none
Remote Desktop Connection Stopped Working when Disconnecting

    Question

  • Hi I have a fresh clean install of Windows 8.1. Whenever I RDP into another Windows 8 machine... upong disconnecting I get the error: "Remote Desktop Connection Stopped Working"

    I have tried not mapping to remote printers, or drives (smart cards etc.) and it still persists. When I remote to Windows Server or Win 7, it does not happen. 

    Anyone have any ideas?

    Thank you

    mi

    Wednesday, December 04, 2013 1:07 AM

Answers

  • *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** WARNING: Unable to verify timestamp for storeng.dll
    *** ERROR: Module load completed but symbols could not be loaded for storeng.dll
    *** The OS name list needs to be updated! Unknown Windows version: 6.3 ***
    
    FAULTING_IP: 
    ntdll!RtlpWaitOnCriticalSection+b6 [d:\blue_gdr\minkernel\ntdll\resource.c @ 727]
    00007ffc`0941bb96 ff4024          inc     dword ptr [rax+24h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 00007ffc0941bb96 (ntdll!RtlpWaitOnCriticalSection+0x00000000000000b6)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000001
       Parameter[1]: 0000000000000024
    Attempt to write to address 0000000000000024
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_WRITE
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000001
    
    EXCEPTION_PARAMETER2:  0000000000000024
    
    WRITE_ADDRESS:  0000000000000024 
    
    FOLLOWUP_IP: 
    storeng+9721
    00000036`15a79721 ??              ???
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    FAULTING_THREAD:  0000000000000ed0
    
    PRIMARY_PROBLEM_CLASS:  NULL_CLASS_PTR_WRITE
    
    BUGCHECK_STR:  APPLICATION_FAULT_NULL_CLASS_PTR_WRITE
    
    LAST_CONTROL_TRANSFER:  from 00007ffc0941b623 to 00007ffc0941bb96
    
    STACK_TEXT:  
    00000036`151aec30 00007ffc`0941b623 : 00000000`00000000 00007ffc`06b01a54 00000036`15ab5c48 00000000`00000003 : ntdll!RtlpWaitOnCriticalSection+0xb6
    00000036`151aed00 00000036`15a79721 : 00000000`00000003 00000000`00000003 00000000`00000000 00000036`12b55f90 : ntdll!RtlpEnterCriticalSectionContended+0x93
    00000036`151aed40 00000000`00000003 : 00000000`00000003 00000000`00000000 00000036`12b55f90 00000036`ffffffff : storeng+0x9721
    00000036`151aed48 00000000`00000003 : 00000000`00000000 00000036`12b55f90 00000036`ffffffff 00000000`00001130 : 0x3
    00000036`151aed50 00000000`00000000 : 00000036`12b55f90 00000036`ffffffff 00000000`00001130 00000000`00000000 : 0x3
    
    
    STACK_COMMAND:  ~4s; .ecxr ; kb
    
    SYMBOL_STACK_INDEX:  2
    
    SYMBOL_NAME:  storeng+9721
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: storeng
    
    IMAGE_NAME:  storeng.dll
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  52745865
    
    FAILURE_BUCKET_ID:  NULL_CLASS_PTR_WRITE_c0000005_storeng.dll!Unknown
    
    BUCKET_ID:  APPLICATION_FAULT_NULL_CLASS_PTR_WRITE_storeng+9721
    
    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/mstsc_exe/6_3_9600_16384/5215e2b5/ntdll_dll/6_3_9600_16408/523d5305/c0000005/0004bb96.htm?Retriage=1
    
    Followup: MachineOwner
    ---------
    
    0:004> lmvm storeng
    start             end                 module name
    00000036`15a70000 00000036`15b1e000   storeng  T (no symbols)           
        Loaded symbol image file: storeng.dll
        Image path: C:\Program Files\Lenovo\Fingerprint Manager Pro\storeng.dll
        Image name: storeng.dll
        Timestamp:        Sat Nov 02 09:41:57 2013 (52745865)
        CheckSum:         000ACFA5
        ImageSize:        000AE000
        File version:     8.0.1.0
        Product version:  8.0.0.0
        File flags:       0 (Mask 3F)
        File OS:          4 Unknown Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

    Hi Mlssa,

    Regarding this issue, I would like to know if you installed the Fingerprint Manager software.

