{"id":809286,"date":"2026-05-18T06:54:56","date_gmt":"2026-05-18T06:54:56","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=809286"},"modified":"2026-05-18T06:54:56","modified_gmt":"2026-05-18T06:54:56","slug":"detectar-e-analisar-telas-azuis-da-morte-bsod-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/pt-br\/script-hub\/detectar-e-analisar-telas-azuis-da-morte-bsod-powershell\/","title":{"rendered":"Como detectar e analisar as telas azuis da morte (BSOD) com o PowerShell"},"content":{"rendered":"

A Tela Azul da Morte (BSOD)<\/a> \u00e9 um termo que causa arrepios em muitos usu\u00e1rios de computador. \u00c9 uma tela de erro de parada exibida em um sistema de computador Windows ap\u00f3s um erro fatal do sistema. Geralmente causadas por problemas de hardware ou driver, as BSODs tamb\u00e9m podem ser acionadas por erros de software, o que leva a uma interrup\u00e7\u00e3o abrupta das opera\u00e7\u00f5es do sistema. Entender e diagnosticar esses erros \u00e9 fundamental na \u00e1rea de TI, e este artigo se aprofunda em um script do PowerShell desenvolvido para detectar e registrar esses desligamentos inesperados.<\/p>\n

Hist\u00f3rico<\/h2>\n

O script utiliza a ferramenta BlueScreenView da Nirsoft<\/a>, um utilit\u00e1rio projetado especificamente para analisar arquivos minidump gerados durante uma BSOD. Para profissionais de TI e provedores de servi\u00e7os gerenciados (MSPs), a automa\u00e7\u00e3o do processo de detec\u00e7\u00e3o e an\u00e1lise desses arquivos minidump \u00e9 inestim\u00e1vel, oferecendo uma abordagem sistem\u00e1tica para a solu\u00e7\u00e3o de problemas.<\/p>\n

