I am trying to analyse MEMORY.DMP using windbg/cdb/kd debugging tools with in a Powershell script that runs only with system account. I have provided symbol file path and "!sym noisy" prompt is on.
- Symbol file path:
"SRV*c:\symbols*http://msdl.microsoft.com/download/symbols"
I was able to download and load symbols in windbg/cdb/kd when ran as Administrator.
SYMSRV: File: ntkrnlmp.exe
SYMSRV: Get File Path: download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe
SYMSRV: Notifies the client application that a proxy has been detected.
SYMSRV: Connecting to the Server: http://msdl.microsoft.com/download/symbols.
SYMSRV: Waiting for the server to respond to a request.
SYMSRV: Successfully received a response from the server.
SYMSRV: Successfully received a copied
copied
DBGHELP: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe - OK
but I not able download and load symbols in windbg/cdb/kd when ran as "NT Authority/System" on the same machine.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
SYMSRV: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe not found
SYMSRV: c:\symbols\ntkrnlmp.exe\5C8C79C8708000\ntkrnlmp.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntkrnlmp.exe/5C8C79C8708000/ntkrnlmp.exe not found
SYMSRV: c:\symbols\ntoskrnl.exe\5C8C79C8708000\ntoskrnl.exe not found
SYMSRV: c:\symbols\ntoskrnl.exe\5C8C79C8708000\ntoskrnl.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/5C8C79C8708000/ntoskrnl.exe not found
SYMSRV: http://msdl.microsoft.com/download/symbols/ntoskrnl.exe/5C8C79C8708000/ntoskrnl.exe not found
why debugging tools not loading symbols with system account? if it is not possible is there any other work around?