    I suggest you uninstall this software to test this issue.

    Regard,


    Kelvin hsu
    TechNet Community Support



    Friday, January 03, 2014 1:36 AM
  • Hi Mlssa11,

    To remove the registry edit Kelvin had you create in a previous step you will want to create another notepad document. This time you will need to save the following as a dump-remove.reg:

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\localdumps\]

    After you save it, preferably to your desktop, simply double click on it to import it the same as you did the previous dump.reg document. This should remove the dump creation setting from within your registry. 

    Tuesday, January 07, 2014 6:37 PM

All replies

  • Hi,

    For this issue, please do a test to see if the other windows machine can remote to windows 8 machine.

    I suggest you check the Remote setting for windows 8.

    Meanwhile, please use "ping" to check if the issue is related to network.

    In addition, please check the event viewer to see if some error log appeared when the issue occurred.

    Keep post.

    Regards,


    Kelvin hsu
    TechNet Community Support

    Friday, December 06, 2013 6:12 AM
  • I can remote into the machine fine. Just when I am done, and disconnect I get the error. I can ping the machine fine. I can remote from other machines fine as well. 

    There is a log entry under application windows log every time:

    Log Name:      Application
    Source:        Application Error
    Date:          12/6/2013 12:30:03 PM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      mi-t.xxxxx.xxxx.com
    Description:
    Faulting application name: mstsc.exe, version: 6.3.9600.16384, time stamp: 0x5215e2b5
    Faulting module name: ntdll.dll, version: 6.3.9600.16408, time stamp: 0x523d5305
    Exception code: 0xc0000005
    Fault offset: 0x000000000004bb96
    Faulting process id: 0x191c
    Faulting application start time: 0x01cef2a8bcc4b2a5
    Faulting application path: C:\Windows\System32\mstsc.exe
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Report Id: 09b082be-5e9c-11e3-8260-5c514f739cdf
    Faulting package full name: 
    Faulting package-relative application ID: 
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-12-06T17:30:03.000000000Z" />
        <EventRecordID>3575</EventRecordID>
        <Channel>Application</Channel>
        <Computer>mi-t.xxxxx.xxxx.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>mstsc.exe</Data>
        <Data>6.3.9600.16384</Data>
        <Data>5215e2b5</Data>
        <Data>ntdll.dll</Data>
        <Data>6.3.9600.16408</Data>
        <Data>523d5305</Data>
        <Data>c0000005</Data>
        <Data>000000000004bb96</Data>
        <Data>191c</Data>
        <Data>01cef2a8bcc4b2a5</Data>
        <Data>C:\Windows\System32\mstsc.exe</Data>
        <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
        <Data>09b082be-5e9c-11e3-8260-5c514f739cdf</Data>
        <Data>
        </Data>
        <Data>
        </Data>
      </EventData>
    </Event>


    • Edited by MIssa11 Thursday, December 26, 2013 3:11 PM
    Friday, December 06, 2013 5:31 PM
  • I don't have an answer or help, but just for reference I've heard others report this on other forums.

      

    -Noel


    Detailed how-to in my eBooks:  

    Configure The Windows 7 "To Work" Options
    Configure The Windows 8 "To Work" Options

    Saturday, December 07, 2013 5:00 AM
  • Hi,

    For this error, the modules that is failing are part of .NET framework.

    I would try to update this to see if that might solve the problem.

    Please uncheck and check .NET Framework 3.5(includes, Net 2.0 and 3.0) to test it.

    Regards,


    Kelvin hsu
    TechNet Community Support

    Thursday, December 26, 2013 11:51 AM
  • For a second I thought it worked, because the first test went well but then it happened agian. 

