MANUALLY_INITIATED_CRASH 0x000000E2 and missing memory dump files

Fix it now

0x000000E2 means somebody deliberately initiated a crash dump, from the kernel debugger or from the keyboard. The crash itself is not a fault; the usual reason for reading about it afterwards is that the dump you wanted was not written.

Get-CimInstance Win32_OSRecoveryConfiguration | Select-Object DebugInfoType, DebugFilePath, AutoReboot, OverwriteExistingDebugFile

1. Read DebugInfoType from that output: 0 means no dump is configured at all, 1 complete, 2 kernel, 3 small.
2. Set it deliberately: Control Panel, System and Security, System, Advanced system settings, Advanced tab, Startup and Recovery, Settings, then choose the dump type under Writing debugging information.
3. Confirm the paging file is on the partition Windows is installed on and large enough for the dump type you chose. The default dump file location is the pagefile.
4. Confirm there is enough free space where the dump file itself will be written – by default %SystemRoot%\Memory.dmp.
5. Restart, then reproduce the crash and check that the dump file appears.

Event ID 46 from volmgr, ‘Crash dump initialization failed!’, is not evidence of a broken configuration on its own. Microsoft documents its cause as booting without a configured dump file, which is what the first boot of a clean installation does, and says it can be ignored in that case.

If a test crash now produces a dump, you are finished. The next section covers the deliberate-crash mechanisms and the codes that look like them.

Why it happens

Some crashes are requested. Support engineers force one to capture the state of a machine that has hung, administrators force one from a management controller when a server stops responding, and developers force one from a kernel debugger. 0x000000E2 is the code for that: the user deliberately initiated a crash dump from either the kernel debugger or the keyboard. It has no parameters, because there is nothing to diagnose.

0xDEADDEAD is the same event under a different name, MANUALLY_INITIATED_CRASH1, with all four parameters reserved. 0x000001C8 is the newer relative: the system was configured to bug check when the power button is held for a set time, so that a machine about to be hard reset produces a dump instead of losing its state. Parameter 1 is the hold time in milliseconds, and rather than a blue screen the user sees a black screen reading ‘Please release the power button. We just need a few more seconds to shut down.’

The keyboard route has to be enabled in advance and it is keyboard-specific. CrashOnCtrlScroll as a REG_DWORD of 1 goes under the Parameters key of the keyboard driver in use: i8042prt for PS/2, kbdhid for USB and HID, hyperkbd for Hyper-V. Microsoft notes that some laptops use the PS/2 driver for the built-in keyboard while also supporting external HID keyboards, so on those it is worth creating both. Once set and restarted, hold the rightmost Ctrl key and press Scroll Lock twice.

The NMI route is where most stale advice lives. NMICrashDump under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl is not required on clients running Windows 8 and later or servers running Windows Server 2012 and later, and Microsoft states that setting it on later versions has no effect. If a runbook tells you to set it on a current server, that instruction has outlived its usefulness.

Full reference

The deliberate-crash codes

Enabling the keyboard crash

Restart after setting the value, then hold the rightmost Ctrl key and press Scroll Lock twice. On a laptop with both a PS/2 internal keyboard and USB external keyboards, Microsoft’s advice is to create both keys so either will work.

Dump configuration, read and set

NMICrashDump under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl is not required on Windows 8 and later clients or Windows Server 2012 and later, and setting it on those versions has no effect. The NMI switch still has to be enabled in the BIOS or the management controller.

The codes that turn up next to these

0x000000E4 is not a deliberate crash and should not be filed with them. Its published meaning is that memory which should not contain an executive work item does contain one, or that a currently active work item was queued – usually because a driver freed memory that still held a work item. Parameter 1 distinguishes the cases: 0x0 an active work item freed, 0x1 an active work item queued, 0x2 a queued I/O work item freed, 0x3 an I/O work item initialised with an invalid object, and others for invalid queue types and worker routine addresses.

0x0000004C, FATAL_UNHANDLED_HARD_ERROR, publishes nothing. The page gives the symbolic name and a statement that the bug check appears very infrequently, and stops. There is no description, no parameter table and no cause, so any confident explanation of it is invented.

Getting a usable dump out of a machine that has hung

1. Decide the route in advance and test it while the machine is healthy. A hung server is a bad time to discover the registry value was never set.
2. Confirm the dump type and the pagefile before you need them, not after.
3. For remote servers, the NMI switch in the management controller is the route that works when nothing else responds – check the controller documentation for where it lives.
4. For a machine that people hold the power button on, the power-button-hold bug check turns a hard reset into a captured dump. Parameter 1 tells you how long they held it.
5. After any forced crash, confirm the dump file exists and opens in the debugger before you let the machine back into service.

Every code this article covers

Confirm the fix worked

1. Get-CimInstance Win32_OSRecoveryConfiguration shows the DebugInfoType you intended, not 0.
2. A deliberate test crash produces a dump file at DebugFilePath.
3. The dump opens in the debugger and !analyze -v produces a stack.
4. Event ID 46 no longer appears at boot, if you completed the paging file configuration.
5. The keyboard or NMI route you plan to rely on has been tested once on a machine you can afford to crash.

Questions people ask about this