This page has been machine-translated from the original page.
I got tired of manually configuring full memory dump collection every time, so I wrote a PowerShell script to automate the settings.
The basic settings are based on the following official blog post.
Reference: Configuring Complete Memory Dump Output | Microsoft Japan Windows Technology Support Blog
In addition to configuring full memory dump collection, I also changed the user-mode process dump settings so that full dumps can be collected, based on the following public documentation.
Reference: Collecting User-Mode Dumps - Win32 apps | Microsoft Learn
The script is below.
You can also download it from EnableFulldump.ps1.
Administrator privileges are required to run it.
# Settings of Full memory dump
$crashControlRegPath = "HKLM:System\CurrentControlSet\Control\CrashControl"
$isExistKey = Test-Path -LiteralPath $crashControlRegPath
if ($isExistKey -eq $False) {
New-Item -Path $crashControlRegPath
}
New-ItemProperty -LiteralPath $CrashControlRegPath -Name "CrashDumpEnabled" -PropertyType "DWord" -Value "1" -Force
New-ItemProperty -LiteralPath $CrashControlRegPath -Name "AutoReboot" -PropertyType "DWord" -Value "1" -Force
New-ItemProperty -LiteralPath $CrashControlRegPath -Name "DumpFile" -PropertyType "ExpandString" -Value "%SystemRoot%\FULL_MEMORY.DMP" -Force
New-ItemProperty -LiteralPath $CrashControlRegPath -Name "LogEvent" -PropertyType "DWord" -Value "1" -Force
# Settings of Full application dump
$localDumpsRegPath = "HKLM:SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"
$isExistKey = Test-Path -LiteralPath $localDumpsRegPath
if ($isExistKey -eq $False) {
New-Item -Path $localDumpsRegPath
}
New-ItemProperty -LiteralPath $localDumpsRegPath -Name "DumpFolder" -PropertyType "ExpandString" -Value "%LOCALAPPDATA%\CrashDumps" -Force
New-ItemProperty -LiteralPath $localDumpsRegPath -Name "DumpCount" -PropertyType "DWord" -Value "2" -Force
New-ItemProperty -LiteralPath $localDumpsRegPath -Name "DumpType" -PropertyType "DWord" -Value "2" -Force
# Disable CrashOnCtrlScroll
$parameterRegPaths = @("HKLM:System\CurrentControlSet\Services\i8042prt\Parameters",
"HKLM:System\CurrentControlSet\Services\kbdhid\Parameters",
"HKLM:System\CurrentControlSet\Services\hyperkbd\Parameters"
)
foreach ($parameterRegPath in $parameterRegPaths) {
$isExistKey = Test-Path -LiteralPath $parameterRegPath
if ($isExistKey -eq $False) {
New-Item -Path $parameterRegPath
}
New-ItemProperty -LiteralPath $parameterRegPath -Name "CrashOnCtrlScroll" -PropertyType "DWord" -Value "0" -Force
}
# Setting alt dump key
$parameterRegPaths = @("HKLM:System\CurrentControlSet\Services\i8042prt\crashdump",
"HKLM:System\CurrentControlSet\Services\kbdhid\crashdump",
"HKLM:System\CurrentControlSet\Services\hyperkbd\crashdump"
)
foreach ($parameterRegPath in $parameterRegPaths) {
$isExistKey = Test-Path -LiteralPath $parameterRegPath
if ($isExistKey -eq $False) {
New-Item -Path $parameterRegPath
}
New-ItemProperty -LiteralPath $parameterRegPath -Name "Dump1Keys" -PropertyType "DWord" -Value "0x2" -Force
New-ItemProperty -LiteralPath $parameterRegPath -Name "Dump2Key" -PropertyType "DWord" -Value "0x3d" -Force
}
# Change PageFileSize
$totalPhysicalMemSize = $([Math]::Round((Get-WmiObject Win32_OperatingSystem).TotalVisibleMemorySize / 1024))
$freeStorageSizeofC = $([Math]::Round(((Get-PSDrive C).Free / 1024 / 1024)))
$pageFileSize = $totalPhysicalMemSize + 400
$pageFileSetting = "c:\pagefile.sys $pageFileSize $pageFileSize"
if (($freeStorageSizeofC -gt $pageFileSize) -eq $True) {
New-ItemProperty -LiteralPath "HKLM:System\CurrentControlSet\Control\Session Manager\Memory Management" -Name "PagingFiles" -PropertyType "MultiString" -Value $pageFileSetting -Force
} else {
Write-Warning "C drive space is too small."
}Note that the script above configures keyboard crashes in addition to full dump collection.
The keyboard on the ThinkPad that I mainly use does not have a CtrlScroll key, so I configured an alternative key instead of CrashOnCtrlScroll.
After applying the settings in the script above, reboot the OS and press [right CTRL + Space twice] to trigger a keyboard crash. After the system restarts, you can obtain the full dump from C:\Windows\FULL_MEMORY.DMP.
Keyboard dump triggering does not work over an RDP connection or through a Hyper-V enhanced session, so you need to use the console or a tool such as NotMyFault.