Windows Event ID 153 – Kernel-General: Memory Management Error

Start by examining the complete event pattern to understand the scope and timing of memory errors.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter for Event ID 153 by right-clicking the System log and selecting Filter Current Log
4. Set Event IDs to 153 and click OK
5. Examine the event details, noting timestamps, frequency, and any accompanying error codes
6. Use PowerShell to get detailed event information:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=153} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

7. Check for related events that occurred around the same time:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1001,1003,6008} -MaxEvents 20

8. Export the events for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=153} | Export-Csv -Path "C:\temp\Event153_Analysis.csv" -NoTypeInformation

Use Windows built-in memory diagnostic to test for hardware-level memory problems.

1. Open Command Prompt as Administrator
2. Run the memory diagnostic scheduler:

   mdsched.exe

3. Select Restart now and check for problems to run the test immediately
4. Allow the system to restart and complete the memory test (this takes 15-30 minutes)
5. After restart, check the test results in Event Viewer:

   Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-MemoryDiagnostics-Results'} -MaxEvents 5

6. For more comprehensive testing, use the extended test mode by pressing F1 during the diagnostic boot screen
7. If errors are found, run additional passes by restarting the diagnostic:

   bcdedit /set {memdiag} bootmenupolicy standard

8. Check system information for memory configuration:

   Get-WmiObject -Class Win32_PhysicalMemory | Select-Object Capacity, Speed, Manufacturer, PartNumber

Investigate potential driver issues and system file corruption that could cause memory management errors.

1. Run System File Checker to detect corrupted system files:

   sfc /scannow

2. Check the SFC log for details:

   Get-Content $env:windir\Logs\CBS\CBS.log | Select-String "\[SR\]" | Select-Object -Last 20

3. Run DISM to repair the Windows image:

   DISM /Online /Cleanup-Image /RestoreHealth

4. Use Driver Verifier to identify problematic drivers:

   verifier /standard /all

5. Monitor system behavior after enabling verifier, then disable it:

   verifier /reset

6. Check for recently installed or updated drivers:

   Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DriverDate -gt (Get-Date).AddDays(-30)} | Sort-Object DriverDate -Descending

7. Review installed updates that might correlate with the memory errors:

   Get-HotFix | Where-Object {$_.InstalledOn -gt (Get-Date).AddDays(-30)} | Sort-Object InstalledOn -Descending

8. Check driver signing and version information:

   Get-WindowsDriver -Online | Where-Object {$_.BootCritical -eq $true} | Select-Object Driver, Version, Date

Use advanced tools to monitor memory pools and identify memory leaks or allocation issues.

1. Enable pool tagging in the registry to track memory allocations:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" -Name "PoolUsageMaximum" -Value 60 -Type DWord

2. Restart the system for pool tagging to take effect
3. Use Performance Monitor to track memory metrics:

   perfmon /res

4. Monitor specific memory counters using PowerShell:

   Get-Counter "\Memory\Pool Nonpaged Bytes", "\Memory\Pool Paged Bytes", "\Memory\Available MBytes" -SampleInterval 5 -MaxSamples 60

5. Check for memory leaks in specific processes:

   Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 10 Name, WorkingSet, VirtualMemorySize

6. Use Windows Performance Toolkit (WPT) for detailed analysis:

   wpa.exe

7. Monitor kernel memory usage patterns:

   Get-Counter "\Process(_Total)\Pool Nonpaged Bytes", "\Process(_Total)\Pool Paged Bytes" -Continuous

8. Check memory commit charge and limits:

   Get-WmiObject -Class Win32_OperatingSystem | Select-Object TotalVirtualMemorySize, TotalVisibleMemorySize, FreeVirtualMemory

Perform comprehensive hardware testing and review system configuration for memory-related issues.

1. Test memory modules individually by removing all but one module and testing each separately
2. Check memory slot configuration and ensure proper seating:

   Get-WmiObject -Class Win32_PhysicalMemoryArray | Select-Object MaxCapacity, MemoryDevices

3. Verify memory timing and voltage settings in BIOS/UEFI
4. Monitor system temperatures during memory-intensive operations:

   Get-WmiObject -Namespace "root/OpenHardwareMonitor" -Class Sensor | Where-Object {$_.SensorType -eq "Temperature"}

5. Test with memory stress testing tools like MemTest86+ (boot from USB)
6. Check power supply stability using hardware monitoring tools
7. Review motherboard QVL (Qualified Vendor List) for memory compatibility
8. Examine system configuration for memory-related settings:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" | Format-List

9. Test system stability with reduced memory configuration
10. Document findings and correlate with Event ID 153 occurrences:

    Get-EventLog -LogName System -InstanceId 153 -After (Get-Date).AddDays(-7) | Export-Csv -Path "C:\temp\Memory_Error_Timeline.csv"