BSOD Change BSOD Crash Memory Dump File Type in Windows 11

This tutorial will show you how to change which BSOD memory dump file type will be generated in Windows 11.

A BSOD (blue screen of death) error (also called a stop error) can occur if a problem causes your PC to shut down or restart unexpectedly (aka: crash). When you experience this type of error, you won’t be able to see things like the Start menu or the taskbar on the screen when your PC is turned on. Instead you might see a blue screen with a message that your PC ran into a problem and needs to restart.

If you experience a BSOD, Windows 11 will create an Automatic memory dump type of dump file by default for debugging purposes.

You can have Windows generate any one of the following memory dump file types:

• (none) for no dump file
• Small memory dump (256 KB)
• Kernel memory dump
• Complete memory dump
• Automatic memory dump
• Active memory dump

A Small Memory Dump is much smaller than the other two kinds of kernel-mode crash dump files. It is exactly 256 KB in size, and requires only 256 KB of pagefile space on the boot drive.

This dump file includes the following:

• The bug check message and parameters, as well as other blue-screen data.
• The processor context (PRCB) for the processor that crashed.
• The process information and kernel context (EPROCESS) for the process that crashed.
• The thread information and kernel context (ETHREAD) for the thread that crashed.
• The kernel-mode call stack for the thread that crashed. If this is longer than 16 KB, only the topmost 16 KB will be included.
• A list of loaded drivers.
• A list of loaded modules and unloaded modules.
• The debugger data block. This contains basic debugging information about the system.
• Any additional memory pages that Windows identifies as being useful in debugging failures. This includes the data pages that the registers were pointing to when the crash occurred, and other pages specifically requested by the faulting component.

This kind of dump file can be useful when space is greatly limited. However, due to the limited amount of information included, errors that were not directly caused by the thread executing at time of crash may not be discovered by an analysis of this file.

Since this kind of dump file does not contain images of any executables residing in memory at the time of the crash, you may also need to set the executable image path if these executables turn out to be important.



A Kernel Memory Dump contains all the memory in use by the kernel at the time of the crash.

This kind of dump file is significantly smaller than the Complete Memory Dump. Typically, the dump file will be around one-third the size of the physical memory on the system. This quantity will vary considerably, depending on your circumstances.

This dump file will not include unallocated memory, or any memory allocated to user-mode applications. It only includes memory allocated to the Windows kernel and hardware abstraction layer (HAL), as well as memory allocated to kernel-mode drivers and other kernel-mode programs.

For most purposes, this crash dump is the most useful. It is significantly smaller than the Complete Memory Dump, but it only omits those portions of memory that are unlikely to have been involved in the crash.

Since this kind of dump file does not contain images of any user-mode executables residing in memory at the time of the crash, you may also need to set the executable image path if these executables turn out to be important.



A Complete Memory Dump is the largest kernel-mode dump file. This file includes all of the physical memory that is used by Windows. A complete memory dump does not, by default, include physical memory that is used by the platform firmware.

This dump file requires a pagefile on your boot drive that is at least as large as your main system memory; it should be able to hold a file whose size equals your entire RAM plus one megabyte.



An Automatic Memory Dump contains the same information as a Kernel Memory Dump. The difference between the two is not in the dump file itself, but in the way that Windows sets the size of the system paging file.

If the system paging file size is set to System managed size, and the kernel-mode crash dump is set to Automatic Memory Dump, then Windows can set the size of the paging file to less than the size of RAM. In this case, Windows sets the size of the paging file large enough to ensure that a kernel memory dump can be captured most of the time.

If the computer crashes and the paging file is not large enough to capture a kernel memory dump, Windows increases the size of the paging file to at least the size of RAM. The time of this event is recorded here in the Registry:

HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\LastCrashTime

The increased paging file size stays in place for 4 weeks and then returns to the smaller size.



An Active Memory Dump is similar to a Complete Memory Dump, but it filters out pages that are not likely to be relevant to troubleshooting problems on the host machine. Because of this filtering, it is typically significantly smaller than a complete memory dump.

This dump file does include any memory allocated to user-mode applications. It also includes memory allocated to the Windows kernel and hardware abstraction layer (HAL), as well as memory allocated to kernel-mode drivers and other kernel-mode programs. The dump includes active pages mapped into the kernel or user space that are useful for debugging, as well as selected Pagefile-backed Transition, Standby, and Modified pages such as the memory allocated with VirtualAlloc or page-file backed sections. Active dumps do not include pages on the free and zeroed lists, the file cache, guest VM pages and various other types of memory that are not likely to be useful during debugging.

An Active Memory Dump is particularly useful when Windows is hosting virtual machines (VMs). When taking a complete memory dump, the contents of each VM is included. When there are multiple VMs running, this can account for a large amount of memory in use on the host system. Many times, the code activities of interest are in the parent host OS, not the child VMs. An active memory dump filters out the memory associated with all of the child VMs.

References:

You must be signed in as an administrator to change the BSOD memory dump file type.

1 Open Settings (Win+I).

2 Click/tap on System on the left side, and click/tap on About on the right side. (see screenshot below)



3 Click/tap on the Advanced system settings link, and close Settings. (see screenshot below)


4 In the Advanced tab of System Properties (SystemPropertiesAdvanced.exe), click/tap on the Settings button under Startup and Recovery. (see screenshot below)


5 Select the dump file type you want in the Write debugging information drop menu, and click/tap on OK. (see screenshot below)

Automatic memory dump is the default dump file type.

6 If prompted a restart is required, click/tap on OK to confirm. (see screenshot below)


7 Click/tap on OK. (see screenshot below)


8 If a restart is required, click/tap on Restart Now to restart the computer. (see screenshot below)

Be sure to save and close everything before clicking on Restart Now.

1 Open Windows Terminal (Admin), and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below you want to use into Windows Terminal (Admin), and press Enter. (see screenshots below)

0 = (none)
1 = Complete memory dump
2 = Kernel memory dump
3 = Small memory dump (256 KB)
7 = Automatic memory dump

3 Close Windows Terminal (Admin).

4 Restart the computer to apply.





1 Do step 2 (none), step 3 (small), step 4 (kernel), step 5 (complete), step 6 (automatic), step 7 (active) below for the dump file type you want.





(Contents of REG file for reference)





(Contents of REG file for reference)





(Contents of REG file for reference)





(Contents of REG file for reference)

This is the default setting.

(Contents of REG file for reference)





(Contents of REG file for reference)

8 Save the .reg file to your desktop.

9 Double click/tap on the downloaded .reg file to merge it.

10 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

11 Restart the computer to apply.

12 You can now delete the downloaded .reg file if you like.


That's it,
Shawn Brink