Windows memory.dmp file is missing after a system crash (blue screen) error

Technical Articles ID: KB68897
Last Modified: 2021-12-23 15:04:18 Etc/GMT

Environment

File and Removable Media Protection (FRP) 5.x

For details of FRP supported environments, see KB81149 - Supported platforms for File and Removable Media Protection.

Problem

The Windows crash dump file (memory.dmp) is a vital piece of evidence that allows support to find the root cause of a system crash. Sometimes the Windows dump file can't be located after a blue screen error on systems where FRP is installed.

Cause

FRP is encrypting the Windows pagefile.sys. When a system restarts after a system crash dump, the pagefile is re-encrypted. This design makes it impossible to generate or copy the memory dump to the memory.dmp file.

Solution

This behavior is expected, because of the Windows page file encryption by FRP.

Directly after a blue screen error, restart your computer in Windows Safe Mode without networking.

The above option causes Windows to start without the FRP driver. Windows is now able to copy the pagefile to memory.dmp.
Restart Windows normally and obtain the newly created dump file.

Also see the related article: KB83461 - Advanced debug and configuration options for File and Removable Media Protection.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Windows memory.dmp file is missing after a system crash (blue screen) error

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Windows memory.dmp file is missing after a system crash (blue screen) error

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title