O roteiro<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Conditional script for detecting BSOD's. Uses BlueScreenView from Nirsoft.\r\n.DESCRIPTION\r\n    Conditional script for detecting BSOD's. Uses BlueScreenView from Nirsoft.\r\n    Will always show the number of Unexpected shutdowns if system is setup to log those events.\r\n        This doesn't always mean that there was a BSOD as this includes things like holding the power button or pressing the rest button.\r\n    When a mini dump is detected in C:WindowsMinidump then this will output the results and exit with an exit code of 1.\r\n    When none have been found then this will exit with an exit code of 0.\r\n    When it couldn't download or extract BlueScreenView then this will exit with an exit code of 2.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    This should be the default, but in case this was modified instructions below.\r\n    Minimal Setup:\r\n        Open System Properties.\r\n        Click on Settings under Startup and Recovery.\r\n        Make sure that \"Write an event to the system log\" is checked.\r\n        Under System failure change to \"Write debugging information\" to Automatic memory dump.\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\n    (c) 2023 NinjaOne\r\n    By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam ()\r\n\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Get unexpected shutdown events from System log\r\n    $UnexpectedShutdownEvents = Get-WinEvent -FilterHashtable @{LogName = 'System'; ID = 6008 }\r\n    if ($UnexpectedShutdownEvents) {\r\n        Write-Host \"Unexpected shutdowns found: $($UnexpectedShutdownEvents.Count)\"\r\n        Write-Host \"\"\r\n    }\r\n\r\n    # Check if any minidumps exist and exit if none are found\r\n    if (-not $(Get-ChildItem -Path \"C:WindowsMinidump\" -ErrorAction SilentlyContinue)) {\r\n        Write-Host \"No mini dumps found.\"\r\n        exit 0\r\n    }\r\n    \r\n    # Download Blue Screen View, run, and export results to a csv file\r\n    try {\r\n        Invoke-WebRequest -Uri $BlueScreenViewUrl -OutFile $ZipPath -ErrorAction Stop\r\n        Expand-Archive -Path $ZipPath -DestinationPath $ENV:Temp -Force -ErrorAction Stop\r\n        Start-Process -FilePath $ExePath -ArgumentList \"\/scomma \"\"$CsvPath\"\"\" -Wait -ErrorAction Stop\r\n    }\r\n    catch {\r\n        Write-Host \"Blue Screen View Command has Failed: $($_.Exception.Message)\"\r\n        # Clean Up\r\n        Remove-DownloadedFiles -Path $CsvPath, $ZipPath, $ExePath, \"$($ENV:Temp)BlueScreenView.chm\", \"$($ENV:Temp)readme.txt\"\r\n        exit 2\r\n    }\r\n\r\n    # Convert the CSV to an array of objects\r\n    $MiniDumps = Get-Content -Path $CsvPath |\r\n        ConvertFrom-Csv -Delimiter ',' -Header $Header |\r\n        Select-Object -Property @{\r\n            'n' = \"Timestamp\";\r\n            'e' = { [DateTime]::Parse($_.timestamp, [System.Globalization.CultureInfo]::CurrentCulture) }\r\n        }, Dumpfile, Reason, Errorcode, CausedByDriver\r\n\r\n    # Clean Up\r\n    Remove-DownloadedFiles -Path $CsvPath, $ZipPath, $ExePath, \"$($ENV:Temp)BlueScreenView.chm\", \"$($ENV:Temp)readme.txt\"\r\n\r\n    # Output the results\r\n    $MiniDumps | Out-String | Write-Host\r\n\r\n    if ($MiniDumps) {\r\n        exit 1\r\n    }\r\n    exit 0\r\n}\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n    function Remove-DownloadedFiles {\r\n        param([string[]]$Path)\r\n        process { Remove-Item -Path $Path -Force -ErrorAction SilentlyContinue }\r\n    }\r\n\r\n    # CSV Headers\r\n    $Header = @(\r\n        \"Dumpfile\"\r\n        \"Timestamp\"\r\n        \"Reason\"\r\n        \"Errorcode\"\r\n        \"Parameter1\"\r\n        \"Parameter2\"\r\n        \"Parameter3\"\r\n        \"Parameter4\"\r\n        \"CausedByDriver\"\r\n    )\r\n\r\n    # Build path variables\r\n    $CsvFileName = \"bluescreenview-export.csv\"\r\n    $BlueScreenViewZip = \"bluescreenview.zip\"\r\n    $BlueScreenViewExe = \"BlueScreenView.exe\"\r\n    $BlueScreenViewUrl = \"https:\/\/www.nirsoft.net\/utils\/$BlueScreenViewZip\"\r\n    $ZipPath = Join-Path -Path $ENV:Temp -ChildPath $BlueScreenViewZip\r\n    $ExePath = Join-Path -Path $ENV:Temp -ChildPath $BlueScreenViewExe\r\n    $CsvPath = Join-Path -Path $ENV:Temp -ChildPath $CsvFileName\r\n}\r\nend {}<\/pre>\n
 <\/p>\n\n\n
Detalhamento<\/strong><\/h2>\n
    \n
  1. Pr\u00e9-requisitos:<\/strong> O script requer a vers\u00e3o 5.1 do PowerShell e foi projetado para o Windows 10 e o Windows Server 2016.<\/li>\n
  2. Inicializa\u00e7\u00e3o:<\/strong> Ele come\u00e7a garantindo que tenha privil\u00e9gios de administrador, essenciais para acessar os logs do sistema e os arquivos de minidump.<\/li>\n
  3. Paralisa\u00e7\u00f5es inesperadas:<\/strong> Em seguida, o script verifica se h\u00e1 eventos inesperados de desligamento no registro do sistema.<\/li>\n
  4. Verifica\u00e7\u00e3o de minidump:<\/strong> Ele procura por arquivos de minidump no diret\u00f3rio designado.<\/li>\n
  5. Integra\u00e7\u00e3o com o BlueScreenView:<\/strong> Se forem detectados arquivos minidump, o script far\u00e1 o download e executar\u00e1 o BlueScreenView, exportando os resultados para um arquivo CSV.<\/li>\n
  6. An\u00e1lise de dados:<\/strong> Os dados CSV s\u00e3o convertidos em uma matriz de objetos para exibi\u00e7\u00e3o pelo usu\u00e1rio.<\/li>\n
  7. Limpeza:<\/strong> Ap\u00f3s a an\u00e1lise, todos os arquivos baixados ou extra\u00eddos s\u00e3o removidos.<\/li>\n<\/ol>\n
    Casos de uso em potencial<\/h2>\n
    Considere um profissional de TI, Alex, que foi alertado sobre BSODs recorrentes no departamento de design de uma empresa. Em vez de examinar manualmente cada sistema, Alex implementa esse script. Em instantes, ele identifica um driver espec\u00edfico que est\u00e1 causando as BSODs, permitindo uma solu\u00e7\u00e3o direcionada. Esse script, portanto, torna-se uma ferramenta poderosa em seu arsenal de solu\u00e7\u00e3o de problemas.<\/p>\n
    Compara\u00e7\u00f5es<\/h2>\n
    Embora o Windows Event Viewer ofere\u00e7a insights, ele n\u00e3o possui a an\u00e1lise detalhada de minidump que o BlueScreenView fornece. Esse script preenche essa lacuna com efici\u00eancia, oferecendo uma abordagem mais abrangente do que os m\u00e9todos manuais.<\/p>\n
    Implica\u00e7\u00f5es de seguran\u00e7a<\/h2>\n
    As BSODs n\u00e3o s\u00e3o apenas um inc\u00f4modo; elas podem ser um problema de seguran\u00e7a. Uma BSOD recorrente pode ser um sinal de que uma entidade mal-intencionada est\u00e1 tentando comprometer o sistema. Ao registrar e analisar esses eventos, os profissionais de TI podem identificar poss\u00edveis amea\u00e7as e garantir a seguran\u00e7a do sistema.<\/p>\n
    Recomenda\u00e7\u00f5es<\/h2>\n
      \n
    • Sempre execute o script com privil\u00e9gios de administrador para garantir a funcionalidade total.<\/li>\n
    • Atualize regularmente a ferramenta BlueScreenView para aproveitar seus recursos mais recentes e garantir a compatibilidade.<\/li>\n
    • Monitore os sistemas quanto a BSODs recorrentes, pois eles podem indicar problemas de seguran\u00e7a mais profundos.<\/li>\n<\/ul>\n
      Considera\u00e7\u00f5es finais<\/h2>\n
      No mundo din\u00e2mico da TI, ferramentas como o NinjaOne, quando combinadas com scripts como o discutido, capacitam os profissionais a manter a integridade e a seguran\u00e7a do sistema. A detec\u00e7\u00e3o e a an\u00e1lise de logs de BSOD e desligamentos inesperados tornam-se um processo simplificado, garantindo opera\u00e7\u00f5es eficientes e seguras.<\/p>\n","protected":false},"author":35,"featured_media":142441,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[12457],"class_list":["post-809286","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/script_hub\/809286","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/comments?post=809286"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/media\/142441"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/media?parent=809286"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/operating_system?post=809286"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/pt-br\/wp-json\/wp\/v2\/use_cases?post=809286"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}