生成内核或完成故障转储Generate a kernel or complete crash dump

Windows 无法 (时,系统崩溃) 错误"或"停止错误"。A system crash (also known as a “bug check” or a "Stop error") occurs when Windows can't run correctly. 此事件生成的转储文件称为系统故障转储。The dump file that is produced from this event is called a system crash dump.

手动内核或完整内存转储文件在解决若干问题时很有用,因为进程在崩溃时捕获系统内存记录。A manual kernel or complete memory dump file is useful when you troubleshoot several issues because the process captures a record of system memory at the time of a crash.

设置页面文件Set up page files

有关 系统崩溃转储的页面 文件大小要求,请参阅支持系统故障转储。See Support for system crash dumps for the page file size requirement for system crash dump.

启用内存转储设置Enable memory dump setting

您必须以管理员或安全组管理员组登录才能完成此过程。You must be logged on as an administrator or a member of the Administrators group to complete this procedure. 如果计算机已连接到网络,则网络策略设置可能会阻止您完成此过程。If your computer is connected to a network, network policy settings may prevent you from completing this procedure.

若要启用内存转储设置,请按照以下步骤操作:To enable memory dump setting, follow these steps:

  1. "控制面板"中,选择 "系统和安全 > 系统"。In Control Panel, select System and Security > System.

  2. 选择 "高级系统设置", 然后选择" 高级" 选项卡。Select Advanced system settings, and then select the Advanced tab.

  3. 在"启动和恢复"区域中, 选择"设置 "。In the Startup and Recovery area, select Settings.

  4. 确保已选择"编写调试信息"下的"内核内存转储"或"完成内存转储"。Make sure that Kernel memory dump or Complete memory dump is selected under Writing Debugging Information.

  5. 重新启动计算机。Restart the computer.


可以通过编辑转储文件字段来更改 转储文件 路径。You can change the dump file path by edit the Dump file field. 换句话说,您可以将路径从 %SystemRoot%\Memory.dmp 更改为指向具有足够磁盘空间的本地驱动器,例如 E:\Memory.dmp。In other words, you can change the path from %SystemRoot%\Memory.dmp to point to a local drive that has enough disk space, such as E:\Memory.dmp.

生成内存转储的提示Tips to generate memory dumps

当计算机崩溃并重新启动时,物理 RAM 的内容将写入到位于安装操作系统的分区上的分页文件中。When the computer crashes and restarts, the contents of physical RAM are written to the paging file that is located on the partition on which the operating system is installed.

根据安装 Windows 的硬盘的速度,转储超过 2 GB (GB) 可能需要很长时间。Depending on the speed of the hard disk on which Windows is installed, dumping more than 2 gigabytes (GB) of memory may take a long time. 即使在最佳情况下,如果转储文件配置为驻留在另一个本地硬盘驱动器上,也会读取大量数据并写入硬盘。Even in a best case scenario, if the dump file is configured to reside on another local hard drive, a significant amount of data will be read and written to the hard disks. 这可能会导致服务器长时间中断。This can cause a prolonged server outage.


使用此方法可谨慎生成完整的内存转储文件。Use this method to generate complete memory dump files with caution. 理想情况下,只有在 Microsoft 支持工程师明确请求时,才应这样做。Ideally, you should do this only when you are explicitly requested to by the Microsoft Support engineer. 所有标准疑难解答方法全部用尽后,任何内核或完整内存转储文件调试都应是最后的方法。Any kernel or complete memory dump file debugging should be the last resort after all standard troubleshooting methods have been completely exhausted.

手动生成内存转储文件Manually generate a memory dump file

使用 NotMyFault 工具Use the NotMyFault tool

如果在出现问题时可以登录,可以使用 Microsoft Sysinternals NotMyFault 工具。If you can log on while the problem is occurring, you can use the Microsoft Sysinternals NotMyFault tool. 为此,请执行下列步骤:To do this, follow these steps:

  1. 下载 NotMyFault 工具。Download the NotMyFault tool.

