css-windows / windowsdiag

Windows Diagnostics, Data Collection and Analysis tools

WindowsDiag Content was moved!

Content of https://github.com/CSS-Windows/WindowsDiag was moved to Microsoft Internal location and will be not accessible to external accounts. Visitors with Microsoft internal accounts can find more info and new internal locations in KB4478817 (https://internal.support.services.microsoft.com/en-us/help/4478817).

Thank you for understanding!

windowsdiag's Issues

vm2dmp doesnt work for vm saved states when the RAM is greater than 4GB

Hi,

I'm having some issues with vm2dmp while trying to get RAM dump from saved state. The problem only occures when the RAM for VM is greater than 4GB. In case when the RAM is set to 4GB the process of dumping RAM takes around 1-2mins, but for e.g. 8GB I stopped the program after 2h of work, because no results were generated. Do you know what the issue is? And also do you ever plan to releaes vm2dmp source code?

ERROR: Result code 0x2 with vm2dmp.exe in vm2dmp_HYPER-V2019.zip

Hi, thanks for sharing this tools.

Is this supported for recent version of Windows Server 2019? I tested it, but there is an error occurred.

Environment:
   Hyper-V Host: Windows Server 2019  (Version 10.0.17763.1282)
   VM: Type: Gen2
           OS: Windows Server 2019 (Version 10.0.17763.1282)
           Name: win2019

Repro step:

1. Create a checkpoint of VM "win2019" to "win2019-test"
2. Run as follows,

vm2dmp -vm "win2019" -snap "win2019-test" -dmp "c:\temp\memory2.dmp"

Output is,

INFO: Using VMRS file c:\hv\win2019\Snapshots\46CE2553-6F58-4FCA-91A4-5199DA49CB61.vmrs
ERROR: Result code 0x2

And, do you have a plan to share source code of vm2dmp.exe in github?

PrintSpooler Cleanup Missing

Is it possible to build one PrintSpooler Cleanup script? As it is now we can collect the information, but i find missing some options:

It will be nice one script with the following options:

Re-enable all non-Microsoft print monitors and processors disabled by a previous execution.
Select which non-Microsoft print monitors and processors to disable and disable them

Thanks in Advance

Explanation

May I consider windowsdiag means windows diagnostics.

vm2dmp support for ARM64

Given the availability of Hyper-V on ARM64 platform it would be very nice if we could have working vm2dmp there.

Typo on the main page title

Hi Walter,

there is a small typo here:

Thanks,
Andrei

Virus Detection on Release

Hi,

Release https://github.com/CSS-Windows/WindowsDiag/releases/tag/2020.09.30.1 shows as a virus in Vipre Endpoint Protection

It doesn't show as a virus on here: https://www.virustotal.com/gui/file/3a0e771a5773b65a5f68ca131a00f1a3d1f4d114b645d9e2909f568d89b64e57/detection

Virus.txt

unsigned executables

Hello,

Thank you for this great toolkit!
We are using Microsoft Defender Application Control to control which files are allowed to be executed.
Hereby we have whitelisted the Microsoft standard certificates;
which can be found in %windir%\schemas\CodeIntegrity\ExamplePolicies\AllowMicrosoft.xml

The default Microsoft policy does not allow this toolkit to be run. When adding the certificates that are used to sign the files, this works, however the following files are not signed at all:
Can these files by signing to solve these issues?

fruti_1903.exe
x86\myfault.x86\myfault.sys
x86\RecorderCommandLine.x86\RecorderCommandLine.exe
x86\RecorderDll.x86\RecorderDll.dll
x86\vsdiagview.x86\vsdiagview.exe
x64\RecorderCommandLine.x64\RecorderCommandLine.exe
x64\RecorderDll.x64\RecorderDll.dll
x64\vsdiagview.x64\vsdiagview.exe
fcinfo.fcinfo.exe
fruti_RS1.fruti_RS1.exe
hbatapi.hbatapi.dll
npivtool.npivtool.exe
poolmon.poolmon.exe
rpccfg.rpccfg.exe
rpcdump.rpcdump.exe
tss_DumpAdapterInfo.tss_DumpAdapterInfo.vbs
tss_EvtMon.tss_EvtMon.vbs
VmlTrace.VmlTrace.exe
VmlTrace_2012.VmlTrace_2012.exe
windowsperformancerecordercontrol.windowsperformancerecordercontrol.dll
wpr.wpr.exe
x86\cscdbdump.x86\cscdbdump.exe
x86\dfsutil.x86\dfsutil.exe
x86\get_dependencies.x86\get_dependencies.vbs
x86\NTttcp.x86\NTttcp.exe
x86\SdkDll.x86\SdkDll.dll
x86\vshadow.x86\vshadow.exe
x86\vssagent.x86\vssagent.exe
x86\vsstrace.x86\vsstrace.exe
x64\cscdbdump.x64\cscdbdump.exe
x64\dfsutil.x64\dfsutil.exe
x64\latte.x64\latte.exe
x64\NTttcp.x64\NTttcp.exe
x64\SdkDll.x64\SdkDll.dll
x64\takeshot.x64\takeshot.exe
x64\vshadow.x64\vshadow.exe
x64\vssagent.x64\vssagent.exe
x64\vsstrace.x64\vsstrace.exe
WIP\RingQuery\Checkwin32enlightened.WIP\RingQuery\Checkwin32enlightened.exe
WIP\RingQuery\querytokenX64.WIP\RingQuery\querytokenX64.exe
WIP\RingQuery\querytokenX86.WIP\RingQuery\querytokenX86.exe
WIP\LogPackages\EDP\dpmcmd_amd64.WIP\LogPackages\EDP\dpmcmd_amd64.exe
WIP\LogPackages\EDP\dpmcmd_ARM64.WIP\LogPackages\EDP\dpmcmd_ARM64.exe
WIP\LogPackages\EDP\dpmcmd_x86.WIP\LogPackages\EDP\dpmcmd_x86.exe