Knowledge Base

How to configure system failure and recovery options in Windows

Article ID: 307973

Article Last Modified on 5/23/2006

APPLIES TO

Microsoft Windows Server 2003, 64-Bit Datacenter Edition
Microsoft Windows Server 2003, Enterprise x64 Edition
Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Microsoft Windows Server 2003, Web Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Professional
Microsoft Windows XP Professional for Itanium-based systems
Microsoft Windows XP Media Center Edition 2002
Microsoft Windows XP Tablet PC Edition
Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Professional Edition
Microsoft Windows 2000 Server
Microsoft Windows Small Business Server 2003 Premium Edition
Microsoft Windows Small Business Server 2003 Standard Edition

This article was previously published under Q307973

SUMMARY

You can configure the actions that Windows takes when a system error (also referred to as a bug check, system crash, fatal system error, or stop error) occurs. You can configure the following actions:

Write an event to the System log.
Alert administrators (if you have set up administrative alerts).
Put system memory in a file that advanced users can use for debugging.
Automatically restart the computer.

You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure.

MORE INFORMATION

Configuring System Failure and Recovery Options

You can use the System control panel to configure system failure and recovery options. IT Professionals can also modify system failure and recovery settings on local or remote computers by modifying the values in the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

In the following steps, the registry value is provided for each option with a sample command line to modify the option on your local computer by using the command-line utility (Wmic.exe) to access Windows Management Instrumentation (WMI). See the Additional Information for IT Professionals section of this article for more information. To configure system failure and recovery options, follow these steps:

Right-click My Computer, and then click Properties.
Click the Advanced tab, and then under Startup and Recovery, click Settings (or Startup and Recovery).
Under System Failure, click to select the check boxes for the actions that you want Windows to perform if a system error occurs:
- The Write an event to the System log option specifies that event information is recorded in the System log. By default, this option is turned on. On computers that are running the Windows 2000 Server or Windows Server 2003 family operating systems, you cannot turn off this feature. Windows always writes event information to the System log. To turn off this option by modifying the registry on a Windows XP or Windows 2000 Professional-based computer, set the LogEvent DWORD value to 0. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set WriteToSystemLog = False
- The Send an administrative alert option specifies that administrators are notified of the system error if you configured administrative alerts. By default, this option is turned on. To turn off this option by modifying the registry, set the SendAlert DWORD value to 0. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set SendAdminAlert = False
  
  For more information about how to set an alert, click the following article number to view the article in the Microsoft Knowledge Base:
  
  310490 How to set up administrative alerts in Windows XP
- The Automatically restart option specifies that Windows automatically restarts your computer. By default, this option is enabled. To turn off this option by modifying the registry, set the AutoReboot DWORD value to 0. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set AutoReboot = False
Under Write Debugging Information, select the type of information that you want Windows to record in a memory dump file if the computer stops unexpectedly:
- The (none) option does not record any information in a memory dump file. To specify that you do not want Windows to record information in a memory dump file by modifying the registry, set the CrashDumpEnabled DWORD value to 0. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set DebugInfoType = 0
- The Small Memory Dump option records the smallest amount of information to help identify the problem. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of your computer and specifies that Windows will create a new file each time the system stops unexpectedly. A history of these files is stored in the folder that is listed under Small Dump Directory (%SystemRoot%\Minidump). In Windows XP and Windows Server 2003, the small memory dump file is used with the Windows Error Reporting feature. To specify that you want to use a small memory dump file by modifying the registry, set the CrashDumpEnabled DWORD value to 3. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set DebugInfoType = 3
  
  To specify that you want to use the D:\Minidump folder as your Small Dump Directory by modifying the registry, set the MinidumpDir Expandable String Value to D:\Minidump. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set MiniDumpDirectory = D:\Minidump
- The Kernel Memory Dump option records only kernel memory. This option stores more information than a small memory dump file, but it takes less time to complete than a complete memory dump file. The file is stored in theDump Filebox (%SystemRoot%\Memory.dmp by default), and any previous kernel or complete memory dump files are overwritten if the Overwrite any existing file check box is selected. If you set this option, you must have a sufficiently large paging file on the boot volume. The required size depends on the amount of RAM in your computer (although the maximum amount of space that must be available for a kernel memory dump on a 32-bit system is 2 GB plus 16 MB; on a 64-bit system, the maximum amount of space that must be available for a kernel memory dump is the size of the RAM plus 128 MB). The following table contains guidelines for the size of the paging file:
  
  RAM size Paging file should be no smaller than
  
  256 MB–1,373 MB 1.5 times the RAM size
  
  1,374 MB or greater 32-bit system: 2 GB plus 16 MB
  
  64-bit system: size of the RAM plus 128 MB
  
  To specify that you want to use a kernel memory dump file by modifying the registry, set the CrashDumpEnabled DWORD value to 2. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set DebugInfoType = 2
  
