How do you get Windows Error Reporting (WER) to save memory dumps for hangs?

Question

WER is creating memory dumps after an application hangs. When Windows shows the dialog box ApplicationName is not responding, if the user clicks Close the program, I can see .hdmp files being created in C:\ProgramData\Microsoft\Windows\WER\Temp. After it sends them to Microsoft, this folder is created: C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppHang_WindowsFormsApp5_823dc9208bf3a14f898f39469b7b6a0c6f17c7_3db8b24d_07a39f1b. However, this folder only has a .wer file with a summary.

Can Windows Error Reporting be configured to keep the memory dumps capturing the unresponsive application on the local disk?

I have already tried Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps, but it is only creating dumps for crashes, not hangs.

Answer 1

You can use the ConfigureArchive setting of WER and set it to '2' [All data]. That will capture and archive all the data (instead of just Report.wer).

See ConfigureArchive at https://learn.microsoft.com/en-us/windows/desktop/wer/wer-settings.

From an elevated prompt, run:

Reg add "hklm\software\microsoft\windows\windows error reporting" /f /t REG_DWORD /v ConfigureArchive /d 2

Setting Corporate WER server would cause all the crash/hang reports to sit on your device and they will never reach Microsoft. That may not be the ideal solution.

Answer 2

Create a REG_SZ value called CorporateWerServer in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\, and set it's value to empty string. Since Windows cannot contact the Corporate WER Server, the hang dumps will remain in C:\ProgramData\Microsoft\Windows\WER\ReportQueue\