Troubleshoot "blue screen" or Stop error problems before you contact Microsoft Support
Things to Try
Before you call Microsoft SupportTry the following methods to troubleshoot Stop error messages:
- Review the "bugcheck" code that you find in the event logs. Search for the specific Stop error codes to see whether there are any known issues, resolutions, or workarounds for the problem.
- Does the error message indicate any specific driver in regards to the problem? If so, update the driver in question.
- Take a detailed look at the event logs on the system. Are you seeing any indication of a service starting or stopping before the crash occurred? Is this service behavior consistent across all instances of the crash? If so, you can contact the software vendor for the service to receive updated versions of the software to check whether this resolves the problem.
- Try to identify whether you have made any software or hardware change or modification. You may want to consider the option to roll back the changes or use the change management to follow standard practices to revert to the last working state. Additionally, you may want to contact the software or hardware vendor for more help.
- As a best practice, we recommend that you make sure that the BIOS is updated and that hardware and memory tests are performed.
- Are you observing behavior that is related to the crashes, and do you believe that you can trigger the crash? Did you reach out to the software vendor for any updated version of the software or drivers that may be triggering the crash?
- Make sure that you save the memory dump files for review. These dump files have been validated by using DumpChk and are not corrupted or invalid. You can verify the memory dump by using the Microsoft DumpChk (Crash Dump File Checker) tool. For more information, go to the following Knowledge Base article:
- Make sure that you install the latest Windows updates, cumulative updates, and rollup updates.
- Upload the memory dumps that you have verified by using the DmpChk memory dump collector. This diagnostic tool collects the last five machine mini-dump files from the past 30 days. It collects machine memory dump files from a computer and checks for known solutions.
For more information about Machine Memory Dump Collector, go to the following Knowledge Base article:
Windows 7 and earlier versions
Windows 8 and later versions
What is a bugcheck or system crash?When Windows cannot continue its operations safely, the system stops all operations to ensure safety to data/prevent corruptions. This system freeze is caused by a kernel mode component (driver) calling either of the functions KeBugCheck(...) or KeBugCheckEx(...). This causes what is commonly called the "Blue Screen of Death (BSOD)," a "bugcheck," or a system crash.
System Crash DumpsWhen the system crashes, the memory contents at the time of the crash are written to a file on the hard disk. This file is called a crash dump. The page file or dedicated dump file is used to write a crash dump file (memory.dmp). To get useful information from the dump file and to prevent it from being corrupted or incomplete, the page file or the dedicated dump file must be large enough to handle the kind of crash dump that is selected. Make sure that the page file is configured appropriately so that the memory dump can be saved correctly.
For more information about how to understand bugchecks and crash dumps, see the following Performance Team Blog articles:
How to obtain a tool to automate the registry keys and paging files
- Download DumpConfigurator.hta from the following Microsoft website:
- Click Download, and then click I Agree after you read the Microsoft Software License Terms.
- Save the WInPlatTools-14600.zip file, and then extract the DumpConfigurator.hta tool.
- Click DumpConfigurator.hta, and then click Auto Config Complete.
For recommended Pagefile settings for different crash dump type, go to the following Knowledge Base article:
To make sure that the system is configured for a good memory dump, go to the following Knowledge Base article:
Obtaining blue screen information after a memory dump file is created:
A Windows-based operating system writes an event log message that includes bugcheck information. The following is an example of the event log entry:
Event ID: 1001
Description: The computer has rebooted from a bugcheck. The bugcheck was: 0xc00000E2 (0xffffffffffffffff, 0x0000000000000001, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\WINDOWS\MEMORY.DMP.
Windows Bugcheck Analysis
Working with Crashdumps - Debugger 101
Debug 101: What does !analyze do?
Αναγνωριστικό άρθρου: 3106831 - Τελευταία αναθεώρηση: 10/22/2015 00:02:00 - Αναθεώρηση: 1.0