If a Kernel memory dump is needed for troubleshooting purposes, the following methods may be used:

        Crash.exe (available with Microsoft Support)– both the command line and GUI versions of Crash.exe may be used to create a memory dump file on Server Core.

        CrashOnCTRLScroll – the “CTRL+Scroll Lock+Scroll Lock” keyboard sequence may be used to “crash” a server to create a memory dump file after editing the registry to add the CrashOnCTRLScroll DWORD value, set to 1, in the following key and restarting the server:



The CrashOnCTRLScroll process is described in the following Knowledge Base article:

244139    Windows feature lets you generate a memory dump file by using the keyboard


As with previous versions of Windows, prior to creating a memory dump, the paging file and memory dump type must be configured and the server must be restarted. To create a Complete memory dump, the paging file must be located on the System drive and sized to at least  (installed memory + 50MB). The paging file may be configured using the steps discussed in the “Configure the Paging File” topic in the Initial Configuration of Server Core section of this module.

By default, Windows Server 2008 is configured to create a Kernel memory dump when a Kernel exception occurs. The memory dump type is defined by the CrashDumpEnabled DWORD value in the following registry key:


Valid CrashDumpEnabled registry values are as follows:

        0x0 = None

        0x1 = Complete memory dump

        0x2 = Kernel memory dump

        0x3 = Small memory dump (64KB)

Other settings that are available in the Startup and Recovery options on a full installation of Windows Server 2008 are also located in the CrashControl registry key as shown in the following table.

Table 16: Full Windows Server 2008 Startup and Recovery Option Registry Values

Startup and Recovery UI Option

Registry value (value range)

Write an event to the System log

Logevent (0, 1)

Automatically restart

AutoReboot (0,1)

Write debugging information

CrashDumpEnabled (see above)

Dump file

DumpFile (path\<dump file name>.dmp)

Overwrite any existing file

Overwrite (0,1)