This is where it gets tricky. To read a dump yourself, you use one of the
MS debuggers (explained below). If you are not comfortable reading the
debug yourself, you can open a case w/MS-Support to have the dump read for
you.
But, to do it yourself do the following:
1) Download & Install the debugger pack
(
http://www.microsoft.com/whdc/ddk/debugging/default.mspx).
1a) Create a directory called c:\debug
2) Launch WinDBG
3) Open the dump file (Click on File-->Open Crash Dump)
4) Type: ".logopen c:\out1.txt <enter>"
This creates a log file of your typing so that you can post the output if
you want someone in the group to take a look.
5) Type: ".sympath
SRV*c:\debug*
http://msdl.microsoft.com/download/symbols<enter>"
6) Type: ".reload <enter>"
This can take a while as symbols are being downloaded from microsoft.com.
You can see the downloaded files in the c:\debug folder you created at 1a.
7) To see the failure type: "kb <enter>" (possible download delay)
8) Type: "!analyze -v <enter>" (possible download delay)
This gives you the thread that failed and runs some basic checks on it.
9) Type: ".logclose <enter>"
If you need help interpreting the log file (or the output), you can post the
output of the log (stored in c:\out1.txt).
Pat
Frank said:
Found user.dmp in drwatson dir with the date that explorer crashed. What
can I use to read? TIA and thanks for your help.