    Log Name:      Application
    Source:        Application Error
    Date:          12/26/2013 10:08:26 AM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      mi-t.xxxxx.xxxx.com
    Description:
    Faulting application name: mstsc.exe, version: 6.3.9600.16384, time stamp: 0x5215e2b5
    Faulting module name: ntdll.dll, version: 6.3.9600.16408, time stamp: 0x523d5305
    Exception code: 0xc0000005
    Fault offset: 0x000000000004bb96
    Faulting process id: 0x115c
    Faulting application start time: 0x01cf024c4263f8cb
    Faulting application path: C:\Windows\System32\mstsc.exe
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Report Id: 914f997d-6e3f-11e3-826b-5c514f739cdf
    Faulting package full name: 
    Faulting package-relative application ID: 
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2013-12-26T15:08:26.000000000Z" />
        <EventRecordID>6628</EventRecordID>
        <Channel>Application</Channel>
        <Computer>mi-t.xxxxx.xxxx.com</Computer>
        <Security />
      </System>
      <EventData>
        <Data>mstsc.exe</Data>
        <Data>6.3.9600.16384</Data>
        <Data>5215e2b5</Data>
        <Data>ntdll.dll</Data>
        <Data>6.3.9600.16408</Data>
        <Data>523d5305</Data>
        <Data>c0000005</Data>
        <Data>000000000004bb96</Data>
        <Data>115c</Data>
        <Data>01cf024c4263f8cb</Data>
        <Data>C:\Windows\System32\mstsc.exe</Data>
        <Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
        <Data>914f997d-6e3f-11e3-826b-5c514f739cdf</Data>
        <Data>
        </Data>
        <Data>
        </Data>
      </EventData>
    </Event>

    Thursday, December 26, 2013 3:11 PM
  • Hi,

    Based on the current situation, this error means mstsc.exe made a call into ntdll.dll (which is part of the Windows operating system) and whatever they're doing, they're doing it wrong because it caused a crash.

    Let us try capture a dump file  and upload your app dump file.

    First enable app crash dump collection by copying following words into notepad, saving it as dump.reg and importing it:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\localdumps\mstsc.exe]

    "DumpFolder"=hex(2):63,00,3a,00,5c,00,63,00,72,00,61,00,73,00,68,00,64,00,75,\

      00,6d,00,70,00,73,00,00,00

    "DumpCount"=dword:00000010

    "DumpType"=dword:00000001

    "CustomDumpFlags"=dword:00000000

    Then, do a Remote Desktop Connection which may cause the issue. If error appeared, please find the crashdump file under c:\.

    Keep post.

    Regards,


    Kelvin hsu
    TechNet Community Support

    Monday, December 30, 2013 11:09 AM
  • Hi Kelvin, I have the app dump file. How can I send it right to you? I prefer not to post it on the forum.
    Tuesday, December 31, 2013 10:45 PM
  • Hi Mlssa,

    I suggest you use SkyDrive to upload this dump file.

    http://skydrive.com

    Then,please share the link on this thread.

    If you cannot post the link, please use the following link to verify your account.

    http://social.msdn.microsoft.com/Forums/en-US/ceb31cd8-39fc-4af9-ac77-1dff965dfcf0/verify-your-account-10?forum=reportabug

    Thanks for your understanding.

    Regards,


    Wednesday, January 01, 2014 2:32 AM
  • http://sdrv.ms/1da47Nt

    Here it is.

    Wednesday, January 01, 2014 5:16 PM
  • Hi,

    According to the dump file, the issue is related to storeng.dll.

    I suggest you try using the following command to repair your system.

    1.Open an elevated command prompt: press Win+X, then click Command Prompt(Admin),and press Enter.

    2.At the command prompt, type the following command, and then press ENTER:

    Dism /Online /Cleanup-Image /RestoreHealth

    If it doesn't work,I suggest you refresh your PC to check the result.

    http://windows.microsoft.com/en-US/windows-8/restore-refresh-reset-pc

    Regards,


    Kelvin hsu
    TechNet Community Support

    Thursday, January 02, 2014 7:38 AM
  • Thank you.

    The command did not work.. but I do not want to refresh since it will remove my apps.  Any other way to reinstall that file?

