Ring0

Windows 7 systems that were configured to generate crash dumps were crashing but not leaving behind a dump file. After having ruled out the usual reasons such as too small of a paging file or not enough disk space to save the dump, there was definitely something strange going on.

What we discovered is that a new policy has been added to Windows when it comes to crash dump file retention. Apparently, certain customers are complaining about the amount of disk space that crash dump files consume and don't want them saved anymore (we're sure they'll regret this decision in the future if their systems ever crash). In order to address this issue, a new set of criteria has been created that determines whether or not Windows saves a crash dump file.

The new criteria are as follows:

1) If the machine is running a server version of the O/S, the crash dump is always saved.

2) If the machine is joined to a domain, the crash dump is always saved.

3) If the amount of free space on the disk is greater than or equal to 25GB, the crash dump is saved.

Otherwise, the crash dump file will not be saved and you'll be left scratching your head. Luckily, a new registry value has been added that will override this behavior and always cause the crash dump file to be generated. By setting the \HKLM\System\CCS\Control\CrashControl\AlwaysKeepMemoryDump DWORD value to 1 you will guarantee that you will always have a crash dump file after crashing the system.