Article ID: 885117
Article Last Modified on 10/30/2006
APPLIES TO
- Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
- Microsoft Windows Server 2003, Standard Edition (32-bit x86)
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
SYMPTOMS
You may experience one or more of the following symptoms:
- When you try to view a memory dump on your Microsoft Windows 2000-based computer, the memory dump file may be corrupted, and you cannot open the file.
- The Write debugging information list setting in the Startup and Recovery dialog box is set to Kernel Memory Dump, but a complete memory dump is performed on your Windows 2000-based computer or on your Microsoft Windows Server 2003-based computer.
CAUSE
This issue may occur if all the following conditions are true:
- You have increased the amount of memory in your computer to 2 gigabytes (GB) or more.
Note The memory dump file will be corrupted on a Windows 2000-based computer if you increase the memory to 4 GB or more. - You have installed the hotfix that is described in Microsoft Knowledge Base article 820361 or you have installed the hotfix that is described in security hotfix MS04-011.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:835732 MS04-011: Security Update for Microsoft Windows
- The value of the CrashDumpEnabled entry in the registry has been set to 0x1.
When you add memory to a computer that is running Windows 2000 or Windows Server 2003, the value of the CrashDumpEnabled registry entry is not changed to reflect the increased amount of memory. The value 0x1 is assigned to the CrashDumpEnabled registry entry when a complete memory dump is to be completed by Windows. The value 0x2 is assigned to the CrashDumpEnabled registry entry when a kernel memory dump is to be completed by Windows. When you increase the amount of memory in the computer that is running Windows to more than 2 GB, it is expected that the complete memory dump setting will be changed to the kernel memory dump setting in both the CrashDumpEnabled registry entry and the Write debugging information list setting in the Startup and Recovery dialog box.
For example, when you install Windows on a computer with 2 GB of memory, the Write debugging information list setting in the Startup and Recovery dialog box of System Properties is Complete Memory Dump. The corresponding CrashDumpEnabled registry entry is set to the value of 0x1.
If you add memory to the computer that is running Windows so that the total memory is more than 2 GB, the Write debugging information list setting is changed to Kernel Memory Dump. However, the CrashDumpEnabled registry entry retains the value of 0x1.
If the computer stops unexpectedly, and a memory dump occurs, the IopReadDumpRegistry() function reads the value of the CrashDumpEnabled entry from the registry. However, the IopReadDumpRegistry() function has a hard-coded limitation that will override the registry value of 0x1 and will perform a kernel memory dump if the function detects that the server has more than 2 GB of memory. Therefore, if the server stops, a kernel memory dump is performed instead of a complete memory dump.
When you install hotfix 820361 or security hotfix MS04-011 on a Windows 2000-based computer, the hard-coded 2 GB memory limitation is removed from the IopReadDumpRegistry() function. Therefore, if you increase the memory in your computer to more than 2 GB, Windows 2000 will try to create a complete memory dump instead of a kernel memory dump if the computer stops unexpectedly.
If you increase the memory to 4 GB or more on a Windows 2000-based computer, Windows 2000 cannot perform a complete memory dump, and the memory dump file is corrupted.
Note Windows Server 2003 can perform a complete memory dump regardless of the amount of memory that is installed in the computer. For example, assume that the Startup and Recovery setting and the CrashDumpEnabled registry entry are set to perform a kernel memory dump and a complete memory dump respectively. If you have 4 GB of memory on your computer, a complete memory dump occurs if you have a large enough paging file on the system partition. The paging file must be the size of physical memory plus 1 megabyte (MB).
The CrashDumpEnabled registry entry is located in the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
WORKAROUND
Hotfix to correct the Write debugging information list display in Windows 2000
To work around the incorrect Write debugging information list display issue on a Windows 2000-based computer, apply the hotfix that is described in Knowledge Base article 837297. After you apply this hotfix, the setting is synchronized with the registry value in the Write debugging information list. If your computer has more than 2 GB of memory, and the CrashDumpEnabled registry entry is assigned the value 0x1, the Complete Memory Dump option is selected in the Write debugging information list. If the CrashDumpEnabled registry entry is not assigned the value 0x1, the Complete Memory Dump option is not displayed in the Write debugging information list.
