Produce a stop error on purpose and read it back from the logs

short · 40 min · Objective 3.1

Task

Trigger a stop error on the guest deliberately, then reconstruct what happened from the event log and the dump alone -- as though you had not been there. Reading the machine's own record is the skill, because in real life the machine has always already restarted.

Steps

  1. Enable the keyboard-initiated crash (the CrashOnCtrlScroll registry value, then right Ctrl + Scroll Lock twice) or use Sysinternals NotMyFault, a Microsoft download rather than part of Windows; then trigger a stop error, and photograph or note the screen. Record the stop code and any named module in lab/stop/screen.txt.
  2. After the restart, find the unexpected shutdown event in the system log and record its identifier and time in lab/stop/event.txt.
  3. Locate the dump file, record its path and size in lab/stop/dump.txt, and note what tool would read it.
  4. Disable a service that others depend on, restart, and record the cascade in lab/stop/cascade.csv with header event_time,source,message_summary,first_or_consequence -- marking which single entry is the cause.
  5. Run a clean boot, then re-enable in halves to identify one startup item, and record the sequence in lab/stop/cleanboot.csv with header round,enabled_set,fault_present,conclusion.

Verify

These checks run in a POSIX shell: Terminal on macOS or Linux, and on Windows Git Bash (it comes with Git for Windows) or WSL. A stock Windows PowerShell or Command Prompt has no awk or grep, so there the first line fails.

grep -Ec '0x[0-9A-Fa-f]+|[A-Z][A-Z_]{5,}' lab/stop/screen.txt    # a code or an UPPER_CASE name
grep -Ec '[0-9]' lab/stop/event.txt
grep -c . lab/stop/dump.txt
awk -F, 'NR>1 && NF>=4 {n++} END {print n" log entr(ies)"}' lab/stop/cascade.csv
awk -F, 'NR>1 && $4 ~ /first/ {n++} END {print n" entr(ies) marked as the cause"}' lab/stop/cascade.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" clean boot round(s)"}' lab/stop/cleanboot.csv

A stop code captured, the shutdown event found, at least four cascade entries with exactly one marked as the cause, and three or more clean boot rounds. If every cascade entry is marked first, the ordering was not examined.

Notes

Put the machine back to a normal startup afterwards. A guest left in clean-boot configuration has its security software, backup agent and sync client silently disabled, which is a fix that creates three problems.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.