Article ID: 244139
Article Last Modified on 12/4/2007
APPLIES TO
- Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
- Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
- Microsoft Windows Server 2003, Datacenter x64 Edition
- Microsoft Windows Server 2003, Enterprise x64 Edition
- Microsoft Windows Server 2003, Standard x64 Edition
- Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows Server 2003, Web Edition
This article was previously published under Q244139
Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows registry
SUMMARY
Windows includes a feature that you can use to cause the system to stop responding and to generate a memory dump file (Memory.dmp). When you do this, you receive a Stop error message that resembles the following:
After you enable the feature, you can generate a memory dump file by holding down the right CTRL key and pressing the SCROLL LOCK key two times. The feature is available for both PS/2 and universal serial bus (USB) keyboards. PS/2 keyboards use the i8042prt.sys driver that is included with the keyboard. However, for USB keyboards you must install a hotfix for the Kbdhid.sys driver. For more information about this hotfix, see the "Windows Server 2003 resolution" subsection at the end of the "More Information" section.
Note There is a limitation with the Kbdhid.sys driver that allows for you to generate the memory dump process by using a USB keyboard. The CTRL+SCROLL LOCK+SCROLL LOCK keyboard shortcut does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver operates at a lower IRQL than the i8042prt.sys driver. The USB keyboard feature only works on computers that are running Microsoft Windows Server 2003.
MORE INFORMATION
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
By default, this feature is disabled. To enable this feature on a computer that uses a PS/2 Keyboard, modify the registry as indicated in this article, and then restart the computer. After you restart the computer, you can generate a Memory.dmp file by holding down the CTRL key and pressing the SCROLL LOCK key two times. You must use the CTRL key on the right side of the spacebar. On a computer that uses a USB keyboard, you do not have to restart the computer. Unplugging the keyboard and plugging it back again is sufficient. After that, the Memory.dmp file can be generated.
To enable the feature on a computer that uses a PS/2 keyboard, follow these steps:
- Start Registry Editor.
- Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters - On the Edit menu, click Add Value, and then add the following registry entry:
Name: CrashOnCtrlScroll
Data Type: REG_DWORD
Value: 1 - Exit Registry Editor, and then restart the computer.
To enable the feature on a computer that uses a USB keyboard, install the hotfix that is mentioned in the "Windows Server 2003 resolution" subsection at the end of the "More Information" section.
To make sure that the feature is enabled on a computer that uses a USB keyboard, follow these steps:
- Start Registry Editor.
- Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters - Make sure that the following registry entry is enabled:
Name: CrashOnCtrlScroll
Data Type: REG_DWORD
Value: 1 - Exit Registry Editor.
How to select memory dump file options
Three types of memory dump files can be generated. Select one before you manually trigger the dump file. To do this, follow these steps:
- Right-click My Computer, and then click Properties.
- Click the Advanced tab, and then click the Startup and Recovery button.
- Click Write Debugging Information, and then click to select either Complete Memory Dump, Kernel Memory Dump, or Small Memory Dump.
For more information about memory dump file options, click the following article number to view the article in the Microsoft Knowledge Base:
254649 Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000
Note If the server has a feature such as the Automatic System Restart (ASR) feature that is found in some Compaq computers, disable the feature. It can interrupt the dump process. On a Compaq computer, you can disable the ASR feature by modifying the basic input/output system (BIOS) settings.
Note Complete memory dumps may not be available on a computer that has 2 or more gigabytes (GB) of RAM. To limit the memory that Windows 2000 can access, add the <MaxMem=2000> parameter to the Boot.ini file.
If you have installed the security update that is described in article 835732 in the Microsoft Knowledge Base, or you have installed a service pack that contains this security update, visit the following Microsoft Knowledge Base article:
885117"Kernel Memory Dump" is displayed in Startup and Recovery, but a complete memory dump is performed in Windows 2000 or in Windows Server 2003
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
835732 MS04-011: Security Update for Microsoft Windows
Service pack information
To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 How to obtain the latest service pack for Windows Server 2003
Hotfix information
A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Server 2003 service pack that contains this hotfix.
