Saturday 1 September 2018

Where does Windows 8 store user-mode crash minidumps?


Where does Windows 8 store minidumps from user-mode crashes?




Windows Vista and Windows 7 is documented to (by default) store a crash dump in:


%LOCALAPPDATA%\CrashDumps

A fact supported by observational evidence:


enter image description here


But, when an application crashes on Windows 8:


enter image description here


There are no crash dumps in %LOCALAPPDATA%\CrashDumps; there isn't even a CrashDumps folder:


enter image description here


Which leads to the question:



Where does Windows 8 store minidumps from user-mode crashes?



Note: You can ignore everything after the first line; it's just wasted filler.




enter image description here



Answer



I observed the following with Windows 8.1 Professional:


Windows Error Reporting writes to: %ProgramData%\Microsoft\Windows\WER\


However, per default, it no longer permanently stores the dumps on the local computer.  You need to explicitly enable the storing of the dumps.


Use the Group Policy Editor (gpedit.msc): Computer Configuration -> Administrative Templates -> Windows Components -> Windows Error Reporting -> Advanced Error Reporting Settings




  1. Enable the policy Configure Report Archive:



    • Archive behaviour = Store all

    • Max number = 100




  2. You may also want to enable the policy Do not throttle additional data to send and store dumps for consecutive crashes with similar signature.




The dumps are inside the file Report.cab of the crash specific subfolder.


No comments:

Post a Comment

Where does Skype save my contact's avatars in Linux?

I'm using Skype on Linux. Where can I find images cached by skype of my contact's avatars? Answer I wanted to get those Skype avat...