    Thursday, January 02, 2014 3:39 PM
  • *******************************************************************************
    *                                                                             *
    *                        Exception Analysis                                   *
    *                                                                             *
    *******************************************************************************
    
    *** WARNING: Unable to verify timestamp for storeng.dll
    *** ERROR: Module load completed but symbols could not be loaded for storeng.dll
    *** The OS name list needs to be updated! Unknown Windows version: 6.3 ***
    
    FAULTING_IP: 
    ntdll!RtlpWaitOnCriticalSection+b6 [d:\blue_gdr\minkernel\ntdll\resource.c @ 727]
    00007ffc`0941bb96 ff4024          inc     dword ptr [rax+24h]
    
    EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
    ExceptionAddress: 00007ffc0941bb96 (ntdll!RtlpWaitOnCriticalSection+0x00000000000000b6)
       ExceptionCode: c0000005 (Access violation)
      ExceptionFlags: 00000000
    NumberParameters: 2
       Parameter[0]: 0000000000000001
       Parameter[1]: 0000000000000024
    Attempt to write to address 0000000000000024
    
    DEFAULT_BUCKET_ID:  NULL_CLASS_PTR_WRITE
    
    PROCESS_NAME:  mstsc.exe
    
    ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
    
    EXCEPTION_PARAMETER1:  0000000000000001
    
    EXCEPTION_PARAMETER2:  0000000000000024
    
    WRITE_ADDRESS:  0000000000000024 
    
    FOLLOWUP_IP: 
    storeng+9721
    00000036`15a79721 ??              ???
    
    NTGLOBALFLAG:  0
    
    APPLICATION_VERIFIER_FLAGS:  0
    
    APP:  mstsc.exe
    
    FAULTING_THREAD:  0000000000000ed0
    
    PRIMARY_PROBLEM_CLASS:  NULL_CLASS_PTR_WRITE
    
    BUGCHECK_STR:  APPLICATION_FAULT_NULL_CLASS_PTR_WRITE
    
    LAST_CONTROL_TRANSFER:  from 00007ffc0941b623 to 00007ffc0941bb96
    
    STACK_TEXT:  
    00000036`151aec30 00007ffc`0941b623 : 00000000`00000000 00007ffc`06b01a54 00000036`15ab5c48 00000000`00000003 : ntdll!RtlpWaitOnCriticalSection+0xb6
    00000036`151aed00 00000036`15a79721 : 00000000`00000003 00000000`00000003 00000000`00000000 00000036`12b55f90 : ntdll!RtlpEnterCriticalSectionContended+0x93
    00000036`151aed40 00000000`00000003 : 00000000`00000003 00000000`00000000 00000036`12b55f90 00000036`ffffffff : storeng+0x9721
    00000036`151aed48 00000000`00000003 : 00000000`00000000 00000036`12b55f90 00000036`ffffffff 00000000`00001130 : 0x3
    00000036`151aed50 00000000`00000000 : 00000036`12b55f90 00000036`ffffffff 00000000`00001130 00000000`00000000 : 0x3
    
    
    STACK_COMMAND:  ~4s; .ecxr ; kb
    
    SYMBOL_STACK_INDEX:  2
    
    SYMBOL_NAME:  storeng+9721
    
    FOLLOWUP_NAME:  MachineOwner
    
    MODULE_NAME: storeng
    
    IMAGE_NAME:  storeng.dll
    
    DEBUG_FLR_IMAGE_TIMESTAMP:  52745865
    
    FAILURE_BUCKET_ID:  NULL_CLASS_PTR_WRITE_c0000005_storeng.dll!Unknown
    
    BUCKET_ID:  APPLICATION_FAULT_NULL_CLASS_PTR_WRITE_storeng+9721
    
    WATSON_STAGEONE_URL:  http://watson.microsoft.com/StageOne/mstsc_exe/6_3_9600_16384/5215e2b5/ntdll_dll/6_3_9600_16408/523d5305/c0000005/0004bb96.htm?Retriage=1
    
