Windows

How to Create Live Kernel Dumps in Windows 11

Written by

Richard

Sep 16, 2022 Updated Jul 14, 2026 2 min read

How to Enable or Disable Cellular Use in Windows 11

Live kernel dumps in Windows 11 capture your system’s kernel memory without needing to restart your PC.

This diagnostic snapshot freezes your computer’s core activity at a precise moment, letting you grab information about problems that happen while Windows is running.

Creating a live kernel dump is especially helpful for tricky issues, like the bug check code 0x161, which can cause your PC to crash. By generating this dump, you collect key details that help figure out why your system is unstable.

This information can pinpoint issues with specific parts of your computer, such as your graphics driver, and make it easier to solve the problem.

⚡ Quick Answer

Create a live kernel dump by opening Task Manager, navigating to the Details tab, right-clicking an empty space, and selecting “Create live kernel dump file.” The dump file is saved in 📁C:\Windows\System32\LiveKernelReports.

How to Create a Live Kernel Dump

Creating a live kernel dump in Windows 11 is simple using Task Manager, and it helps you capture vital system details without your computer stopping. This process lets you get a snapshot of what’s happening inside your PC when problems occur, making it easier to figure out what went wrong.

Open Task Manager by pressing Ctrl+Shift+Esc on your keyboard.
Click on the Details tab.
windows 11 task manager details
Right-click on any empty space in the list of processes.
Select Create live kernel dump file.
Choose either Full live kernel dump or Kernel stacks dump.
windows 11 create live kernel dump file
A box will appear showing you where the file was saved.
Click OK to close the box.
Click Open file location to go to the folder where the dump file is saved in 📁C:\Windows\System32\LiveKernelReports.

Advanced Methods: Command-Line and Tools

Beyond Task Manager, you can use advanced debugging tools. The ProcDump utility from the Sysinternals suite is a powerful alternative. You can also use the Windows Error Reporting (WER) service to trigger these dumps manually. For deep analysis, professionals use WinDbg to inspect the memory dump file location.

Analysis and Debugging

Once you have the file, you need to analyze it. You can open the .dmp file in WinDbg. This allows you to run commands to see which driver or process caused the system to hang. Refer to the official Microsoft documentation for advanced debugging resources.

Summary

A live kernel dump in Windows 11 lets you grab important system information while your computer is still working, helping you fix problems without needing a full restart.

Where are live kernel dumps stored by default in 🪟 Windows 11?

By default, Windows 11 saves these diagnostic files in the 📁C:\Windows\System32\LiveKernelReports folder. You must have administrative rights to access this directory and view the generated memory dump files. Always check this specific path if you are looking for recent snapshots created by the system or manual triggers.