windows3-5  Exercise 3: A Change Plan for the Dump Type
=================================================================

Verification: Level 3 (planning only; the change itself is not run here, but the read-only record step was run).

Prediction (work this out before running the script):

  Before reading the solution: list, in order, what you would do before, during and after switching the
  dump type to Automatic, and say what makes each step reversible.

This is a planning exercise: the commands below are NOT to be run unless you intend to make the change.

Plan:

  1. RECORD (read-only; works without administrator rights):
       reg export "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" crashcontrol_backup.reg /y
       (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl').CrashDumpEnabled
  2. PRESERVE EVIDENCE: copy C:\Windows\Minidump somewhere safe before changing anything (chapter 6).
  3. CHECK THE PAGE FILE FITS the new type: .\dump_readiness.ps1   (Automatic after a repeat crash needs RAM or 32 GB, whichever is smaller)
  4. CHANGE ONE THING (administrator rights): System Properties, Advanced tab, Startup and Recovery, Settings,
     Write debugging information: Automatic memory dump. Microsoft says a restart is needed for the change.
  5. RESTART, THEN VERIFY: (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl').CrashDumpEnabled
     should read 7 (Microsoft's value for Automatic memory dump); re-run dump_readiness.ps1.
  6. REVERT, if wanted: set the same box back to Small memory dump (value 3), or, as administrator,
       reg import crashcontrol_backup.reg
     and restart.

Output:

  Step 1 run for real on the author's machine (the export, not any change):

  The operation completed successfully.

  3912
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
  "CrashDumpEnabled"=dword:00000003
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\FullLiveKernelReports]
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\FullLiveKernelReports\ResourceTimeout]
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LiveKernelReports]
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\StorageTelemetry]
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\LastCrashdump]
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\MachineCrash]

WHY THIS WORKS AS AN ANSWER
---------------------------
  The exported file recorded CrashDumpEnabled as dword:00000003 (Small memory dump), which is the value
  step 6 returns to. The export is only a read, so it works as a normal user, and I deleted the test file after
  checking it.
  Why this order works: recording comes first so that the revert exists before the change; the page file check
  comes before the change because the dump needs room (a too-small page file prevents the dump);
  the restart is in the plan because Microsoft says changes to these settings need one; and verification reads
  the value back instead of trusting the dialog.
  Not run here: steps 4 to 6 change a setting, need administrator rights and a restart. The Settings path in step 4
  is Microsoft's (the dump-options article), which also warns that the steps differ between Windows versions,
  so use the plan's shape, not the exact menu names. Whether Automatic is the right choice for you is a
  judgement, not a result: it keeps more evidence at the cost of bigger files, and Microsoft describes it as the
  default.
  Common mistakes: changing the setting before copying the existing dumps; assuming the revert is obvious
  after the change instead of writing it down before; and not verifying after the restart.