    Followup: MachineOwner
    ---------
    
    0:004> lmvm storeng
    start             end                 module name
    00000036`15a70000 00000036`15b1e000   storeng  T (no symbols)           
        Loaded symbol image file: storeng.dll
        Image path: C:\Program Files\Lenovo\Fingerprint Manager Pro\storeng.dll
        Image name: storeng.dll
        Timestamp:        Sat Nov 02 09:41:57 2013 (52745865)
        CheckSum:         000ACFA5
        ImageSize:        000AE000
        File version:     8.0.1.0
        Product version:  8.0.0.0
        File flags:       0 (Mask 3F)
        File OS:          4 Unknown Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

    Hi Mlssa,

    Regarding this issue, I would like to know if you installed the Fingerprint Manager software.

    I suggest you uninstall this software to test this issue.

    Regard,


    Kelvin hsu
    TechNet Community Support



    Friday, January 03, 2014 1:36 AM
  • Wow, looks like that was it because I am no longer getting the error. So the Thinkvantage Fingerprint Manager Pro was the issue then?   I wonder if windows 8 can do the finger print sensor natively. Thank you for your help!
    Friday, January 03, 2014 3:10 AM
  • Hi,

    Did you use the latest version for Fingerprint Manager Pro  software?

    You can use windows 8.1 fingerprint .The feature is build-in.

    http://technet.microsoft.com/en-us/library/dn344916.aspx

    Open Control Panel>Hardware and Sound>Biometric Devices.

    Note: you need to install .NET Framework 3.5 before using this feature.

    Regards,


    Kelvin hsu
    TechNet Community Support

    Friday, January 03, 2014 5:43 AM
  • Yes I was using the latest version. I re-installed it to see if it would still happen, and sure thing.. as soon as I reinstalled and tested it again, the error came up.  I would like to use the native 8.1 feature but when I uninstall Fingerprint Manager Pro, I also lose the driver. I can't find the driver alone.   I have a Thinkpad t440s. 

    Thanks again.

    mi

    Friday, January 03, 2014 4:04 PM
  • FYI, same issue here, Windows 8.1 on ThinkPad W520 (upgraded from Windows 8).

    Even without Fingerprint Manager, and having uninstalled ThinkVantage Password Manager as well, still crashes.  I also tried the:
    Dism /Online /Cleanup-Image /RestoreHealth

    but no luck, my mstsc.exe is still crashing when the remote session window is closed.

    Any ideas?  Happy to upload/provide more details, here's the Report.wer contents from

    C:\Users\myusername\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_mstsc.exe_fe9be6b453d387663f457b9f305ac5e3ae6f5fc2_00000000_2fb47393\Report.wer

