Registry Location for Memory Dump File Names

The Windows Registry stores the active configuration, paths, and naming conventions for system-wide memory dump files under a centralized control key. This article details the exact registry path, the core values responsible for defining memory dump filenames and storage directories, and the settings that control how crash logs are generated across the operating system.

The CrashControl Registry Path

Windows manages all kernel-level and system crash dump configurations within the following registry path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

This key contains the active configuration used by the Windows kernel crash handler during a Stop error (Blue Screen of Death).

Key Values for Dump File Naming and Paths

Inside the CrashControl key, the specific file naming structures and storage directories are determined by several string and DWORD values:

• DumpFile (REG_EXPAND_SZ): Defines the complete directory path and filename for full, kernel, active, and automatic memory dumps. The default value is %SystemRoot%\MEMORY.DMP. Custom file names and paths can be set here to redirect output to alternative local storage locations.
• MinidumpDir (REG_EXPAND_SZ): Specifies the directory path where small memory dumps (minidumps) are saved. The default value is %SystemRoot%\Minidump. Individual minidump filenames are dynamically generated by Windows using the date and incident count (e.g., dump-date-index.dmp).
• DedicatedDumpFile (REG_SZ or REG_EXPAND_SZ): Present in custom storage configurations where dump data must be written to a dedicated, pre-allocated file on a non-boot volume during a crash.

Associated Configuration Settings

The structure and generation of these files are directly controlled by surrounding values in the same key:

• CrashDumpEnabled (REG_DWORD): Determines the dump type to produce (0 = None, 1 = Complete memory dump, 2 = Kernel memory dump, 3 = Small memory dump, 7 = Automatic memory dump).
• Overwrite (REG_DWORD): Set to 1 to overwrite the existing MEMORY.DMP file when a new crash occurs, or 0 to prevent overwriting existing dump files of the same name.
• LogEvent (REG_DWORD): Set to 1 to write an event to the System Event Log whenever a dump file is written to disk.