A live kernel dump creates a consistent snapshot of kernel memory and saves it to a dump file without having to restart the computer.
The goal of kernel live dump is to gather data to trouble shoot an abnormal situation, but allow the OS to continue operation. This reduces downtime when compared to a bug check for “non-fatal” but high-impact failures and hangs. Kernel live dumps are used when it is possible to recover the OS to a known good state.
Starting with Windows 11 build 25188, some got a new Create live kernel dump file option inside the Task Manager, but it didn't work yet. It is now available and working starting with Windows 11 build 25197.
This tutorial will show you how to create a live kernel dump file in Windows 11.
You must be signed in as an administrator to create a live kernel dump file.
This option is only available for some starting with Windows 11 build 25197.
Open Task Manager (Ctrl+Shift+Esc).
Perform the following actions: (see screenshot below)
- Click/tap on the Details tab.
- Right click on an empty area in Details.
- Click/tap on Create live kernel dump file.
- Click/tap on Full live kernel dump or Kernel stacks dump for which type of dump file you want to create.
You will now see a Dumping kernel dialog showing you the location of the dump file. You can click/tap on OK to close the dialog, or click/tap on Open file location to open File Explorer to the dump file's location. (see screenshot below)
Open Windows Terminal (Admin), and select Windows PowerShell.
Copy and paste the command below into PowerShell, and press Enter to get the StorageSubsystem friendly name. (see screenshot below step 3)
Make note of the StorageSubsystem friendly name (ex: "Windows Storage on BrinkW11"). (see screenshot below)
Type the command below into PowerShell, and press Enter. (see screenshot below)
Get-StorageDiagnosticInfo -StorageSubSystemFriendlyName "<name>" -IncludeLiveDump -DestinationPath "$Env:userprofile\Desktop"
Substitute <name> in the command above with the actual StorageSubsystem friendly name (ex: "Windows Storage on BrinkW11") from step 3.
Get-StorageDiagnosticInfo -StorageSubSystemFriendlyName "Windows Storage on BrinkW11" -IncludeLiveDump -DestinationPath "$Env:userprofile\Desktop"
A localhost folder will now be created on your desktop that includes the live kernel dump file. (see screenshot below)