gigabytes (GB) or more.

Note The memory dump file will be corrupted on a Windows 2000-based computer if you increase the memory to 4 GB or more.
You have installed the hotfix that is described in Microsoft Knowledge Base article 820361 or you have installed the hotfix that is described in security hotfix MS04-011.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
835732 (http://support.microsoft.com/kb/835732/ ) MS04-011: Security Update for Microsoft Windows
The value of the CrashDumpEnabled entry in the registry has been set to 0x1.

When you add memory to a computer that is running Windows 2000 or Windows Server 2003, the value of the CrashDumpEnabled registry entry is not changed to reflect the increased amount of memory. The value 0x1 is assigned to the CrashDumpEnabled registry entry when a complete memory dump is to be completed by Windows. The value 0x2 is assigned to the CrashDumpEnabled registry entry when a kernel memory dump is to be completed by Windows. When you increase the amount of memory in the computer that is running Windows to more than 2 GB, it is expected that the complete memory dump setting will be changed to the kernel memory dump setting in both the CrashDumpEnabled registry entry and the Write debugging information list setting in the Startup and Recovery dialog box.

For example, when you install Windows on a computer with 2 GB of memory, the Write debugging information list setting in the Startup and Recovery dialog box of System Properties is Complete Memory Dump. The corresponding CrashDumpEnabled registry entry is set to the value of 0x1.

If you add memory to the computer that is running Windows so that the total memory is more than 2 GB, the Write debugging information list setting is changed to Kernel Memory Dump. However, the CrashDumpEnabled registry entry retains the value of 0x1.

If the computer stops unexpectedly, and a memory dump occurs, the IopReadDumpRegistry() function reads the value of the CrashDumpEnabled entry from the registry. However, the IopReadDumpRegistry() function has a hard-coded limitation that will override the registry value of 0x1 and will perform a kernel memory dump if the function detects that the server has more than 2 GB of memory. Therefore, if the server stops, a kernel memory dump is performed instead of a complete memory dump.

When you install hotfix 820361 or security hotfix MS04-011 on a Windows 2000-based computer, the hard-coded 2 GB memory limitation is removed from the IopReadDumpRegistry() function. Therefore, if you increase the memory in your computer to more than 2 GB, Windows 2000 will try to create a complete memory dump instead of a kernel memory dump if the computer stops unexpectedly.

If you increase the memory to 4 GB or more on a Windows 2000-based computer, Windows 2000 cannot perform a complete memory dump, and the memory dump file is corrupted.

Note Windows Server 2003 can perform a complete memory dump regardless of the amount of memory that is installed in the computer. For example, assume that the Startup and Recovery setting and the CrashDumpEnabled registry entry are set to perform a kernel memory dump and a complete memory dump respectively. If you have 4 GB of memory on your computer, a complete memory dump occurs if you have a large enough paging file on the system partition. The paging file must be the size of physical memory plus 1 megabyte (MB).

The CrashDumpEnabled registry entry is located in the following registry subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

Back to the top

WORKAROUND

Hotfix to correct the Write debugging information list display in Windows 2000

To work around the incorrect Write debugging information list display issue on a Windows 2000-based computer, apply the hotfix that is described in Knowledge Base article 837297. After you apply this hotfix, the setting is synchronized with the registry value in the Write debugging information list. If your computer has more than 2 GB of memory, and the CrashDumpEnabled registry entry is assigned the value 0x1, the Complete Memory Dump option is selected in the Write debugging information list. If the CrashDumpEnabled registry entry is not assigned the value 0x1, the Complete Memory Dump option is not displayed in the Write debugging information list.

For more information about this hotfix, click the following article number to view the article in the Microsoft Knowledge Base:

837297 (http://support.microsoft.com/kb/837297/ ) Crash memory dump file created is different from the type selected in Windows 2000 Startup and Recovery settings

Back to the top

Hotfix to correct the Write debugging information list display in Windows Server 2003

A Windows Server 2003 version of the hotfix that is described in Knowledge Base article 837297 is scheduled to be included in Windows Server 2003 Service Pack 1.

Back to the top

Microsoft Visual Basic script to force Windows 2000 with 4 GB of memory to write a kernel memory dump

To force a Windows 2000-based computer that has 4 GB or more of memory to write only a kernel memory dump, you can use the following Visual Basic script.

Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.

########## Start of VBS script ########## 
 
On Error Resume Next
 
Const ForAppending=8
 
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("c:\memoryCheck.txt", ForAppending, True)
 
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
    
Set colOperatingSystems = objWMIService.ExecQuery _
    ("Select * from Win32_OperatingSystem")
    
For Each objOperatingSystem in colOperatingSystems
    OSNum="5.0.2195"
     csName=objOperatingSystem.CSName
 
    objLogFile.Write csName
    objLogFile.Writeline
                 
    objLogFile.Write objOperatingSystem.Caption & " " & objOperatingSystem.Version
    objLogFile.Writeline
    
    objMemory = objOperatingSystem.TotalVisibleMemorySize
    objLogFile.Write "Memory Size:" & objMemory& "KB"
    objLogFile.Writeline
 
    Set wshell = CreateObject("WScript.Shell")
    crashControl = Wshell.RegRead("HKLM\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled")
    objLogFile.Write "CrashDumpEnabled:" & crashControl 
    objLogFile.Writeline
 
    'verify whether os is 2000 server
    If (InStr(1,objOperatingSystem.Version,OSNUm)>1) and (objOperatingSystem.ProductType >1) Then 
                 objMemory = objOperatingSystem.TotalVisibleMemorySize
                     'verify whether menory is >4G
                      If objMemory >= 4194304 Then
                          'modify registry "CrashDumpEnabled" value to 2 and get the CSName if value is 1
                          If crashControl=1 Then
                               Const HKEY_LOCAL_MACHINE = &H80000002
                               Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_ 
                               strComputer & "\root\default:StdRegProv")
                               strKeyPath = "System\CurrentControlSet\Control\CrashControl"
                               strValueName = "CrashDumpEnabled"
                               dwValue = 2
                               oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
                               objLogFile.Write "CrashDumpEnabled has been modified from 1 to 2"
                               objLogFile.Writeline
          Wscript.Echo "CrashDumpEnabled has been modified from 1 to 2"
                         End  If 
                       End If                                      
    End If  
Next
objLogFile.Close
 
########## End of VBS script ##########

Back to the top

MORE INFORMATION

The following tables show the type of crash dump that occurs and what the Write debugging information setting displays in the Startup and Recovery dialog box. These items depend upon the value that is assigned to the CrashDumpEnabled registry entry and the amount of memory that is installed in the computer.

Back to the top