windowscrash-dumpswindows-error-reporting

LocalDumps registry key stopped working (Windows Error Reporting)

I set up the registry key, HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps as described on MSDN.

I have a test program - a console program, compiled with Visual C++, that tries to dereference a NULL pointer before printing a message and exiting. The test program used to exit and dump a core file, but now it just exits. I get no core.

I'm running Windows Server 2008 R2 Enterprise, SP1 on physical hardware.

I don't know what changed. What could have changed that prevents WER from dumping cores now?

Solution

  • The following may go wrong:

    Permissions of the folder to write to

    Looking at the permissions of the folder C:\ProgramData\Microsoft\Windows\WER it has

    Creating a subfolder LocalDumps will inherit the permissions.

    So you should either modify the permissions of that folder or use a different folder with write permissions.

    Permissions of the Registry key

    Windows might not be able to read the Registry settings if the permissions do not allow it. E.g. the following (really silly) permissions will prevent a LocalDump as well:

    LocalDumps permissions

    32 vs. 64 bit

    Windows Error Reporting is executed by Windows and only uses the registry key with the bitness of the OS. You said you set up both. If that's true, it`s fine. If you only set up the 32 bit Registry key, it won't work.

    AeDebug

    If you have a setting for AeDebug HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug, those are executed before WER.

    Note that this entry may exist in 32 bit (WOW6432Node) and 64 bit.

    Usually that should result in starting a debugger, but who knows ... it might do nothing and just exit.

    LocalDumps is disabled

    Make sure that there is no DWORD Disabled with a value of 1 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

    Use of REG_SZ instead of REG_EXPAND_SZ

    I have seen people using a REG_SZ for DumpFolder in combination with %APPDATA%. Only REG_EXPAND_SZ will expand environment variables.