On one of my debugging workstations I couldn’t analyze kernel and complete memory dumps from Windows 2003 Server R02. I was always getting this message:

*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe –

An attempt to reload and overwrite PDB files using .reload /o /f command didn’t resolve the issue but the following WinDbg command helped:

1: kd> !sym noisy
noisy mode – symbol prompts on

Reloading symbol files showed that default symbol path contained corrupt ntkrnlmp.pdb:

1: kd> .reload
DBGHELP: C:\Program Files\Debugging Tools for Windows\sym\ntkrnlmp.pdb\A91CA63E49A840F4A50509F90ADE10D52\ntkrnlmp.pdb – E_PDB_CORRUPT
DBGHELP: ntkrnlmp.pdb – file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe –
DBGHELP: nt – export symbol

Deleting it and reloading symbols again showed problems with the file downloaded from MS symbol server too:

1: kd> .reload
SYMSRV: c:\mss\ntkrnlmp.pdb\A91CA63E49A840F4A50509F90ADE10D52\ntkrnlmp.pd_
The file or directory is corrupted and unreadable.
DBGHELP: ntkrnlmp.pdb – file not found
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntkrnlmp.exe –
DBGHELP: nt – export symbols

Removing the folder and reloading symbols resolved the problem:

1: kd> .reload
DBGHELP: nt – public symbols
c:\mss\ntkrnlmp.pdb\A91CA63E49A840F4A50509F90ADE10D52\ntkrnlmp.pdb

Now it was time to switch noisy mode off:

1: kd> !sym quiet
quiet mode – symbol prompts on