This guide provides the steps necessary to configure Windows to automatically capture a crash dump (minidump) when the Teramind Agent encounters a fatal error, such as a Blue Screen of Death (BSOD). These files are essential for our team to diagnose the cause of the crash.
⚠️ Warning: Registry Modification Risk
The steps below require modifying the Windows Registry. Working with the registry can be dangerous and potentially cause system instability or failure if done incorrectly. Please follow these instructions precisely. Teramind is not responsible for any damage caused by using external tools or following incorrect instructions.
Configuration Steps
To ensure crash dumps are captured, you need to configure the Windows Error Reporting settings via the Registry:
1. Create Dump Folder: Create a new folder named dumps directly on your main drive (usually C:). The full path should look something like: C:\dumps.
2. Create Registry File: Open Windows Notepad and enter the following lines exactly as shown:
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps] "DumpFolder"="c:\\dumps" "DumpType"=dword:00000002 "DumpCount"=dword:00000100
3. Save the File:
When saving the file in Notepad:
Change the Save as type dropdown menu to All Files (*.*).
Save the file with a
.regextension (e.g.,registry_entry.reg). If you skip changing the file type, it will save incorrectly as a.txtfile.
4. Import to Registry:
4.1 Open Windows Explorer.
4.2 Browse to the .reg file you just saved.
4.3 Double-click the file. A warning message, "Do you want to allow this app to make changes to your device?" will appear asking you to confirm the action:
4.4 Click Yes to confirm the import.
Collecting and Submitting the Dumps
5. Locate the Dump Files: The next time a crash occurs, you will see the crash dump file(s) in the C:\dumps folder.
6. Send the Files to Teramind Support: You can then send the file(s) to us for further diagnosis. When submitting the files to our support team, please include further details on what actions were being performed and what applications were running at the moment of the crash.
We typically require the crash dumps for dwm.exe and svc.exe. If a Revealed Agent was in use, we may also be interested in the tmagent.exe dumps.