Windows

How to Create Live Kernel Dumps in Windows 11

Written by

Richard

Sep 16, 2022 Updated Apr 30, 2026 2 min read

How to Enable or Disable Cellular Use in Windows 11

You create a live kernel dump in Windows 11 to capture your system’s kernel memory state without rebooting.

A live kernel dump is a diagnostic snapshot of your PC’s kernel memory, freezing its activity at a specific moment.

This method is crucial for diagnosing elusive issues, like those causing bug check code 0x161, directly within Windows 11.

By generating this dump, you gather vital information to analyze system instability and pinpoint problems with components like your graphics driver.

⚡ Quick Answer

Create a live kernel dump by opening Task Manager, navigating to the Details tab, right-clicking an empty space, and selecting “Create live kernel dump file.” The dump file is saved in 📁C:\Windows\System32\LiveKernelReports.

How to Create a Live Kernel Dump

Creating a live kernel dump in Windows 11 is simple using Task Manager, letting you capture system data without freezing your PC.

Open Task Manager by pressing Ctrl+Shift+Esc on your keyboard.
Click on the Details tab.
windows 11 task manager details
Right-click on any empty space in the list of processes.
Select Create live kernel dump file.
Choose either Full live kernel dump or Kernel stacks dump.
windows 11 create live kernel dump file
A box will appear showing you where the file was saved.
Click OK to close the box.
Click Open file location to go to the folder where the dump file is saved in 📁C:\Windows\System32\LiveKernelReports.

Advanced Methods: Command-Line and Tools

Beyond Task Manager, you can use advanced debugging tools. The ProcDump utility from the Sysinternals suite is a powerful alternative. You can also use the Windows Error Reporting (WER) service to trigger these dumps manually. For deep analysis, professionals use WinDbg to inspect the memory dump file location.

Analysis and Debugging

Once you have the file, you need to analyze it. You can open the .dmp file in WinDbg. This allows you to run commands to see which driver or process caused the system to hang. Refer to the official Microsoft documentation for advanced debugging resources.

Summary

A live kernel dump in Windows 11 lets you grab important system information while your computer is still working, helping you fix problems without needing a full restart.

Where are live kernel dumps stored by default in 🪟 Windows 11?

By default, Windows 11 saves these diagnostic files in the 📁C:\Windows\System32\LiveKernelReports folder. You must have administrative rights to access this directory and view the generated memory dump files. Always check this specific path if you are looking for recent snapshots created by the system or manual triggers.