    Version=1
    EventType=CLR20r3
    EventTime=130332895175356766
    ReportType=2
    Consent=1
    UploadTime=130332895176424161
    ReportIdentifier=1d23a02d-7507-11e3-81f8-f0def1f95c65
    Response.BucketId=c93f173301a697688e31de36235ffda6
    Response.BucketTable=5
    Response.LegacyBucketId=-439202015
    Response.type=4
    Sig[0].Name=Problem Signature 01
    Sig[0].Value=mstsc.exe
    Sig[1].Name=Problem Signature 02
    Sig[1].Value=6.3.9600.16384
    Sig[2].Name=Problem Signature 03
    Sig[2].Value=5215e2b5
    Sig[3].Name=Problem Signature 04
    Sig[3].Value=WHSOLConnector
    Sig[4].Name=Problem Signature 05
    Sig[4].Value=2.5.7.7
    Sig[5].Name=Problem Signature 06
    Sig[5].Value=4beac4d4
    Sig[6].Name=Problem Signature 07
    Sig[6].Value=70
    Sig[7].Name=Problem Signature 08
    Sig[7].Value=71
    Sig[8].Name=Problem Signature 09
    Sig[8].Value=System.NullReferenceException
    DynamicSig[1].Name=OS Version
    DynamicSig[1].Value=6.3.9600.2.0.0.256.48
    DynamicSig[2].Name=Locale ID
    DynamicSig[2].Value=1033
    UI[2]=C:\WINDOWS\system32\mstsc.exe
    UI[3]=Remote Desktop Connection has stopped working
    UI[4]=Windows can check online for a solution to the problem.
    UI[5]=Check online for a solution and close the program
    UI[6]=Check online for a solution later and close the program
    UI[7]=Close the program
    LoadedModule[0]=C:\WINDOWS\system32\mstsc.exe
    LoadedModule[1]=C:\WINDOWS\SYSTEM32\ntdll.dll
    LoadedModule[2]=C:\WINDOWS\system32\KERNEL32.DLL
    LoadedModule[3]=C:\WINDOWS\system32\KERNELBASE.dll
    LoadedModule[4]=C:\WINDOWS\system32\ADVAPI32.dll
    LoadedModule[5]=C:\WINDOWS\system32\GDI32.dll
    LoadedModule[6]=C:\WINDOWS\system32\USER32.dll
    LoadedModule[7]=C:\WINDOWS\system32\msvcrt.dll
    LoadedModule[8]=C:\WINDOWS\system32\ole32.dll
    LoadedModule[9]=C:\WINDOWS\system32\OLEAUT32.dll
    LoadedModule[10]=C:\WINDOWS\system32\SHELL32.dll
    LoadedModule[11]=C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.16384_none_62475f7becb72503\COMCTL32.dll
    LoadedModule[12]=C:\WINDOWS\system32\COMDLG32.dll
    LoadedModule[13]=C:\WINDOWS\system32\SHLWAPI.dll
    LoadedModule[14]=C:\WINDOWS\system32\CRYPT32.dll
    LoadedModule[15]=C:\WINDOWS\system32\WINHTTP.dll
    LoadedModule[16]=C:\WINDOWS\system32\credui.dll
    LoadedModule[17]=C:\WINDOWS\system32\Secur32.dll
    LoadedModule[18]=C:\WINDOWS\system32\CRYPTUI.dll
    LoadedModule[19]=C:\WINDOWS\system32\CFGMGR32.dll
    LoadedModule[20]=C:\WINDOWS\system32\WS2_32.dll
    LoadedModule[21]=C:\WINDOWS\system32\NETAPI32.dll
    LoadedModule[22]=C:\WINDOWS\system32\RPCRT4.dll
    LoadedModule[23]=C:\WINDOWS\system32\WINMM.dll
    LoadedModule[24]=C:\WINDOWS\system32\IPHLPAPI.DLL
    LoadedModule[25]=C:\WINDOWS\SYSTEM32\sechost.dll
    LoadedModule[26]=C:\WINDOWS\SYSTEM32\combase.dll
    LoadedModule[27]=C:\WINDOWS\system32\MSASN1.dll
    LoadedModule[28]=C:\WINDOWS\system32\NSI.dll
    LoadedModule[29]=C:\WINDOWS\system32\netutils.dll
    LoadedModule[30]=C:\WINDOWS\system32\srvcli.dll
    LoadedModule[31]=C:\WINDOWS\system32\wkscli.dll
    LoadedModule[32]=C:\WINDOWS\system32\WINMMBASE.dll
    LoadedModule[33]=C:\WINDOWS\system32\WINNSI.DLL
    LoadedModule[34]=C:\WINDOWS\system32\SHCORE.DLL
    LoadedModule[35]=C:\WINDOWS\system32\DEVOBJ.dll
    LoadedModule[36]=C:\WINDOWS\system32\SSPICLI.DLL
    LoadedModule[37]=C:\WINDOWS\system32\IMM32.DLL
    LoadedModule[38]=C:\WINDOWS\system32\MSCTF.dll
    LoadedModule[39]=C:\Windows\system32\nvinitx.dll
    LoadedModule[40]=C:\WINDOWS\SYSTEM32\kernel.appcore.dll
    LoadedModule[41]=C:\WINDOWS\system32\CRYPTBASE.dll
    LoadedModule[42]=C:\WINDOWS\system32\bcryptPrimitives.dll
    LoadedModule[43]=C:\WINDOWS\system32\uxtheme.dll
    LoadedModule[44]=C:\WINDOWS\system32\credssp.dll
    LoadedModule[45]=C:\WINDOWS\system32\NTASN1.dll
    LoadedModule[46]=C:\WINDOWS\SYSTEM32\clbcatq.dll
    LoadedModule[47]=C:\WINDOWS\system32\PROPSYS.dll
    LoadedModule[48]=C:\WINDOWS\system32\dwmapi.dll
    LoadedModule[49]=C:\WINDOWS\system32\mstscax.dll
