LocalDumps registry key stops working (Windows Error Report)

Question

I set the registry key, HKLM \ SOFTWARE \ Microsoft \ Windows \ Windows Error Reporting \ LocalDumps as described in MSDN .

I have a test program - a console program compiled with Visual C ++ that tries to dereference a NULL pointer before printing a message and exiting. The testing program used to exit and upload the main file, but now it just quits. I do not have a kernel.

I am using Windows Server 2008 R2 Enterprise, SP1 on physical hardware.

I do not know what has changed. What could have changed, which now prevents WER from dropping kernels?

Answer 1

Make sure you add the key to the LocalDumps node, for example, "LocalDumps \ MyApplication.exe". Then update the values ​​that are explained in this link. During a crash, WER searches for a key with the appropriate application name to decide how to handle the dump.

Answer 2

The following may go wrong:

Folder permissions to write to

Looking at the permissions of the folder C:\ProgramData\Microsoft\Windows\WER , it has

• Read and execute
• List Folder Contents
• Read

Creating a subfolder of LocalDumps inherits permissions.

Therefore, you must either change the permissions of this folder or use another folder with write permissions.

Registry Key Permissions

Windows may not be able to read the registry settings if permissions do not allow this. For instance. The following (really stupid) permissions will prevent the use of LocalDump:

32 vs 64 bit

Windows error reports are run by Windows and use only a registry key with a broken OS. You said you created both. If true, everything is in order. If you configured only a 32-bit registry key, this will not work.

Aedebug

If you have a setting for AeDebug HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug , they run before WER.

Please note that this entry may exist in 32-bit (WOW6432Node) and 64-bit.

Usually this should lead to the launch of the debugger, but who knows ... he can do nothing and just exit.

LocalDumps is disabled

Make sure there is no DWORD Disabled with a value of 1 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

Using REG_SZ instead of REG_EXPAND_SZ

I saw people using REG_SZ for DumpFolder in combination with %APPDATA% . Only REG_EXPAND_SZ will expand environment variables.