如何获取Windows错误报告（WER）以保存内存转储以供挂起？

Question

WER is creating memory dumps after an application hangs. When Windows shows the dialog box ApplicationName is not responding , if the user clicks Close the program , I can see .hdmp files being created in C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp . After it sends them to Microsoft, this folder is created: C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\AppHang_WindowsFormsApp5_823dc9208bf3a14f898f39469b7b6a0c6f17c7_3db8b24d_07a39f1b . However, this folder only has a .wer file with a summary.

Can Windows Error Reporting be configured to keep the memory dumps capturing the unresponsive application on the local disk?

I have already tried Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps , but it is only creating dumps for crashes, not hangs.

Answer 1

You can use the ConfigureArchive setting of WER and set it to '2' [All data]. That will capture and archive all the data (instead of just Report.wer).

See ConfigureArchive at https://docs.microsoft.com/en-us/windows/desktop/wer/wer-settings .

From an elevated prompt, run:

Reg add "hklm\software\microsoft\windows\windows error reporting" /f /t REG_DWORD /v ConfigureArchive /d 2

Setting Corporate WER server would cause all the crash/hang reports to sit on your device and they will never reach Microsoft. That may not be the ideal solution.

Answer 2

Create a REG_SZ value called CorporateWerServer in Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\ , and set it's value to empty string. Since Windows cannot contact the Corporate WER Server, the hang dumps will remain in C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\