Carbon Black Cloud: How to Enable UMDH Logging (Windows)

[#1]

Environment

• Carbon Black Cloud Console: All Versions
• Microsoft Windows: All Supported Versions

Objective

How to Enable UMDH Logging (Windows)

Resolution

1. Open Regedit application.
2. Navigate to following Key path. 

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

3. Create Key under “Image File Execution Options” by right clicking and name the key “repmgr.exe” 
4. Click “repmgr.exe” to select the newly created Key.
5. Navigate the cursor to right pane. While in that pane, right click, and create new DWORD (32-Bit) Value key and rename the key to “GlobalFlag”. 
6. Double click on “GlobalFlag” to display following dialog change Base to Decimal and enter 4096 in text box of Value Data.

Related Content

Using UMDH to Find a User-Mode Memory Leak - Windows drivers