How to Configure Memory Dump and Crash Control Settings in Windows 11 Using PowerShell

When a critical kernel-level fault triggers a Blue Screen of Death (BSOD) stop error in Windows 11, the operating system’s CrashControl subsystem writes memory diagnostic data to a crash dump file on disk before rebooting. These crash dumps are vital for software engineers, IT administrators, and hardware technicians using WinDbg to pinpoint faulting drivers, corrupted kernel memory structures, or hardware anomalies.

By default, Windows 11 automatically restarts immediately after capturing a crash dump, often denying technicians the opportunity to view the stop code on the monitor. Furthermore, the default dump type may not contain enough debugging symbols or may consume excessive disk space on smaller solid-state drives. Using PowerShell, administrators can query and configure CrashControl registry parameters directly: selecting between Small Memory Dumps (Minidumps), Kernel Dumps, or Complete Memory Dumps, disabling automatic reboots, and customising dump file directories. If you manage Windows system health, you might also like our guides on auditing Windows reliability history with PowerShell and tuning the Windows 11 TCP/IP stack.

Launching PowerShell as Administrator

Because CrashControl parameters govern low-level Windows kernel behaviour, modifying them requires an elevated administrative console:

1. Press Windows Key + X or right-click the Start menu button on your Windows 11 taskbar.
2. Select Terminal (Admin) or PowerShell (Admin).
3. Click Yes to confirm the User Account Control (UAC) prompt.

Inspecting Current Crash Dump and Reboot Settings

Windows stores its crash control configuration in the system registry under HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl. To query these parameters using PowerShell, execute:

# Query active CrashControl registry settings
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" | Select-Object CrashDumpEnabled, AutoReboot, Overwrite, DumpFile, MinidumpDir

Understanding the key properties:

• CrashDumpEnabled: Defines the diagnostic dump type written to disk upon a BSOD.
  • 0: None (no dump file created).
  • 1: Complete Memory Dump (captures all physical RAM; requires a paging file at least as large as physical memory).
  • 2: Kernel Memory Dump (captures kernel-mode memory; recommended balance of detail and file size).
  • 3: Small Memory Dump (Minidump; approximately 256 KB to 1 MB, capturing stop codes and call stacks).
  • 7: Automatic Memory Dump (default on Windows 11; dynamic kernel dump).
• AutoReboot: Set to 1 to reboot automatically after writing the dump, or 0 to freeze the blue screen on monitor display.
• Overwrite: Dictates whether subsequent kernel crashes overwrite MEMORY.DMP (1) or append unique files.

Disabling Automatic Reboot on BSOD

To prevent Windows 11 from instantly restarting after a system crash—allowing you to inspect the stop code (such as CRITICAL_PROCESS_DIED or DRIVER_IRQL_NOT_LESS_OR_EQUAL) and faulting .sys file—disable AutoReboot:

# Disable automatic restart upon system crash
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "AutoReboot" -Value 0

# Verify the updated value
(Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl").AutoReboot

Configuring Minidump vs Kernel Memory Dump

On systems with limited disk capacity or for rapid transmission to external technical support, configuring Small Memory Dumps (Minidumps) is ideal:

# Configure Small Memory Dump (Minidump - Type 3)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "CrashDumpEnabled" -Value 3

# Verify minidump directory (defaults to C:\Windows\Minidump)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "MinidumpDir" -Value "%SystemRoot%\Minidump"

Conversely, for in-depth software driver debugging where full call stacks and heap structures are required, configure a Kernel Memory Dump:

# Configure Kernel Memory Dump (Type 2)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "CrashDumpEnabled" -Value 2

# Set dedicated dump file target path
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "DumpFile" -Value "%SystemRoot%\MEMORY.DMP"

Ensuring Paging File Capacity

Windows requires that the active paging file on your OS system drive (C:) is large enough to stage the crash dump during a kernel crash. If the pagefile is disabled or constrained to a small fixed size, Windows cannot write the dump file:

# Verify pagefile configuration using CIM
Get-CimInstance -ClassName Win32_PageFileSetting | Select-Object Name, InitialSize, MaximumSize

Ensuring system-managed pagefile sizing on the boot volume guarantees dependable crash log generation across all Windows 11 workstations.