For more information about this hotfix, click the following article number to view the article in the Microsoft Knowledge Base:
837297 Crash memory dump file created is different from the type selected in Windows 2000 Startup and Recovery settings
Hotfix to correct the Write debugging information list display in Windows Server 2003
A Windows Server 2003 version of the hotfix that is described in Knowledge Base article 837297 is scheduled to be included in Windows Server 2003 Service Pack 1.
Microsoft Visual Basic script to force Windows 2000 with 4 GB of memory to write a kernel memory dump
To force a Windows 2000-based computer that has 4 GB or more of memory to write only a kernel memory dump, you can use the following Visual Basic script.
Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.
########## Start of VBS script ##########
On Error Resume Next
Const ForAppending=8
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("c:\memoryCheck.txt", ForAppending, True)
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery _
("Select * from Win32_OperatingSystem")
For Each objOperatingSystem in colOperatingSystems
OSNum="5.0.2195"
csName=objOperatingSystem.CSName
objLogFile.Write csName
objLogFile.Writeline
objLogFile.Write objOperatingSystem.Caption & " " & objOperatingSystem.Version
objLogFile.Writeline
objMemory = objOperatingSystem.TotalVisibleMemorySize
objLogFile.Write "Memory Size:" & objMemory& "KB"
objLogFile.Writeline
Set wshell = CreateObject("WScript.Shell")
crashControl = Wshell.RegRead("HKLM\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled")
objLogFile.Write "CrashDumpEnabled:" & crashControl
objLogFile.Writeline
'verify whether os is 2000 server
If (InStr(1,objOperatingSystem.Version,OSNUm)>1) and (objOperatingSystem.ProductType >1) Then
objMemory = objOperatingSystem.TotalVisibleMemorySize
'verify whether menory is >4G
If objMemory >= 4194304 Then
'modify registry "CrashDumpEnabled" value to 2 and get the CSName if value is 1
If crashControl=1 Then
Const HKEY_LOCAL_MACHINE = &H80000002
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")
strKeyPath = "System\CurrentControlSet\Control\CrashControl"
strValueName = "CrashDumpEnabled"
dwValue = 2
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
objLogFile.Write "CrashDumpEnabled has been modified from 1 to 2"
objLogFile.Writeline
Wscript.Echo "CrashDumpEnabled has been modified from 1 to 2"
End If
End If
End If
Next
objLogFile.Close
########## End of VBS script ##########
MORE INFORMATION
The following tables show the type of crash dump that occurs and what the Write debugging information setting displays in the Startup and Recovery dialog box. These items depend upon the value that is assigned to the CrashDumpEnabled registry entry and the amount of memory that is installed in the computer.
Windows 2000 before hotfix 820361 is installed, before update MS04-011 is installed, or before update 891861 is installed
Registry value 0x1
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Complete | Kernel | Kernel |
| User interface display | Complete | Kernel | Kernel |
Registry value 0x2
| Amount of Memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Kernel | Kernel | Kernel |
| User interface display | Kernel | Kernel | Kernel |
Windows 2000 after hotfix 820361 is installed, after update MS04-011 is installed, or after update 891861 is installed
Registry value 0x1
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Complete | Complete | Corrupted Complete |
| User interface display | Complete | Kernel | Kernel |
Registry value 0x2
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Kernel | Kernel | Kernel |
| User interface display | Kernel | Kernel | Kernel |
Windows Server 2003 before hotfix 820361 is installed, before update MS04-011 is installed, or before Service Pack 1 is installed
Registry value 0x1
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Complete | Complete | Complete |
| User interface display | Complete | Kernel | Kernel |
Registry value 0x2
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Kernel | Kernel | Kernel |
| User interface display | Kernel | Kernel | Kernel |
Windows Server 2003 after hotfix 820361 is installed, after update MS04-011 is installed, or after Service Pack 1 is installed
Registry value 0x1
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Complete | Complete | Complete |
| User interface display | Complete | Kernel | Kernel |
Registry value 0x2
| Amount of memory | 2 GB or less | 2 GB - 4 GB | 4 GB or more |
|---|---|---|---|
| Dump type executed | Kernel | Kernel | Kernel |
| User interface display | Kernel | Kernel | Kernel |
Keywords: kbtshoot kbprb KB885117
