Skip to main content

Enabling User Mode Dumps in a ProfileUnity Configuration

Steve Ku
  • Created:
  • Updated:

Problem:

"Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after any user-mode application crashes or after a specific application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature.*"

Possible Resolution(s): 

Add registry rules to enable full user-mode dumps for a ProfileUnity executable and enable the 'Windows Error Reporting Service'. 


Note: If explorer is crashing set the key to:
HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

  1. Add the LocalDumps Key using a registry rule with the following:
    Action: Add Key
    Process Action Post Login: False
    Hive: HKEY_LOCAL_MACHINE
    Key: SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\CrashingApp.exe
  2. Add the following registry rules:
    • Action: Add Value
      Process Action Post Login: False
      Hive: HKEY_LOCAL_MACHINE
      Key: SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\CrashingApp.exe
      Data Type: REG_EXPAND_SZ
      Value: DumpFolder
      Data: C:\CrashDumps
    • Action: Add Value
      Process Action Post Login: False
      Hive: HKEY_LOCAL_MACHINE
      Key: SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\CrashingApp.exe
      Data Type: REG_DWORD
      Value: DumpType
      Data: 2
    • Action: Add Value
      Process Action Post Login: False
      Hive: HKEY_LOCAL_MACHINE
      Key: SYSTEM\CurrentControlSet\Services\WerSvc
      Data Type: REG_DWORD
      Value: Start
      Data: 3

*More details on setting user crash dumps can be found - https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps

If you are experiencing a BSOD the following should allow you to generate dump files. A restart of the machine is needed for the settings to take affect. You may need to place the machine in maintenance mode if your machine is set to refresh on a logoff/restart.

The following values enable NMI crash dump via the "HOLD RIGHT CTRL+PintScreen TWICE" method via VM console.
Add the following registry rules:

  • Action: Add Value
    Process Action Post Login: False
    Hive: HKEY_LOCAL_MACHINE
    Key: SYSTEM\CurrentControlSet\Control\CrashControl
    Data Type: REG_DWORD
    Value: NMICrashDump
    Data: 1
  • Action: Add Value
    Process Action Post Login: False
    Hive: HKEY_LOCAL_MACHINE
    Key: System\CurrentControlSet\Services\i8042prt\Parameters
    Data Type: REG_DWORD
    Value: CrashOnCtrlScroll
    Data: 1
  • Action: Add Value
    Process Action Post Login: False
    Hive: HKEY_LOCAL_MACHINE
    Key: System\CurrentControlSet\Services\kbdhid\Parameters
    Data Type: REG_DWORD
    Value: CrashOnCtrlScroll
    Data: 1
  • Action: Add Value
    Process Action Post Login: False
    Hive: HKEY_LOCAL_MACHINE
    Key: System\CurrentControlSet\Services\hyperkbd\Parameters
    Data Type: REG_DWORD
    Value: CrashOnCtrlScroll
    Data: 1

 For more details: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard 

 

Product: ProfileUnity

Product Version: All versions

 

Related articles