Windows feature lets you generate a memory dump file by using the keyboard

Summary

Windows includes a feature that you can use to cause the system to stop responding and to generate a memory dump file (Memory.dmp). When you do this, you receive a Stop error message that resembles the following:
*** STOP: 0x000000E2 (0x00000000,0x00000000,0x00000000,0x00000000)
The end-user manually generated the crashdump.
After you enable the feature, you can generate a memory dump file by holding down the right CTRL key and pressing the SCROLL LOCK key two times. The feature is available for both PS/2 and universal serial bus (USB) keyboards. PS/2 keyboards use the i8042prt.sys driver that is included with the keyboard. However, for USB keyboards that are attached to Windows Server 2003-based systems, you must install a hotfix for the Kbdhid.sys driver.For more information about this hotfix, see the resolution in the "More Information" section.

Note There is a limitation with the Kbdhid.sys driver that allows for you to generate the memory dump process by using a USB keyboard. The CTRL+SCROLL LOCK+SCROLL LOCK keyboard shortcut does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver operates at a lower IRQL than the i8042prt.sys driver.

More Information

For more information on how to resolve this issue visit the following Microsoft Web site:

http://msdn.microsoft.com/en-us/library/ff545499.aspx

Note The USB keyboard feature can be used in Windows Server 2008 if Service Pack 2 or later is installed, or by installing the following hotfix:
971284 A hotfix is available to enable CrashOnCtrlScroll support for a USB keyboard on a computer that is running Windows Vista S971284 or Windows Server 2008

Properties

Article ID: 244139 - Last Review: Sep 11, 2011 - Revision: 1

Feedback