Is it possible to export a snapshot of the process tree in ProcessExplorer? RRS feed

  • Question

  • I have a mysterious problem that has plagued my PC for several years and persisted through a couple of format/reinstalls. The problem is that when I Sleep the PC or shut it down but leave the power connected, the PC reboots. The amount of time before the reboot is usually a few seconds but can be some arbitrary time later. Even more frustratingly, it doesn't always do this and I can't work out any pattern.

    I suspect a driver or something is crashing and - though I can't find a setting to control this  - the PC is set to restart upon a crash.

    I was hoping Process Explorer could help. I was wanting to use a process of elimination, manually closing down processes before sleeping the PC and trying to identify which one is causing the problem. The trouble is that I have no way of keeping track of which ones I've eliminated.

    To be more efficient, I'd like to do this as a roughly binary process, closing half the processes and seeing if the problem persists, but to do this, I'd need to be able to print out something so I can use a good old fashioned highlighter pen.

    So is it possible to somehow dump out the tree from Process Explorer?

    Monday, October 19, 2020 10:48 AM

All replies

  • Both PSList and TaskList can print out a list of processes, but I think your approach is probably a littl ebit overkill..

    If you suspect a driver, I would start with Autoruns, listing only the third party drivers and disabling them one by one to see if the problem happens again. If this doesn't work I would capture a dump when/if a blue screen happens and would send it to microsoft for examination..

    If that result unconclusive yet then would probably start with your idea.. even if I would personally change PC at that point :-)


    Monday, October 19, 2020 1:46 PM
  • Thank you for the information.

    The problem is that the problem is extremely intermittent. If I try disabling drivers one-by-one, I'll spend the next several weeks working on a PC that has decreasing functionality. If I go too fast and decide a certain driver is at fault only to have the problem reappear a week later, I'll be back to square one.

    My approach does at least allow me to work on the PC normally each day. I just have to spend a few minutes closing it down and recording my results.

    I'm very interested in the idea of trying to get Microsoft to look at a memory dump. How do I get that? The way it normally works is that I sleep my PC and when I come back to it an hour later it will have restarted and gone to the login screen. I don't see a blue screen or get any kind of dialog telling me my PC did not shut down correctly.

    Re. getting a new PC, I can't afford to. I could change an individual component if I discovered what was causing the problem but I've done various hardware checks (e.g. a full RAM test) and so far have no idea what's at fault.

    - Patrick

    Wednesday, October 21, 2020 8:46 AM
  • Configure the machien in order to take a ful lmemory dump initiated manually by you  suing the keyboard:

    Forcing a System Crash from the Keyboard - Windows drivers | Microsoft Docs

    After you can successfully grab a dunp using the keyboard go in Control Panel advanced option and configure the machine to always take a full memory fump when a problem hapens..

    Enable memory dump setting

    You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure.

    To enable memory dump setting, follow these steps:

    1. In Control Panel, select System and Security > System.

    2. Select Advanced system settings, and then select the Advanced tab.

    3. In the Startup and Recovery area, select Settings.

    4. Make sure that Kernel memory dump or Complete memory dump is selected under Writing Debugging Information.

    5. Restart the computer.


    Wednesday, October 21, 2020 11:04 AM
  • I have got this working but I'm not sure how it helps. How do I open a *.DMP file?

    - Patrick

    Friday, November 6, 2020 3:39 PM