Advanced Windows Debugging – I

Setting workstations for complete memory dump

Manual: Right Click on

1. My computer -> Properties -> Advanced -> Start and Recovery -> Settings –>
2. Under Write Debugging Information drop down box,
3. select Complete Memory Dump and click OK

Registry Automation:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlCrashControl
Key Type: REG_DWORD
Key Name: CrashDumpEnabled
Set this key to 1 for complete memory dump.

Enable Winlogon logging on workstations

Please follow below instructions to enable winlogon logging on machines:

Value Path: HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonGPExtensions{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
Value Name: ExtensionDebugLevel
Value Type: REG_DWORD
Value Data: 2

After enabling the logging here, you would get log file with the name as Winlogon.log file and is created in the Windows_folderSecurityLogs folder.