{"id":673,"date":"2026-08-21T23:58:23","date_gmt":"2026-08-21T23:58:23","guid":{"rendered":"https:\/\/windows-vps.org\/blog\/?p=673"},"modified":"2026-10-20T22:08:43","modified_gmt":"2026-10-20T22:08:43","slug":"windows-server-bsod-driver-verifier-windbg-dump-analysis","status":"publish","type":"post","link":"https:\/\/windows-vps.org\/blog\/windows-server-bsod-driver-verifier-windbg-dump-analysis\/","title":{"rendered":"Windows Server BSOD Diagnosis: Driver Verifier, Crash Dumps, and WinDbg !analyze"},"content":{"rendered":"
\n

When a Windows Server stops responding or reboots itself, the fastest route to a root cause is a kernel memory dump plus the WinDbg !analyze -v<\/code> extension. This guide is a working procedure: reproduce the crash under Driver Verifier, capture the dump reliably, load it with the correct symbol path, and read the bug check parameters without guessing. It assumes the server is a VPS or a small on-prem box where you cannot attach a kernel debugger to the physical serial port \u2014 everything here works from a dump file alone. If your instance has a small system disk, note that crash dumps are written to the page file’s backing volume, and Windows Server instance sizing<\/a> matters for whether a full or kernel dump is practical.<\/p>\n

Step 1: Choose the Dump Type Before the Crash<\/h2>\n

Crash dump configuration is a registry\/BCD setting, not a control-panel tweak that applies after the fact. Decide before you run Driver Verifier.<\/p>\n\n\n\n\n\n\n\n\n
Type<\/th>\nSize<\/th>\nContents<\/th>\nUse when<\/th>\n<\/tr>\n<\/thead>\n
Small (minidump)<\/td>\n~256 KB \u2013 2 MB<\/td>\nBug check code, parameters, current thread, loaded module list, stack of the crashing thread<\/td>\nAlways enabled as a baseline; enough for most third-party driver faults<\/td>\n<\/tr>\n
Kernel<\/td>\nTypically 400 MB \u2013 2 GB<\/td>\nAll kernel-mode memory: pools, driver images, stacks of all threads<\/td>\nPool corruption, deadlocks, need driver data of a non-crashing thread<\/td>\n<\/tr>\n
Complete<\/td>\nRAM size or larger<\/td>\nEntire physical memory including user mode<\/td>\nRarely needed server-side; requires page file \u2265 RAM<\/td>\n<\/tr>\n
Automatic<\/td>\nKernel by default<\/td>\nKernel dump, minidump if kernel cannot be written<\/td>\nGood default for production<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Set it with wmic<\/code>-free commands on Server 2022\/2025:<\/p>\n

# Show current setting (1=complete, 2=kernel, 3=small, 7=automatic)\nGet-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\CrashControl' |\n    Select-Object CrashDumpEnabled, DumpFile, MinidumpDir, AutoReboot, Overwrite\n\n# Set kernel dump explicitly\nSet-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\CrashControl' -Name CrashDumpEnabled -Value 2\nSet-ItemProperty 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\CrashControl' -Name Overwrite -Value 0\n\n# Page file must be at least on the same disk and large enough\nGet-CimInstance Win32_PageFileUsage | Select-Object Name, AllocatedBaseSize, CurrentUsage\n<\/code><\/pre>\n
Overwrite=0<\/code> keeps a dump at C:\\Windows\\MEMORY.DMP<\/code> instead of overwriting it on the next crash \u2014 essential when you need several runs to identify an intermittent driver. Ensure the disk has free space equal to the expected dump size before enabling a kernel dump on a 40 GB VPS disk.<\/p>\n
Step 2: Driver Verifier \u2014 Targeted, Not “Verify Everything”<\/h2>\n
Driver Verifier’s \/standard<\/code> suite applied to all drivers will make a production server unbootable. On a VPS this means a recovery console session. Verify only the drivers you suspect, and only with a non-destructive option set.<\/p>\n
# List third-party drivers and their vendors\nGet-CimInstance Win32_SystemDriver | Where-Object State -eq 'Running' |\n    ForEach-Object {\n        $p = (Get-Item $_.PathName -ErrorAction SilentlyContinue).VersionInfo\n        [pscustomobject]@{Name=$_.Name; Company=$p.CompanyName; File=$_.PathName}\n    } | Where-Object Company -notlike 'Microsoft*' | Format-Table -AutoSize\n<\/code><\/pre>\n
Pick one<\/strong> driver and enable only the options that are meaningful for it:<\/p>\n
verifier \/volatile \/adddriver myfilter.sys \/flags 0x209BB\nverifier \/volatile \/querysettings\n<\/code><\/pre>\n
The \/volatile<\/code> switch applies the settings until the next reboot without persisting them in the registry. That matters: if the box fails to boot under verification, a reset node in a VPS panel has already cleared the setting. Reboot, reproduce the load, and wait for bug check 0xC4<\/code> (DRIVER_VERIFIER_DETECTED_VIOLATION) \u2014 the dump now names the driver in the bug check parameters.<\/p>\n