Last Object

Although in the case of system hangs we, usually, recommend dumping Stack Trace Collection (Volume 1, page 409), in some cases it is very time-consuming, especially when it involves thousands of processes such as in modern terminal services environments. In such a case, if the problem description indicates the last action such as a not progressing user logon or a recently launched process we first check the tail of the corresponding linked list where Last Object is usually added to the tail of the list:

Sometimes we can simply check the end of some enumerated collection, such as sessions (dotted lines represent ALPC Wait Chains, Volume 3, page 97):

This analysis pattern can be added to the first tier of RSDP (Volume 7, page 444). If nothing found around a couple of Last Objects we then resort to the analysis of entire linked lists.