Boot the machine in 'safe mode with networking'.
browse thru hklm\system\currentcontrolset\services\swin\parameters. Set the vaue of 'rtemodeonreboot' as 0
uncheck the 'Automatic restart' option under the 'startup and recovery' window of 'My Computer' and configure the machine for 'complete memory dump'
reboot the machine
enable solidcore protection with 'samdin enable' command
This time machine should stop on a blue screen
boot into safe mode . Set the vaue of 'rtemodeonreboot' as 0 and reboot.
Collect the memory.dmp file and run gahterinfo .bat.
Open a SR and provide dump file and gatherinfo logs for analysis.