Windows feature lets you generate a memory dump file by using the keyboard

Windows includes a feature that you can use to cause the system to stop responding and to generate a memory dump file (Memory.dmp). When you do this, you receive a Stop error message that resembles the following:After you enable the feature, you can generate a memory dump file by holding down the right CTRL key and pressing the SCROLL LOCK key two times. The feature is available for both PS/2 and universal serial bus (USB) keyboards. PS/2 keyboards use the i8042prt.sys driver that is included with the keyboard. However, for USB keyboards that are attaced to Windows Server 2003-based systems, you must install a hotfix for the Kbdhid.sys driver. For more information about this hotfix, see the "Windows Server 2003 resolution" subsection at the end of the "More Information" section.

Note There is a limitation with the Kbdhid.sys driver that allows for you to generate the memory dump process by using a USB keyboard. The CTRL+SCROLL LOCK+SCROLL LOCK keyboard shortcut does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver operates at a lower IRQL than the i8042prt.sys driver. The USB keyboard feature works only on computers that are running Windows Server 2003. The USB keyboard feature cannot be used in Windows Server 2008.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: By default, this feature is disabled. To enable this feature on a computer that uses a PS/2 Keyboard, modify the registry as indicated in this article, and then restart the computer. After you restart the computer, you can generate a Memory.dmp file by holding down the CTRL key and pressing the SCROLL LOCK key two times. You must use the CTRL key on the right side of the spacebar. On a computer that uses a USB keyboard, you do not have to restart the computer. Unplugging the keyboard and plugging it back again is sufficient. After that, the Memory.dmp file can be generated.

To enable the feature on a computer that uses a PS/2 keyboard, follow these steps:

1. Start Registry Editor.
2. Locate the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
3. On the Edit menu, click Add Value, and then add the following registry entry:
   Name: CrashOnCtrlScroll
   Data Type: REG_DWORD
   Value: 1
4. Exit Registry Editor, and then restart the computer.

To enable the feature on a computer that uses a USB keyboard, install the hotfix that is mentioned in the "Windows Server 2003 resolution" subsection at the end of the "More Information" section.

Note This feature is not available in Windows Server 2008 for USB keyboards.

To make sure that the feature is enabled on a computer that uses a USB keyboard, follow these steps:

1. Start Registry Editor.
2. Locate the following registry subkey:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters
3. Make sure that the following registry entry is enabled:
   Name: CrashOnCtrlScroll
   Data Type: REG_DWORD
   Value: 1
4. Exit Registry Editor.

How to select memory dump file options

Three types of memory dump files can be generated. Select one before you manually trigger the dump file. To do this, follow these steps:

1. Right-click My Computer, and then click Properties.
2. Click the Advanced tab, and then click the Startup and Recovery button.
3. Click Write Debugging Information, and then click to select either Complete Memory Dump, Kernel Memory Dump, or Small Memory Dump.

For more information about memory dump file options, click the following article number to view the article in the Microsoft Knowledge Base: Note If the server has a feature such as the Automatic System Restart (ASR) feature that is found in some Compaq computers, disable the feature. It can interrupt the dump process. On a Compaq computer, you can disable the ASR feature by modifying the basic input/output system (BIOS) settings.

Note Complete memory dumps may not be available on a computer that has 2 or more gigabytes (GB) of RAM. To limit the memory that Windows 2000 can access, add the <MaxMem=2000> parameter to the Boot.ini file.

If you have installed the security update that is described in article 835732 in the Microsoft Knowledge Base, or you have installed a service pack that contains this security update, visit the following Microsoft Knowledge Base article: For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Note This hotfix applies only to Windows Server 2003-based systems.

Prerequisites

To apply this hotfix, you must have Windows Server 2003 or Windows Server 2003 Service Pack 1 installed on the computer.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, 32-bit (x86-based) versions

Windows Server 2003, x64-based versions

Windows Server 2003, Itanium-based versions

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

How to configure registry keys to generate the memory dump file

You can configure entries under the following registry subkey to generate the memory dump file:The REG_DWORD entries are as follows: The Dump1Keys entry is a bit map of the modifier keys to use. The values are as follows: The Dump2Key entry is the index into the scancode table for the keyboard layout. The following is the actual table in the driver.

Note Index 124 (sysreq) is a special case because an 84-key keyboard has a different scan code. For more information about how to generate a memory dump file in Windows Server 2008, click the following article number to view the article in the Microsoft Knowledge Base: The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.