dumpfve.sys<\/code> to do the task of dumping the memory to a file.<\/p>\nThe file dumpfve.sys<\/code> is mentioned in the following registry key, in a REG_MULTI_SZ value named DumpFilters<\/code><\/p>\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CrashControl<\/pre>\n![\"windows](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/crash-dumpfilters-registry.png\")
<\/p>\n
The multi-string registry value allows third-party providers to add the crash dump filter drivers — e.g., Truecrypt.sys from TrueCrypt, MfeEpeOpal.sys from McAfee Endpoint Encryption, or Daemon Tools filter driver, etc. Most disk encryption products typically also want to encrypt hibernation & crash dump files and add their dump filters in the above registry key.<\/p>\n
The dump filter drivers mentioned in the registry key are loaded when crash dump or hibernation is initialized. If Windows is unable to load the filter drivers during the hibernate process, it generates an event log entry with the Event ID 45. The event log entry looks like the following:<\/p>\n
Log Name: System \nSource: volmgr \nEvent ID: 45 \nTask Category: None \nLevel: Error \nKeywords: Classic \nDescription: \nThe system could not successfully load the crash dump driver.<\/pre>\nAdditionally, when you go to the Details tab in this event and then select friendly view, you may notice the following:<\/p>\n
Binary data:\n\nIn Words\n\n0000: 00000000 00000001 00000000 C004002D \n0010: 00002005 C0000034 00000000 00000000 \n0020: 00000000 00000000\n\nC0000034 - means STATUS_OBJECT_NAME_NOT_FOUND\n\nC004002D - means IO_DUMP_DRIVER_LOAD_FAILURE<\/pre>\nThe problem may occur during the shutdown<\/strong> as well. How?<\/strong><\/p>\nIf Fast Startup<\/a> is enabled, the system logs off all the user sessions completely and then hibernates the system instead of performing a clean shut down<\/a>. Fast Startup relies upon the hibernation feature, dumping the kernel memory to hiberfil.sys file. When the fast startup is enabled and a user shuts down the computer, all sessions are logged off, and the computer is supposed to enter hibernation. As part of the hibernation process, Windows initializes the system’s memory dump configuration. If the filter driver(s) is not loaded, it fails to hibernate, and brings you back to the Windows lock screen or the sign-in screen.<\/p>\nRELATED:<\/strong> Disable Hibernation Without Disabling Fast Startup<\/a><\/p>\nWorkarounds<\/h3>\n
To avoid the problem from happening during shutdown (not hibernate), you can disable fast startup<\/a> or bypass fast startup during shutdown on a per-session basis by running the command shutdown.exe \/s \/t 0<\/code> to shut down the computer.<\/p>\nOr, disable Fast Startup via Power Options:<\/p>\n
\n- Open Control Panel \u2192 All Control Panel Items \u2192 Power Options (or run
powercfg.cpl<\/code>)<\/li>\n- Click Choose what the power buttons do<\/strong><\/li>\n
- Click Change settings that are currently unavailable<\/strong><\/li>\n
- Uncheck Turn on fast startup<\/strong><\/li>\n
- Click OK.<\/li>\n<\/ol>\n
However, turning off fast startup is a compromise. It’s not a feasible thing to do for most users, as the restart process in Windows continues to perform a full boot cycle, without the hibernation performance benefits.<\/p>\n
Resolution<\/h2>\n
To fix the problem, remove third-party crash dump filter driver references from the registry using the following steps:<\/p>\n
\n- Start the Registry Editor (
regedit.exe<\/code>) and go to the following key:\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\CrashControl<\/pre>\n<\/li>\n
- Backup<\/a> the key by exporting it to a .reg file.<\/li>\n
- Double-click the
DumpFilters<\/code> multi-string value.<\/li>\n- Remove all the third-party filter drivers listed in the value. Note that the Windows default driver dumpfve.sys<\/strong> should not<\/strong> be removed.
\n![\"dumpfilters](\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/dumpfilters-registry.png\")
<\/li>\n- Exit the Registry Editor.<\/li>\n
- Restart Windows.<\/li>\n<\/ol>\n
The hibernate and shutdown features should now work correctly — with or without Fast Startup enabled.<\/p>\n
If you want to resolve the issue without<\/strong> removing 3rd party dump filter drivers, contact the software vendor for an updated version of their product to support the latest version and build<\/a> of Windows — e.g., Windows 10 v22H2.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"