Configure Windows Server to Generate Full Crash Dumps

Products

• CA Security Command Center

Issue/Introduction

This document details how to configure the Windows Server OS to generate Full User-Process Dumps when an application process crashes unexpectedly.

Environment

PRODUCT: Siteminder

COMPONENT: Policy Server, Web Server, Access Gateway Server

VERSION: ANY

OS: Windows Server

Cause

The Windows Server Operating System is not configured to generate full crash dumps for application processes by default.  This needs to be manually configured.  

Resolution

1) Logon to the Windows Server you want to configure to capture user-mode process dumps

2) Open the Windows Registry

Start -> Run -> Regedit

3) Browse to the following registry hive:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

4) Create the following keys:

KeyName: DumpFolder
Data Type: REG_EXPAND_SZ
Value: %LOCALAPPDATA%\CrashDumps

KeyName: DumpCount
Data Type: REG_DWORD
Value: 3

KeyName: DumpType
Data type: REG_DWORD
Value: 2

Data Values:
0 = Create a custom dump 
1 = Mini dump 
2 = Full dump

NOTE: Configure Full Dumps.

The next time an application process crashes a dump file will be created.

Additional Information

You can generate a Dump file using TaskManager, however that dumps the stack of a running process.  It will not tell us what was in the stack at the time the process crashed.  

ADPlus is an older tool which is part of the Debugging Tools for Windows.  It can be installed and configured to generate user mode process dumps too.  However, it must be run against a specific running process in order to capture the crash, when it eventually happens.