Windows 停止错误 - #0x000000EF“关键进程已终止”Windows Stop Error - #0x000000EF "Critical Process Died"

本文提供用于解决在 Azure VM 中启动期间关键进程终止的问题的步骤。This article provides steps to resolve issues where a critical process dies during boot in an Azure VM.

症状Symptom

使用启动诊断查看 VM 的屏幕截图时,看到屏幕截图中显示了错误“#0x000000EF”和消息“关键进程已终止” 。When you use Boot diagnostics to view the screenshot of the VM, you will see that the screenshot displays the error #0x000000EF with the message Critical Process Died .

“你的电脑遇到问题,需要重启。

原因Cause

通常,此错误是在启动过程中关键的系统进程失败造成的。Usually, this is due to a critical system process failing during boot. 可以在“Bug 检查 0xEF:CRITICAL_PROCESS_DIED”中详细了解关键进程。You can read more about critical process issues at "Bug Check 0xEF: CRITICAL_PROCESS_DIED".

解决方案Solution

过程概述:Process Overview:

  1. 创建并访问修复 VM。Create and Access a Repair VM.
  2. 修复任何 OS 损坏情况。Fix any OS Corruption.
  3. 建议 :在重建 VM 之前,启用串行控制台和内存转储收集。Recommended : Before you rebuild the VM, enable serial console and memory dump collection.
  4. 重建 VM。Rebuild the VM.

备注

遇到此启动错误时,来宾 OS 不会正常运行。When encountering this boot error, the Guest OS is not operational. 需要在脱机模式下进行故障排除才能解决此问题。You will be troubleshooting in Offline mode to resolve this issue.

创建并访问修复 VMCreate and Access a Repair VM

  1. 使用 VM 修复命令的步骤 1-3 来准备一个修复 VM。Use steps 1-3 of the VM Repair Commands to prepare a Repair VM.
  2. 使用远程桌面连接来连接到修复 VM。Using Remote Desktop Connection connect to the Repair VM.

修复任何 OS 损坏情况Fix any OS Corruption

  1. 打开权限提升的命令提示符。Open an elevated command prompt.

  2. 运行以下系统文件检查程序 (SFC) 命令:Run the following System File Checker (SFC) command:

    sfc /scannow /offbootdir=<BOOT DISK DRIVE>:\ /offwindir=<BROKEN DISK DRIVE>:\windows

    • 其中,< BOOT DISK DRIVE > 是修复 VM 的启动卷(通常为“C:”),< BROKEN DISK DRIVE > 是已损坏 VM 中的附加磁盘的驱动器号。Where < BOOT DISK DRIVE > is the boot volume of the Repair VM (typically "C:") and < BROKEN DISK DRIVE > will be the drive letter for the attached disk from the broken VM. 请将大于号/小于号及其包含的文本(例如“< text here >”)替换为相应的驱动器号。Replace the greater than / less than symbols as well as the text contained within them, e.g. "< text here >", with the appropriate letter.
  3. 接下来,使用 VM 修复命令的步骤 5 重新装配 VM,并查看它是否可启动。Next, use step 5 of the VM Repair Commands to reassemble the VM and see if it boots.

  4. 如果 VM 仍然不能启动,请继续收集内存转储文件。If the VM is still not booting, then continue to collect the memory dump file.

收集内存转储文件Collect the Memory Dump File

如果在运行 SFC 后仍然出现问题,则需要分析内存转储文件以确定问题的原因。If the issue persists after running SFC, analysis of a memory dump file will be required to determine the cause of the issue. 若要收集内存转储文件,请执行以下步骤:To collect the memory dump file, follow these steps:

将 OS 磁盘附加到新的修复 VMAttach the OS disk to a new Repair VM

  1. 使用 VM 修复命令的步骤 1-3 来准备一个新的修复 VM。Use steps 1-3 of the VM Repair Commands to prepare a new Repair VM.
  2. 使用远程桌面连接来连接到修复 VM。Using Remote Desktop Connection connect to the Repair VM.