To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:
Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:
Prerequisites
To apply this hotfix, you must have Windows Server 2003 or Windows Server 2003 Service Pack 1 installed on the computer.
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.
Windows Server 2003, 32-bit (x86-based) versions
| File name | File version | File size | Date | Time | Platform | SP requirement | Service branch |
|---|---|---|---|---|---|---|---|
| Kbdhid.sys | 5.2.3790.493 | 16,896 | 28-Feb-2006 | 00:03 | x86 | None | RTMQFE |
| Kbdhid.sys | 5.2.3790.2649 | 17,408 | 28-Feb-2006 | 03:11 | x86 | SP1 | SP1QFE |
Windows Server 2003, x64-based versions
| File name | File version | File size | Date | Time | Platform |
|---|---|---|---|---|---|
| Kbdhid.sys | 5.2.3790.2649 | 24,576 | 13-Apr-2006 | 15:59 | x64 |
Windows Server 2003, Itanium-based versions
| File name | File version | File size | Date | Time | Platform | SP requirement | Service branch |
|---|---|---|---|---|---|---|---|
| Kbdhid.sys | 5.2.3790.493 | 47,104 | 13-Apr-2006 | 15:54 | IA-64 | None | RTMQFE |
| Kbdhid.sys | 5.2.3790.2649 | 49,664 | 13-Apr-2006 | 15:59 | IA-64 | SP1 | SP1QFE |
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
928839 How to use the keyboard to generate a memory dump file on a Virtual Server 2005 guest computer
Configuring keys to generate the memory dump file
You can configure entries under the following registry subkey to generate the memory dump file:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\crashdump
The REG_DWORD entries are as follows:
Dump1Keys
Dump2Key
The Dump1Keys entry is a bit map of the modifier keys to use. Here are the values:
- define CRASH_R_SHIFT 0x01
- define CRASH_R_CTRL 0x02
- define CRASH_R_ALT 0x04
- define CRASH_L_SHIFT 0x10
- define CRASH_L_CTRL 0x20
- define CRASH_L_ALT 0x40
The Dump2Key entry is the index into the scancode table for the keyboard layout. The following is the actual table in the driver.
Note Index 124 (sysreq) is a special case because an 84-key keyboard has a different scancode.
const UCHAR keyToScanTbl[134] = {
0x00,0x29,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
0x0A,0x0B,0x0C,0x0D,0x7D,0x0E,0x0F,0x10,0x11,0x12,
0x13,0x14,0x15,0x16,0x17,0x18,0x19,0x1A,0x1B,0x00,
0x3A,0x1E,0x1F,0x20,0x21,0x22,0x23,0x24,0x25,0x26,
0x27,0x28,0x2B,0x1C,0x2A,0x00,0x2C,0x2D,0x2E,0x2F,
0x30,0x31,0x32,0x33,0x34,0x35,0x73,0x36,0x1D,0x00,
0x38,0x39,0xB8,0x00,0x9D,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0xD2,0xD3,0x00,0x00,0xCB,
0xC7,0xCF,0x00,0xC8,0xD0,0xC9,0xD1,0x00,0x00,0xCD,
0x45,0x47,0x4B,0x4F,0x00,0xB5,0x48,0x4C,0x50,0x52,
0x37,0x49,0x4D,0x51,0x53,0x4A,0x4E,0x00,0x9C,0x00,
0x01,0x00,0x3B,0x3C,0x3D,0x3E,0x3F,0x40,0x41,0x42,
0x43,0x44,0x57,0x58,0x00,0x46,0x00,0x00,0x00,0x00,
0x00,0x7B,0x79,0x70 };
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
Additional query words: blue screen force dump bluescreen crash memory.dmp manual ctrl scrlk
Keywords: kbwinserv2003sp2fix kbexpertiseadvanced kbwinserv2003presp2fix kbbug kbfix kbhotfixserver kbqfe kbpubtypekc KB244139
