TL;DR
A fleet of Dell Precision 5470 laptops is affected by the KB5063878 issue which causes the system drive to disappear at crash time. That means crash dump doesn’t get written to the system drive because it’s not there and dump information gets written to C:pagefile.sys by default. Those dump information writes can be redirected to another physical drive that is not removable. But the Precision 5470 chassis has only one drive bay. So how do I capture a crash dump on this chassis?
I have a small fleet of Windows 11 computers that are still crashing unexpectedly since KB5063878 was installed. Uninstalling KB5063878 cured the problem, but the problem persists when the latest updates are installed. Currently the choice for this fleet seems to be to freeze updates just before KB5063878 or live with periodic crashes. I would like to diagnose the crash. It seems I need a crash dump to diagnose this issue.
There is an obvious problem with capturing such a mini dump in this case, though. The crash that results from KB5063878 is caused by the system drive SSD disappearing so there is no system drive to which to write the mini dump. Indeed, there are no minidumps in C:WindowsMinidump that correspond to the crashes occurring.
I changed “Small dump directory” to e:Minidump. e:Minidump is a folder on an SD card installed in the chassis on one of the affected computers. I was hoping to see mini dump files after that change, but no files have appeared.
Apparently Windows writes crash information to the paging file at crash time by default:
Since the system is in an unstable state during the crash, the data is first written to the paging file and then transferred to the appropriate dump file during the next boot.
Microsoft supports dedicated dump files which can be written to at crash time instead of the page file. They can be on other physical disks, but with the following restriction:
Dedicated dump files can be put on any disk volume that can support a page file.
I think this “eliminates removable drives, such as anything on USB, and Windows clustered storage.” Unfortunately, the affected chassis is a Dell Precision 5470 which has only one slot for internal storage so it’s not obvious to me how I can connect a second disk that supports the dedicated dump file.
This leaves me with the following questions:
- Is there a way to connect a second physical disk to this chassis that Windows would successfully use for a dedicated dump file?
- Is there some other way to capture a crash dump for this scenario?
Background
There are details on the systems and crash in this question. Capturing even the black screen of death has been tricky because of how quickly it disappears. One photo of the black screen that was successfully captured contained with the following text:
0xFFFFD28FD44D8000
0xFFFFA30BE6995E00
0x0000000000000002
0x0000000000000000
Your device ran into a problem and needs to restart.
Stop code: UNEXPECTED_STORE_EXCEPTION (0x154)
The affect computers don’t seem to suffer data loss. They are protected by nightly drive images and other backups which we have, fortunately, not yet had to use for recovery. Nevertheless, such unexpected crashes are sometimes very disruptive and I would like to diagnose them.
