To collect the UMH logs:

1. Optional: For a Blue Screen of Death (BSoD) issue, you may need to log in using Safe Mode if the system BSoD happens before login.
   • If the user’s system is Windows 7 or an earlier version, use F8 in the system boot to enter System Safe Mode.
   • If the user’s system is Windows 8 or a later version, set the legacy boot mode before reproducing the BSoD.

   To log in using Safe Mode:

   1. Open a command line.
   2. Run the following prompt:

      bcdedit /set {default} bootmenupolicy legacy

      After the issue has been reproduced, roll back to standard boot mode.

   3. Run the following prompt:

      bcdedit /set {default} bootmenupolicy standard

2. Enable kernel dump.

   

   

   For more information, refer to the following article: Enabling a Kernel-Mode Dump File.

3. Set a restore point for %systemdrive% and impacted disk/partition.

   

   

   

    

   Always back up the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
4. Unload the OfficeScan agent, then update following registry keys to to reset UMH’s state before generating BSoD’s dump:
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\tmumh
   • "BootStatus"=dword:ffffffff
5. Reboot the computer to trigger the BSoD issue.
6. Reboot the system again to get the dump file from %SystemRoot%\MEMORY.DMP. You may need to log in using Safe Mode.
7. Get the UMH-related binary files:
   • <OSCE installation path>\CCSF\module\20019
   • %windir%\system32\tmumh
   • %windir%\syswow64\tmumh
   • %windir%\system32\drivers\tmumh.sys
8. Get the UMH-related registry keys:
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tmumh
   • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\GlobalFlag
   • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
   • HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows