How To Guides Org

Where does Windows store WER (Error Reporting Dumps) Files And Change The Path

Aside from DMP (dump) and MDMP (mini-dump) files there are *.wer files that contain valuable information about why a certain app crashed


C:\ProgramData\Microsoft\Windows\WER\

1. Step Open the Windows explorer

2. Step Copy and paste this into the address bar C:\ProgramData\Microsoft\Windows\WER\

3. Step There will be two folders ReportArchive and ReportQueue

4. Step Open ReportArchive

5. Step If you recently crashed a few programs you will find a bunch of folders like AppCrash_DynUpSvc.exe
or AppHang_Everything.exe

Alright now we know where WER files are stored – let’s take a quick look at it

Here is the beginning of a AppHang WER dump of the program Everything.exe

Version=1
EventType=AppHangB1
EventTime=130157773680293929
ReportType=3
Consent=1
UploadTime=130157773697098912
ReportIdentifier=76907ef1-d5c1-11e2-bea1-485b3936d32b
IntegratorReportIdentifier=76907ef2-d5c1-11e2-bea1-485b3936d32b
WOW64=1
NsAppName=Everything.exe
Response.BucketId=14d330a5151758884db32ed616190d90
Response.BucketTable=5
Response.LegacyBucketId=-614153629
Response.type=4

Scroll down a little and you will find all LoadedModules (DLL’s) which is pretty handy if you ask me to check for certain conflicts. Also the exact ReportDescription and EventName will be listed

Handy for debugging purposes. Cheers, hope it helps

Change the Storage Path

1. Step Open the registry editor

2. Step Uncollapse HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\DumpFolder

3. Step Double-click StoreLocation

4. Step Enter a new valid Windows path

5. Step Done!