找到转储文件并提交支持票证Locate the dump file and submit a support ticket

  1. 在修复 VM 上,转到附加的 OS 磁盘中的 Windows 文件夹。On the repair VM, go to windows folder in the attached OS disk. 如果分配给附加 OS 磁盘的驱动器号为 F,则需转到 F:\Windows 。If the driver letter that is assigned to the attached OS disk is F , you need to go to F:\Windows .

  2. 找到 memory.dmp 文件,然后使用该内存转储文件提交支持票证Locate the memory.dmp file, and then submit a support ticket with the memory dump file.

    备注

    如果找不到转储文件,请完成以下步骤以启用内存转储收集和串行控制台,然后返回到本部分,并重复执行上述任务中的步骤来收集内存转储文件。If you cannot find the dump file, complete the below steps to enable memory dump collection and Serial Console, then return to this section and repeat the steps in the task above to collect the memory dump file.

若要启用内存转储收集和串行控制台,请运行以下脚本:To enable memory dump collection and Serial Console, run the following script:

  1. 打开提升的命令提示符会话(以管理员身份运行)。Open an elevated command prompt session (Run as administrator).

  2. 运行以下命令:Run the following commands:

    启用串行控制台Enable Serial Console

    bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /ems {<BOOT LOADER IDENTIFIER>} ON

    bcdedit /store <VOLUME LETTER WHERE THE BCD FOLDER IS>:\boot\bcd /emssettings EMSPORT:1 EMSBAUDRATE:115200

    替换所有大于号或小于号以及其中的文本,例如“< text here >”。Replace any greater than or less than symbols as well as the text within them, e.g. "< text here >".

  3. 验证 OS 磁盘上的可用空间是否与 VM 上的内存大小 (RAM) 相当。Verify that the free space on the OS disk is as much as the memory size (RAM) on the VM.

如果 OS 磁盘上没有足够的空间,则应更改内存转储文件的创建位置,将其指向任何已附加到 VM 且具有足够可用空间的数据磁盘。If there's not enough space on the OS disk, you should change the location where the memory dump file will be created and refer that to any data disk attached to the VM that has enough free space. 若要更改位置,请将以下命令中的“%SystemRoot%”替换为数据磁盘的驱动器号(例如“F:”)。To change the location, replace "%SystemRoot%" with the drive letter (for example, "F:") of the data disk in the below commands.

用于启用 OS 转储的建议配置Suggested configuration to enable OS Dump

加载损坏的 OS 磁盘Load Broken OS Disk :

REG LOAD HKLM\BROKENSYSTEM <VOLUME LETTER OF BROKEN OS DISK>:\windows\system32\config\SYSTEM

在 ControlSet001 上启用:Enable on ControlSet001:

REG ADD "HKLM\BROKENSYSTEM\ControlSet001\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 1 /f

REG ADD "HKLM\BROKENSYSTEM\ControlSet001\Control\CrashControl" /v DumpFile /t REG_EXPAND_SZ /d "%SystemRoot%\MEMORY.DMP" /f

REG ADD "HKLM\BROKENSYSTEM\ControlSet001\Control\CrashControl" /v NMICrashDump /t REG_DWORD /d 1 /f

在 ControlSet002 上启用:Enable on ControlSet002:

REG ADD "HKLM\BROKENSYSTEM\ControlSet002\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 1 /f

REG ADD "HKLM\BROKENSYSTEM\ControlSet002\Control\CrashControl" /v DumpFile /t REG_EXPAND_SZ /d "%SystemRoot%\MEMORY.DMP" /f

REG ADD "HKLM\BROKENSYSTEM\ControlSet002\Control\CrashControl" /v NMICrashDump /t REG_DWORD /d 1 /f

卸载损坏的 OS 磁盘:Unload Broken OS Disk:

REG UNLOAD HKLM\BROKENSYSTEM

重建原始 VMRebuild the Original VM

使用 VM 修复命令的步骤 5 重新装配 VM。Use step 5 of the VM Repair Commands to reassemble the VM.