An API that attaches header information to the memory image is available for OEM computers that have "capture memory image" capability in Windows Server 2003

Support for Windows Server 2003 ended on July 14, 2015

Microsoft ended support for Windows Server 2003 on July 14, 2015. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article has been archived. It is offered "as is" and will no longer be updated.
Beta Information
This article discusses a Beta release of a Microsoft product. The information in this article is provided as-is and is subject to change without notice.

No formal product support is available from Microsoft for this Beta product. For information about how to obtain support for a Beta release, see the documentation that is included with the Beta product files, or check the Web location where you downloaded the release.
Some computers can capture a memory image when they stop responding, when performance is extremely slow, or when they crash without providing a crash dump file. After the computer captures the memory image, the computer requires a Microsoft Windows application programming interface (API) to analyze the image with debug tools. This API attaches information that is required for debugging the image. An API for attaching the header information to the memory image is now available. This API is scheduled to be included in Service Pack 1 (SP1) for Microsoft Windows Server 2003.

Update information

A supported feature that modifies the default behavior of the product is available from Microsoft. However, this feature is intended to modify only the behavior that this article describes. Apply this feature only to systems that specifically require it. This feature might receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next software update that contains this feature.

If the feature is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the feature.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific feature. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the feature is available. If you do not see your language, it is because the feature is not available for that language.


Prerequisites are supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Restart requirement

The restart requirement is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

Hotfix replacement information

Hotfix replacement information is supplied by the OEMs that provide the feature to capture a memory image from a non-responding computer.

File information

The English version of this update has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version         Size       File name   ------------------------------------------------------------   06-Mar-2004  00:44  5.2.3790.139    2,407,424  Ntkrnlmp.exe   06-Mar-2004  00:30  5.2.3790.139    2,064,896  Ntkrnlpa.exe   06-Mar-2004  00:30  5.2.3790.139    2,108,416  Ntkrpamp.exe   06-Mar-2004  00:47  5.2.3790.139    2,207,232  Ntoskrnl.exe

API information

The following information applies to this API:
  • The API is restricted to full dumps only. For example, the API is restricted to complete memory images of the computer.
  • The API will not account for any dynamic data, such as contact information or secondary dump callbacks.
  • The API may also lack certain information if the image is captured early in the startup process of the operating system.
  • The API is named "KeInitializeCrashDumpHeader." This API will be documented in the driver development kit (DDK) for Windows Server 2003 SP1 and in the Debug documentation.
Note If the computer can capture a crashed system image "off-line" without the use of Crashdump.sys, set the Startup and Recovery setting for Write debugging information to (none). To do this:
  1. In Control Panel, double-click System.
  2. Click the Advanced tab.
  3. Under Startup and Recovery, click Settings.
  4. In the Write debugging information box, click (none).
The API does not have to have the crash dump selection set in the Write debugging information box to capture the image in memory. You do not have to specify Small Memory dump (64KB) or Kernel memory dump in this box because the new API captures the full image. The API only works for full memory images. The full memory image may be required to completely understand an issue. A small memory dump or a kernel memory dump may not provide enough information to resolve the issue.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

Article ID: 838461 - Last Review: 01/17/2015 16:39:47 - Revision: 3.7

Microsoft Windows Server 2003, Web Edition, Microsoft Windows Server 2003, Standard Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise x64 Edition

  • kbnosurvey kbarchive kbautohotfix kbhowto kbinfo kbbug kbwinserv2003presp1fix kbqfe kbhotfixserver KB838461