  To specify that you want to use the D:\Dump\Mem.dmp file as your memory dump file by modifying the registry, set the DumpFile Expandable String Value to D:\Dump\Mem.dmp. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set DebugFilePath = D:\Dump\Mem.dmp
  
  To specify that you do not want to overwrite any previous kernel or complete memory dump files by modifying the registry, set the Overwrite DWORD value to 0. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set OverwriteExistingDebugFile = 0
- The Complete Memory Dump option records the contents of system memory when the computer stops unexpectedly. This option is not available on computers with 2 or more GB of RAM. For more information about this issue, click the following article number to view the article in the Microsoft Knowledge Base:
  
  274598 Complete memory dumps Not available on computers with 2 or more gigabytes of RAM
  
  If you select this option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 MB. The file is stored as specified in theDump Filebox (%SystemRoot%\Memory.dmp by default).
  
  The extra MB is required for a complete memory dump file because Windows writes a header in addition to dumping the memory contents. The header contains a crash dump signature and specifies the values of some kernel variables. The header information does not require a full MB of space, but Windows sizes your paging file in increments of MBs.
  
  To specify that you want to use a complete memory dump file by modifying the registry, set the CrashDumpEnabled DWORD value to 1. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set DebugInfoType = 1
  
  To specify that you want to use the D:\Dump\Mem.dmp file as your memory dump file by modifying the registry, set the DumpFile Expandable String Value to D:\Dump\Mem.dmp. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set DebugFilePath = D:\Dump\Mem.dmp
  
  To specify that you do not want to overwrite any previous kernel or complete memory dump files by modifying the registry, set the Overwrite DWORD value to 0. For example, type the following information at a command prompt, and then press ENTER:
  
  wmic recoveros set OverwriteExistingDebugFile = 0.
Note If you contact Microsoft Product Support Services about a stop error, you might be asked for the memory dump file that is generated by the Write Debugging Information option. For more information about these Windows memory dump file options, click the following article number to view the article in the Microsoft Knowledge Base:

254649 Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000

back to the top

Additional Information for IT Professionals

The sample commands in the previous procedures use Wmic.exe to configure system failure and recovery options in the Windows registry. Wmic.exe is included with Windows XP and Windows Server 2003. Wmic.exe is not included with Windows 2000, but you can run Wmic.exe on a Windows XP- or Windows Server 2003-based computer to set some system failure and recovery settings on a remote Windows 2000-based computer. The DebugInfoType property is not supported on Windows 2000-based computers. For more information about the Wmic.exe utility, click the following article number to view the article in the Microsoft Knowledge Base:

290216 A description of the Windows Management Instrumentation command-line utility

To view system failure and recovery settings for your local computer, type wmic recoveros at a command prompt, and then press ENTER. To view system failure and recovery settings for a remote computer on your local area network, type wmic /node:"computer_name" recoveros at a command prompt, and then press ENTER. Note that to successfully use these Wmic.exe command line examples, you must be logged on by using a user account that has administrative rights on the computer. If you are not logged on by using a user account that has administrative rights on the computer, use the /user:user_name and /password:password switches.

You can also use Registry Editor or another utility to edit these registry values on a Windows XP-, Windows 2000-, or Windows 2003-based computer. For more information about editing the Windows registry, click the following article numbers to view the articles in the Microsoft Knowledge Base:

322756 How to back up, edit, and restore the registry in Windows XP and Windows Server 2003

322755 How to back up, edit, and restore the registry in Windows 2000

back to the top

Troubleshooting

To take advantage of the dump file feature, your paging file must be on the boot volume. If you have moved the paging file to another volume, you must move it back to the boot volume before you use this feature.
If you set theKernel Memory Dump or the Complete Memory Dump option, and you select the Overwrite any existing file check box, Windows always writes to the same file name. To save individual dump files, click to clear the Overwrite any existing file check box, and then change the file name after each stop error.
You can save some memory if you click to clear the Write an event to the system log and Send an administrative alert check boxes. The memory that you save depends on the computer, but these features typically require about 60 to 70 KB.
For more information about how to configure your computer to generate a dump file for testing purposes, click the following article number to view the article in the Microsoft Knowledge Base:

244139 Windows feature allows a Memory.dmp file to be generated with keyboard
For more information about tools that you can use to read the contents of a small memory dump, click the following article number to view the article in the Microsoft Knowledge Base:

315263 Reading the small memory dump files that Windows XP can create for debugging
For more information about procedures to identify the cause of STOP messages before you contact Microsoft Product Support Services, click the following article number to view the article in the Microsoft Knowledge Base:

314103 Preparation before you contact Microsoft after receiving a STOP message on a blue screen

Keywords: kbenv kbhowtomaster KB307973

Microsoft KB Archive/307973

Contents