When to Use This Technique

There are several situations in which it is useful, or even necessary, to control user-mode debugging from the kernel debugger:

• When you need to perform user-mode debugging, but also need control over the Windows kernel that the user-mode target is running on or need to use some kernel-mode debugging features to analyze the problem.
• When your user-mode target is a Windows process such as CSRSS or WinLogon. For a detailed description of how to debug these targets, see Debugging CSRSS with NTSD and Debugging WinLogon with NTSD.
• When your user-mode target is a service application. For a detailed description of how to debug these targets, see Debugging a Service Application.