Active Memory Dump in Windows Server 2016

I don’t know if I can highlight all new features of Windows Server 2016 – but this is blog post for new feature for Memory Dump – Windows Server 2016 Active Memory Dump. This catches my eye this is another revolution is Microsoft Operating system.

Windows Server 2016 Launch

In a blog post, Microsoft has confirmed that Windows Server and System Center will not launch until 2016. The move is a departure from Microsoft’s historic strategy of launching its server platform alongside the general consumer release of Windows. As it stands, Windows 10 will launch this year, and Windows Server won’t be finalized until 2016.

Let’s move on to our interesting Topic which is for Active Memory Dump in Windows Server 2016.

Active Dump – Active Memory Dump in Windows Server 2016

The following enhancement is not specific to Failover Cluster or even Windows Server.  However, it has significant advantages when you are troubleshooting and getting memory.dmp files from servers running Hyper-V.

Memory Dump Enhancement – Active memory dump

Servers that are used as Hyper-V hosts tend to have a significant amount of RAM and a complete memory dump includes processor state as well as a dump of what is in RAM and these results in the dmp file for a Full Dump to be extremely large.  On these Hyper-V hosts, the parent partition is usually a small percentage of the overall RAM of the system, with the majority of the RAM allocated to Virtual Machines(VMs).  It’s the parent partition memory that is interesting in debugging a bugcheck or other bluescreen and the VM memory pages are not important for diagnosing most problems.

Windows Server 2016 introduces a dump type of “Active memory dump”, which filters out most memory pages allocated to VMs and therefore makes the memory.dmp much smaller and easier to save/copy.

As an example, I have read in of the MS Blog were they have a system with 16GB of RAM running Hyper-V and they have  initiated bluescreens with different crash dump settings to see what the resulting memory.dmp file size would be.  I also tried “Active memory dump” with no VMs running and with 2 VMS taking up 8 of the 16GB of memory to see how effective it would be:


Active Memory Dump in Windows Server 2016
Active Memory Dump in Windows Server 2016 ( Image from Microsoft Blog)

*The size of the Active Dump as compared to a complete dump will vary depending on the total host memory and what is running on the system.

In looking at the numbers in the table above, keep in mind that the Active Dump is larger than the kernel, but includes the usermode space of the parent partition, while being 10% of the size of the complete dump that would have normally been required to get the usermode space.


The new dump type can be chosen through the Startup and Recovery dialog as shown here:

Active Memory Dump in Windows Server 2016
Active Memory Dump in Windows Server 2016 (Image from Microsoft Blog)

The memory.dmp type can also be set through the registry under the following key.  The change will not take effect until the system is restarted if changing it directly in the registry: HKEY_LOCAL_MACHINESystemCurrentControlSetControlCrashControl

Note: Information on setting memory dump types directly in the registry for previous versions can be found in a blog here.

To configure the Active memory.dmp there are 2 values that need to be set, both are REG_DWORD values.


The CrashDumpEnabled value needs to be 1, which is the same as a complete dump.



The FilterPages value needs to be set to 1.

Note: FilterPages value will not found under the HKEY_LOCAL_MACHINESystemCurrentControlSetControlCrashControl key unless the GUI “Startup and Recovery” dialog is used to set the dump type to “Active memory dump”, or you manually create and set the value.

You Love PowerShell

If you would like to set this via Windows PowerShell, here is the flow and example:

  1. Gets the value of CrashDumpEnabled
  2. Sets the value of CrashDumpEnabled to 1 (so effectively this is now set to Complete dump).
  3. Gets the value of FilterPages (note that there is an error because this value doesn’t exist yet).
  4. Sets the value of FilterPages to 1 (this changes it from Complete dump to Active dump)
  5. Gets the value of FilterPages to verify it was set correctly and exists now.
Active Memory Dump in Windows Server 2016
Active Memory Dump in Windows Server 2016 (image from Microsoft Blog)

Here is TXT version of what is the showing before above, to make it easier to copy paste

Get-ItemProperty –Path HKLM:SystemCurrentControlSetControlCrashControl –Name CrashDumpEnabled

Get-ItemProperty –Path HKLM:SystemCurrentControlSetControlCrashControl –Name FilterPages

Set-ItemProperty –Path HKLM:SystemCurrentControlSetControlCrashControl –Name CrashDumpEnabled –value 1

Set-ItemProperty –Path HKLM:SystemCurrentControlSetControlCrashControl –Name FilterPages –value 1

Get the Microsoft Blog information for Active Memory Dump in Windows Server 2016

0 responses on "Active Memory Dump in Windows Server 2016"

Leave a Message

About AIK IT Support

Start Building Your Career with Solid Platform and its the time to Grab the Opportunity and Start Today

© AIK IT Support All rights reserved.