How to Obtain a Kernel Memory Dump file in Server Core of Windows Server 2008

If a Kernel memory dump is needed for troubleshooting
purposes, the following methods may be used:

¦
Crash.exe
(available with Microsoft Support)– both the command line and GUI versions of Crash.exe may be used to create a
memory dump file on Server Core.

¦
CrashOnCTRLScroll
– the “CTRL+Scroll Lock+Scroll Lock” keyboard sequence may be used
to “crash” a server to create a memory dump file after editing the registry to
add the CrashOnCTRLScroll DWORD value, set to 1, in the following key and
restarting the server:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\

Parameters

As with previous versions of Windows, prior to creating a
memory dump, the paging file and memory dump type must be configured and the
server must be restarted. To create a Complete memory dump, the paging file
must be located on the System drive and sized to at least (installed memory + 50MB) .
The paging file may be configured using the steps discussed in the “Configure
the Paging File” topic in the Initial Configuration of Server Core section of
this module.

By default, Windows Server 2008 is configured to create a
Kernel memory dump when a Kernel exception occurs. The memory dump type is
defined by the CrashDumpEnabled DWORD value in
the following registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl

Valid CrashDumpEnabled
registry values are as follows:

¦
0x0
= None

¦
0x1
= Complete memory dump

¦
0x2
= Kernel memory dump

¦
0x3
= Small memory dump (64KB)

Other settings that are available in
the Startup and Recovery options on a full installation of Windows Server 2008
are also located in the CrashControl
registry key as shown in the following table.

Table 16: Full Windows Server 2008 Startup and
Recovery Option Registry Values