Windows Memory Dump Overwrite Registry Setting

When Windows experiences a critical system crash (Blue Screen of Death), it writes diagnostic information to a memory dump file. By default, Windows is configured to overwrite this file every time a new crash occurs to save disk space. This behavior is controlled directly by a specific DWORD value in the Windows Registry, which administrators can configure using the Registry Editor (regedit.exe) to preserve historical crash logs or ensure new ones are always recorded.

The Registry Setting Location and Values

The registry setting responsible for the memory dump overwrite behavior is located in the CrashControl key:

• Registry Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
• Value Name: Overwrite
• Value Type: REG_DWORD

Value Data Options:

• 1 (Enabled): Windows automatically overwrites the existing memory dump file (e.g., C:\Windows\MEMORY.DMP) whenever a new system crash occurs. This is the default setting in modern versions of Windows.
• 0 (Disabled): Windows will not overwrite an existing memory dump file. If a file named MEMORY.DMP already exists in the target directory, the system will skip writing the new kernel dump.

How to Modify the Overwrite Setting via Regedit

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to the following path:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

3. Locate the Overwrite entry in the right-hand pane.

   • If the entry does not exist, right-click an empty space, select New > DWORD (32-bit) Value, and name it Overwrite.

4. Double-click Overwrite to edit its value.

5. In the Value data field, enter:

   • 1 to allow overwriting.
   • 0 to prevent overwriting.

6. Ensure the Base is set to Hexadecimal, then click OK.

7. Restart the computer for the changes to take effect.

Modifying the Setting via Command Prompt

You can also configure this value using an elevated Command Prompt:

• To enable overwriting:

  reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v Overwrite /t REG_DWORD /d 1 /f

• To disable overwriting:

  reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v Overwrite /t REG_DWORD /d 0 /f