Se você ficar sem opções após examinar logs / eventos, tente forçar o System Crash a sair do teclado quando isso acontecer e, em seguida, analise o dump * com o depurador ( windbg
, por exemplo- link para ferramentas de depuração aqui: link ).
* Você quer definir o tipo de despejo como kernel
, você pode configurá-lo em System->Advanced->Startup and Recovery
Como ativar a falha iniciada pelo teclado é descrita em detalhes aqui: Forçando uma pane no sistema no teclado
Pontos principais:
You must ensure the following three settings before the keyboard can
cause a system crash:
If you wish a crash dump file to be written, you must enable such dump
files, choose the path and file name, and select the size of the dump
file. For more information, see Enabling a Kernel-Mode Dump File.
With PS/2 keyboards, you must enable the keyboard-initiated crash in
the registry. In the registry key
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters,
create a value named CrashOnCtrlScroll, and set it equal to a
REG_DWORD value of 0x01.
With USB keyboards, you must enable the keyboard-initiated crash in
the registry. In the registry key
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters,
create a value named CrashOnCtrlScroll, and set it equal to a
REG_DWORD value of 0x01.
You must restart the system for these settings to take effect.
After this is completed, the keyboard crash can be initiated by using
the following hotkey sequence: Hold down the rightmost CTRL key, and
press the SCROLL LOCK key twice.
(...)
Limitations
It is possible for a system to freeze in such a way that the keyboard
shortcut sequence will not work. However, this should be a very rare
occurrence. Using the keyboard shortcut sequence to initiate a crash
will work even in many instances where CTRL+ALT+DELETE does not work.
Forcing a system crash from the keyboard does not work if the computer
stops responding at a high interrupt request level (IRQL). This
limitation exists because the Kbdhid.sys driver, which allows the
memory dump process to run, operates at a lower IRQL than the
i8042prt.sys driver.