Edit

Windows shows blue screen error when booting an Azure VM

  • Article

This article describes blue screen errors that you might encounter when you boot a Windows Virtual Machine (VM) in Microsoft Azure. It provides steps to help you collect data for a support ticket.

Symptoms

A Windows VM doesn't start. When you check the boot screenshots within Boot diagnostics, you see one of the following error messages in a blue screen:

Your PC ran into a problem and needs to restart. We're just collecting some error info, and then you can restart.

Your PC ran into a problem and needs to restart.

Cause

There might be many reasons why you experience a stop error. The most common causes are the following issues:

  • Problem within a driver
  • Corrupted system file or memory
  • An application accessing a forbidden sector of the memory

Solution

Tip

If you have a recent backup of the VM, you may try restoring the VM from the backup to fix the boot problem.

To resolve this problem, you first have to gather a dump file for the crash before you contact support. To collect the dump file, follow these steps:

Step 1: Locate the dump file and submit a support ticket

Part 1: Attach the OS disk to a recovery VM

  1. Take a snapshot of the OS disk of the affected VM to create a backup. For more information, see Create a snapshot of a virtual hard disk.

  2. Attach the OS disk to a recovery VM.

  3. Use remote desktop protocol (RDP) to connect remotely to the recovery VM.

  4. If the OS disk of the affected VM is encrypted, turn off encryption before you go to the next step. For more information, see Decrypt the encrypted OS disk.

Part 2: Locate the dump file and submit a support ticket

  1. On the recovery VM, go to the Windows folder on the attached OS disk. For example, if the drive letter that's assigned to the attached OS disk is F, go to F:\Windows.

  2. Locate the Memory.dmp file, and then submit a support ticket and attach the dump file.

If you can't find the dump file, go to the next steps to enable the dump log and the serial console, and then reproduce the issue.

Step 2: Enable the dump log and the serial console

Important

This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For protection, back up the registry before you modify it so that you can restore it if a problem occurs. For more information about how to back up and restore the registry, see How to back up and restore the registry in Windows.

To enable the dump log and the serial console, follow these steps:

  1. Open an elevated command prompt session as an administrator.

  2. Run the following BCDEdit commands using the /ems and /emssettings options:

    Enable the serial console:

    bcdedit /store <volume-letter-containing-the-bcd-folder>:\boot\bcd /ems {<boot-loader-identifier>} ON
bcdedit /store <volume-letter-containing-the-bcd-folder>:\boot\bcd /emssettings EMSPORT:1 EMSBAUDRATE:115200

  3. Verify that the free space on the OS disk is larger than the memory size (RAM) on the VM.

    If there isn't enough space on the OS disk, change the location where the memory dump file is created, and refer that location to any data disk attached to the VM that has enough free space. To change the location, replace %SystemRoot% with the drive letter of the data disk, such as F:, in the following commands.

    To enable the OS dump file, run the following load, add, and unload commands to implement the suggested configuration using the reg tool:

    Load the registry hive from the broken OS disk:

    reg load HKLM\<broken-system> <volume-letter-of-broken-os-disk>:\windows\system32\config\SYSTEM

    Enable on ControlSet001:

    reg add "HKLM\<broken-system>\ControlSet001\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 1 /f
reg add "HKLM\<broken-system>\ControlSet001\Control\CrashControl" /v DumpFile /t REG_EXPAND_SZ /d "%SystemRoot%\MEMORY.DMP" /f
reg add "HKLM\<broken-system>\ControlSet001\Control\CrashControl" /v NMICrashDump /t REG_DWORD /d 1 /f

    Enable on ControlSet002:

    reg add "HKLM\<broken-system>\ControlSet002\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 1 /f
reg add "HKLM\<broken-system>\ControlSet002\Control\CrashControl" /v DumpFile /t REG_EXPAND_SZ /d "%SystemRoot%\MEMORY.DMP" /f
reg add "HKLM\<broken-system>\ControlSet002\Control\CrashControl" /v NMICrashDump /t REG_DWORD /d 1 /f

    Unload the broken OS disk:

    reg unload HKLM\<broken-system>

Step 3: Reproduce the issue

  1. Detach the OS disk, and then reattach the OS disk to the affected VM.

  2. Start the VM to reproduce the issue so that a dump file is generated.

  3. Repeat the instructions in the Step 1: Locate the dump file and submit a support ticket section.

Contact us for help

If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.