    LoadedModule[50]=C:\WINDOWS\system32\PSAPI.DLL
    LoadedModule[51]=C:\WINDOWS\system32\d2d1.dll
    LoadedModule[52]=C:\WINDOWS\system32\d3d11.dll
    LoadedModule[53]=C:\WINDOWS\system32\MSACM32.dll
    LoadedModule[54]=C:\WINDOWS\system32\VERSION.dll
    LoadedModule[55]=C:\WINDOWS\system32\SETUPAPI.dll
    LoadedModule[56]=C:\WINDOWS\system32\DWrite.dll
    LoadedModule[57]=C:\WINDOWS\system32\bcrypt.dll
    LoadedModule[58]=C:\WINDOWS\system32\ncrypt.dll
    LoadedModule[59]=C:\WINDOWS\system32\pdh.dll
    LoadedModule[60]=C:\WINDOWS\system32\dxgi.dll
    LoadedModule[61]=C:\WINDOWS\system32\explorerframe.dll
    LoadedModule[62]=C:\WINDOWS\system32\DUser.dll
    LoadedModule[63]=C:\WINDOWS\system32\DUI70.dll
    LoadedModule[64]=C:\WINDOWS\system32\WINTRUST.dll
    LoadedModule[65]=C:\Windows\system32\WHSOLConnector.dll
    LoadedModule[66]=C:\WINDOWS\system32\mscoree.dll
    LoadedModule[67]=C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll
    LoadedModule[68]=C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll
    LoadedModule[69]=C:\WINDOWS\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.8428_none_88dcdb0b2fb19957\MSVCR80.dll
    LoadedModule[70]=C:\WINDOWS\system32\profapi.dll
    LoadedModule[71]=C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\mscorlib\97d2eb053ee241db571311577790ae43\mscorlib.ni.dll
    LoadedModule[72]=C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorjit.dll
    LoadedModule[73]=C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\System\8b12c5fec7e8912da325ee73b380e652\System.ni.dll
    LoadedModule[74]=C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\System.Drawing\3eac16e6688dfec78565e3e71a26266f\System.Drawing.ni.dll
    LoadedModule[75]=C:\WINDOWS\assembly\NativeImages_v2.0.50727_64\System.Windows.Forms\d78d7a76a56319e4bc1cbffa3a90a0e1\System.Windows.Forms.ni.dll
    LoadedModule[76]=C:\WINDOWS\System32\Essentials\VCListener.dll
    LoadedModule[77]=C:\WINDOWS\system32\MF.dll
    LoadedModule[78]=C:\WINDOWS\system32\MFCORE.DLL
    LoadedModule[79]=C:\WINDOWS\system32\ksuser.dll
    LoadedModule[80]=C:\WINDOWS\system32\MFPlat.dll
    LoadedModule[81]=C:\WINDOWS\system32\RTWorkQ.DLL
    LoadedModule[82]=C:\WINDOWS\system32\AVRT.dll
    LoadedModule[83]=C:\Windows\System32\MSAudDecMFT.dll
    LoadedModule[84]=C:\WINDOWS\System32\MMDevApi.dll
    LoadedModule[85]=C:\WINDOWS\System32\perfos.dll
    LoadedModule[86]=C:\Windows\System32\msxml6.dll
    LoadedModule[87]=C:\WINDOWS\system32\NLAapi.dll
    LoadedModule[88]=C:\Windows\System32\rasadhlp.dll
    LoadedModule[89]=C:\WINDOWS\system32\WTSAPI32.dll
    LoadedModule[90]=C:\WINDOWS\system32\WINSTA.dll
    LoadedModule[91]=C:\WINDOWS\system32\mswsock.dll
    LoadedModule[92]=C:\WINDOWS\system32\DNSAPI.dll
    LoadedModule[93]=C:\Program Files\Bonjour\mdnsNSP.dll
    LoadedModule[94]=C:\WINDOWS\System32\fwpuclnt.dll
    LoadedModule[95]=C:\WINDOWS\system32\DPAPI.DLL
    LoadedModule[96]=C:\WINDOWS\system32\CRYPTSP.dll
    LoadedModule[97]=C:\WINDOWS\system32\rsaenh.dll
    LoadedModule[98]=C:\WINDOWS\system32\schannel.DLL
    LoadedModule[99]=C:\WINDOWS\system32\tspkg.DLL
    LoadedModule[100]=C:\WINDOWS\system32\ncryptsslp.dll
    LoadedModule[101]=C:\WINDOWS\SYSTEM32\gpapi.dll
    LoadedModule[102]=C:\WINDOWS\system32\wdmaud.drv
    LoadedModule[103]=C:\WINDOWS\system32\AUDIOSES.DLL
    LoadedModule[104]=C:\WINDOWS\SYSTEM32\powrprof.dll
    LoadedModule[105]=C:\WINDOWS\system32\msacm32.drv
    LoadedModule[106]=C:\WINDOWS\system32\midimap.dll
    LoadedModule[107]=C:\Windows\System32\msmpeg2vdec.dll
    LoadedModule[108]=C:\WINDOWS\System32\msvproc.dll
    LoadedModule[109]=C:\WINDOWS\system32\LINKINFO.dll
    LoadedModule[110]=C:\WINDOWS\system32\ntshrui.dll
    LoadedModule[111]=C:\WINDOWS\system32\cscapi.dll
    State[0].Key=Transport.DoneStage1
    State[0].Value=1
    FriendlyEventName=Stopped working
    ConsentKey=CLR20r3
    AppName=Remote Desktop Connection
    AppPath=C:\Windows\System32\mstsc.exe
    ReportDescription=Stopped working
    ApplicationIdentity=00000000000000000000000000000000