  2. 选择 "开始",然后选择"命令提示符"。Select Start, and then select Command Prompt.

  3. 在命令行中,运行以下命令:At the command line, run the following command:

    notMyfault.exe /crash


此操作将生成内存转储文件和 D1 停止错误。This operation generates a memory dump file and a D1 Stop error.


在某些计算机上,不能使用键盘生成故障转储文件。On some computers, you cannot use keyboard to generate a crash dump file. 例如,Hewlett-Packard (开发) 的 HP Hewlett-Packard BladeSystem 服务器通过基于浏览器的图形用户界面和 GUI (进行管理) 。For example, Hewlett-Packard (HP) BladeSystem servers from the Hewlett-Packard Development Company are managed through a browser-based graphical user interface (GUI). 键盘未连接到 HP BladeSystem 服务器。A keyboard is not attached to the HP BladeSystem server.

在这些情况下,必须使用导致系统处理器上 NMI 的不可屏蔽中断 (NMI) 开关生成完整的故障转储文件或内核故障转储文件。In these cases, you must generate a complete crash dump file or a kernel crash dump file by using the Non-Maskable Interrupt (NMI) switch that causes an NMI on the system processor.

为此,请执行下列步骤:To do this, follow these steps:


请仔细执行本节中的步骤。Follow the steps in this section carefully. 如果注册表修改不正确,可能会发生严重问题。Serious problems might occur if you modify the registry incorrectly. 在修改注册表 之前,请备份注册表以 在出现问题时进行还原。Before you modify it, back up the registry for restoration in case problems occur.

  1. 在注册表编辑器中,找到以下注册表子项:In Registry Editor, locate the following registry subkey:


  2. 右键单击CrashControl, 指向 "新建",然后单击 "DWORD 值"。Right-click CrashControl, point to New, and then click DWORD Value.

  3. 键入 NMICrashDump,然后按 Enter。Type NMICrashDump, and then press Enter.

  4. 右键单击 "NMICrashDump", 然后选择"修改 "。Right-click NMICrashDump, and then select Modify.

  5. 在"值数据" 框中,键入"1", 然后选择"确定 "。In the Value data box, type 1, and then select OK.

  6. 重新启动计算机。Restart the computer.

  7. 硬件供应商(如 HP、IBM 和 Dell)可能会提供自动系统恢复 (ASR) 功能。Hardware vendors, such as HP, IBM, and Dell, may provide an Automatic System Recovery (ASR) feature. 在疑难解答期间,应禁用此功能。You should disable this feature during troubleshooting. 例如,如果在 BIOS 中启用了 HP 和 Comppc ASR 功能,在排除故障时禁用此功能以生成完整的 Memory.dmp 文件。For example, if the HP and Compaq ASR feature is enabled in the BIOS, disable this feature while you troubleshoot to generate a complete Memory.dmp file. 有关确切步骤,请与硬件供应商联系。For the exact steps, contact your hardware vendor.

  8. 在 BIOS 中启用 NMI 开关,或者使用 iLO (集成灯) 开关。Enable the NMI switch in the BIOS or by using the Integrated Lights Out (iLO) Web interface.


    有关确切步骤,请参阅 BIOS 参考手册或联系硬件供应商。For the exact steps, see the BIOS reference manual or contact your hardware vendor.

  9. 使用 NMI 开关生成转储文件,在服务器上测试此方法。Test this method on the server by using the NMI switch to generate a dump file. 你将看到 STOP 0x00000080硬件故障。You will see a STOP 0x00000080 hardware malfunction.

如果要使用串行控制台在 Microsoft Azure 中运行 NMI,请参阅对 SysRq和 NMI 调用使用串行控制台。If you want to run NMI in Microsoft Azure using Serial Console, see Use Serial Console for SysRq and NMI calls.

使用键盘Use the keyboard

通过键盘强制系统崩溃Forcing a System Crash from the Keyboard

使用调试器Use Debugger

从调试器强制系统崩溃Forcing a System Crash from the Debugger