http://support.citrix.

com/article/ctx107528

How to Set WinDbg as a Default Windows Postmortem Debugger

Document ID: CTX107528 / Created On: Sep 6, 2005 / Updated On: Jan 11, 2008 Average Rating: (4 ratings)

View products this document applies to Symptoms Sometimes its difficult to capture a user dump inside a terminal session because Dr. Watson doesnt work as the default debugger. Cause This is probably caused by security permissions in Windows Server 2003. Resolution 1. Install the latest Debugging Tools for Windows: http://www.microsoft.com/whdc/devtools/debugging/default.mspx 2. Set WinDbg as a default debugger by issuing the following command: WinDbg -I Note: The I must be capitalized. 3. Create a folder where the dump must be stored and give it full control permissions for users or remote desktop users. For this example, the c:\TEMP folder is used. 4. Inspect the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug For example, it has the following value: "C:\Program Files\Debugging Tools for Windows\windbg.exe" -p %ld -e %ld -g Take the current key value and append the following string: -c '.dump /o /f c:\TEMP\new.dmp; q' -Q -QS -QY -QSY The new key should have the following value: "C:\Program Files\Debugging Tools for Windows\windbg.exe" -p %ld -e %ld -g -c '.dump /o /f c:\TEMP\new.dmp; q' -Q -QS -QY -QSY On 64-bit Windows, use the 64-bit Debugging Tools for Windows. However if you want to save dumps from 32-bit processes (shown as *32 in Task Manager) you also need to change Wow6432Node registry hive and use the 32-bit WinDbg.exe from the 32-bit Debugging Tools for Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug

5. Whenever there is an exception inside a session, a dump is stored in the TEMP folder. Note: The previously stored dump is overwritten. 6. You can use this technique with other debuggers from the Debugging Tools suit. For their command line options, check the debugger.chm help file. Note: On some operating systems such as Windows Server 2003, Windows XP and later you can use the /ma switch instead of /f to save additional debugging information such as handle data and thread time information: "C:\Program Files\Debugging Tools for Windows\windbg.exe" -p %ld -e %ld -g -c '.dump /o /ma c:\TEMP\new.dmp; q' -Q -QS -QY -QSY If the dump is still not generated, try to enable detailed process tracking in your local security policy, then look for process creation events in the security event log to see if the postmortem debugger is launched.