CAUSE
This issue may occur if all the following conditions are true:
- You have increased the amount of memory in your computer to 2 gigabytes (GB) or more.
Note The memory dump file will be corrupted on a Windows 2000-based computer if you increase the memory to 4 GB or more. - You have installed the hotfix that is described in Microsoft Knowledge Base article 820361 or you have installed the hotfix that is described in security hotfix MS04-011.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
835732
MS04-011: Security Update for Microsoft Windows
- The value of the CrashDumpEnabled entry in the registry has been set to 0x1.
When you add memory to a computer that is running Windows 2000 or Windows Server 2003, the value of the CrashDumpEnabled registry entry is not changed to reflect the increased amount of memory.
The value 0x1 is assigned to the CrashDumpEnabled registry entry when a complete memory dump is to be completed by Windows. The value 0x2 is assigned to the CrashDumpEnabled registry entry when a kernel memory dump is to be completed by Windows. When you increase the amount of memory in the computer that is running Windows to more than 2 GB, it is expected that the complete memory dump setting will be changed to the kernel memory dump setting in both the CrashDumpEnabled registry entry and the
Write debugging information list setting in the
Startup and Recovery dialog box.
For example, when you install Windows on a computer with 2 GB of memory, the
Write debugging information list setting in the
Startup and Recovery dialog box of
System Properties is
Complete Memory Dump. The corresponding CrashDumpEnabled registry entry is set to the value of 0x1.
If you add memory to the computer that is running Windows so that the total memory is more than 2 GB, the
Write debugging information list setting is changed to
Kernel Memory Dump. However, the CrashDumpEnabled registry entry retains the value of 0x1.
If the computer stops unexpectedly, and a memory dump occurs, the
IopReadDumpRegistry() function reads the value of the CrashDumpEnabled entry from the registry. However, the
IopReadDumpRegistry() function has a hard-coded limitation that will override the registry value of 0x1 and will perform a kernel memory dump if the function detects that the server has more than 2 GB of memory. Therefore, if the server stops, a kernel memory dump is performed instead of a complete memory dump.
When you install hotfix 820361 or security hotfix MS04-011 on a Windows 2000-based computer, the hard-coded 2 GB memory limitation is removed from the
IopReadDumpRegistry() function. Therefore, if you increase the memory in your computer to more than 2 GB, Windows 2000 will try to create a complete memory dump instead of a kernel memory dump if the computer stops unexpectedly.
If you increase the memory to 4 GB or more on a Windows 2000-based computer, Windows 2000 cannot perform a complete memory dump, and the memory dump file is corrupted.
Note Windows Server 2003 can perform a complete memory dump regardless of the amount of memory that is installed in the computer. For example, assume that the
Startup and Recovery setting and the CrashDumpEnabled registry entry are set to perform a kernel memory dump and a complete memory dump respectively. If you have 4 GB of memory on your computer, a complete memory dump occurs if you have a large enough paging file on the system partition. The paging file must be the size of physical memory plus 1 megabyte (MB).
The CrashDumpEnabled registry entry is located in the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
WORKAROUND
Hotfix to correct the Write debugging information list display in Windows 2000
To work around the incorrect
Write debugging information list display issue on a Windows 2000-based computer, apply the hotfix that is described in Knowledge Base article 837297. After you apply this hotfix, the setting is synchronized with the registry value in the
Write debugging information list. If your computer has more than 2 GB of memory, and the CrashDumpEnabled registry entry is assigned the value 0x1, the
Complete Memory Dump option is selected in the
Write debugging information list. If the CrashDumpEnabled registry entry is not assigned the value 0x1, the
Complete Memory Dump option is not displayed in the
Write debugging information list.
For more information about this hotfix, click the following article number to view the article in the Microsoft Knowledge Base:
837297
Crash memory dump file created is different from the type selected in Windows 2000 Startup and Recovery settings
Hotfix to correct the Write debugging information list display in Windows Server 2003
A Windows Server 2003 version of the hotfix that is described in Knowledge Base article 837297 is scheduled to be included in Windows Server 2003 Service Pack 1.
Microsoft Visual Basic script to force Windows 2000 with 4 GB of memory to write a kernel memory dump
To force a Windows 2000-based computer that has 4 GB or more of memory to write only a kernel memory dump, you can use the following Visual Basic script.
Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure, but they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.
########## Start of VBS script ##########
On Error Resume Next
Const ForAppending=8
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objLogFile = objFSO.OpenTextFile("c:\memoryCheck.txt", ForAppending, True)
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colOperatingSystems = objWMIService.ExecQuery _
("Select * from Win32_OperatingSystem")
For Each objOperatingSystem in colOperatingSystems
OSNum="5.0.2195"
csName=objOperatingSystem.CSName
objLogFile.Write csName
objLogFile.Writeline
objLogFile.Write objOperatingSystem.Caption & " " & objOperatingSystem.Version
objLogFile.Writeline
objMemory = objOperatingSystem.TotalVisibleMemorySize
objLogFile.Write "Memory Size:" & objMemory& "KB"
objLogFile.Writeline
Set wshell = CreateObject("WScript.Shell")
crashControl = Wshell.RegRead("HKLM\System\CurrentControlSet\Control\CrashControl\CrashDumpEnabled")
objLogFile.Write "CrashDumpEnabled:" & crashControl
objLogFile.Writeline
'verify whether os is 2000 server
If (InStr(1,objOperatingSystem.Version,OSNUm)>1) and (objOperatingSystem.ProductType >1) Then
objMemory = objOperatingSystem.TotalVisibleMemorySize
'verify whether menory is >4G
If objMemory >= 4194304 Then
'modify registry "CrashDumpEnabled" value to 2 and get the CSName if value is 1
If crashControl=1 Then
Const HKEY_LOCAL_MACHINE = &H80000002
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")
strKeyPath = "System\CurrentControlSet\Control\CrashControl"
strValueName = "CrashDumpEnabled"
dwValue = 2
oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
objLogFile.Write "CrashDumpEnabled has been modified from 1 to 2"
objLogFile.Writeline
Wscript.Echo "CrashDumpEnabled has been modified from 1 to 2"
End If
End If
End If
Next
objLogFile.Close
########## End of VBS script ##########