    Saturday, January 04, 2014 6:16 AM
  • Kelvin, how can I undo the script above that is capturing the dump files?
    Sunday, January 05, 2014 4:43 AM
  • Hi tinkererguy,

    I suggest you post a new thread to describe your issue.

    Thanks for your understanding.

    Regards,


    Kelvin hsu
    TechNet Community Support

    Tuesday, January 07, 2014 1:32 AM
  • Hi Mlssa,

    If you want to capture a app Dump file, you should add a registry key.

    So, that's not script. That is a registry key.

    Since the issue is related to Fingerprint Manager Pro, I suggest you contact Lenovo for further help.

    Also, I suggest you try windows 8 Fingerprint Manager Pro driver to test it.

    Regards,


    Kelvin hsu
    TechNet Community Support

    Tuesday, January 07, 2014 1:46 AM
  • Kelvin, I just want to undo what you had me do in an earlier post to have crash dumps save to c:\crash dumps.

    You had me create dump.reg above.

     
    Tuesday, January 07, 2014 2:50 PM
  • Hi Mlssa11,

    To remove the registry edit Kelvin had you create in a previous step you will want to create another notepad document. This time you will need to save the following as a dump-remove.reg:

    Windows Registry Editor Version 5.00

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\localdumps\]

    After you save it, preferably to your desktop, simply double click on it to import it the same as you did the previous dump.reg document. This should remove the dump creation setting from within your registry. 

    Tuesday, January 07, 2014 6:37 PM
  • Thanks Jessica, so all the other dump.reg did was move the location where all dump files land? If so then I will keep it as is. 

    Thanks

    Tuesday, January 07, 2014 8:59 PM
  • It seems that way, Mlssa11. All the dump-remove.reg file I included above did was remove the registry modification Kelvin had you make. Kelvin's dump.reg script added a registry key and my dump-remove.reg script removed said registry key. Prior to making the above modification, dump files are stored in C:\Windows\Minidump.

    Hope this helps!

    Wednesday, January 08, 2014 7:12 PM