How do you get Windows Error Reporting (WER) to save memory dumps for hangs?

Question

WER is creating memory dumps after an application hangs. When Windows shows the dialog box ApplicationName is not responding, if the user clicks Close the program, I can see .hdmp files being created in C:\ProgramData\Microsoft\Windows\WER\Temp. After it sends them to Microsoft, this folder is created: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_WindowsFormsApp5_823dc9208bf3a14f898f39469b7b6a0c6f17c7_3db8b24d_07a39f1b. However, this folder only has a .wer file with a summary.

Can Windows Error Reporting be configured to keep the memory dumps capturing the unresponsive application on the local disk?

I have already tried Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps, but it is only creating dumps for crashes, not hangs.

Tetrachord

use procdump -h to generate dumps for hangs: collaborationhelp.cisco.com/article/en-us/WBX85638 – Gyn

Answer 1

Create a REG_SZ value called CorporateWerServer in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\, and set it's value to empty string. Since Windows cannot contact the Corporate WER Server, the hang dumps will remain in C:\ProgramData\Microsoft\Windows\WER\ReportQueue\

Tetrachord

This is the only thing that worked reliably for me. – Done

Answer 2

You can use the ConfigureArchive setting of WER and set it to '2' [All data]. That will capture and archive all the data (instead of just Report.wer).

See ConfigureArchive at https://learn.microsoft.com/en-us/windows/desktop/wer/wer-settings.

From an elevated prompt, run:

Reg add "hklm\software\microsoft\windows\windows error reporting" /f /t REG_DWORD /v ConfigureArchive /d 2

Setting Corporate WER server would cause all the crash/hang reports to sit on your device and they will never reach Microsoft. That may not be the ideal solution.

Woodhead

Hi, I cannot remember if we tested ConfigureArchive, but I'll verify it works and change the accepted answer. Changing CorporateWerServer to empty string definitely was a hack - ConfigureArchive of 2 sounds much closer to what we were looking for. – Tetrachord

This didn't work for me even though I also set the value in HKCU. – Finality