LocalDumps registry key stopped working (Windows Error Reporting)

Question

I set up the registry key, HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps as described on MSDN.

I have a test program - a console program, compiled with Visual C++, that tries to dereference a NULL pointer before printing a message and exiting. The test program used to exit and dump a core file, but now it just exits. I get no core.

I'm running Windows Server 2008 R2 Enterprise, SP1 on physical hardware.

I don't know what changed. What could have changed that prevents WER from dumping cores now?

Answer 1

Make sure you've added a key on the LocalDumps node like "LocalDumps\MyApplication.exe". Then, update the values that are explained in that link. At the time of a crash, WER looks for a key with the matching application name to decide how to handle the dump.

Answer 2

The following may go wrong:

Permissions of the folder to write to

Looking at the permissions of the folder C:\ProgramData\Microsoft\Windows\WER it has

• Read & execute
• List folder contents
• Read

Creating a subfolder LocalDumps will inherit the permissions.

So you should either modify the permissions of that folder or use a different folder with write permissions.

Permissions of the Registry key

Windows might not be able to read the Registry settings if the permissions do not allow it. E.g. the following (really silly) permissions will prevent a LocalDump as well:

32 vs. 64 bit

Windows Error Reporting is executed by Windows and only uses the registry key with the bitness of the OS. You said you set up both. If that's true, it`s fine. If you only set up the 32 bit Registry key, it won't work.

AeDebug

If you have a setting for AeDebug HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug, those are executed before WER.

Note that this entry may exist in 32 bit (WOW6432Node) and 64 bit.

Usually that should result in starting a debugger, but who knows ... it might do nothing and just exit.

LocalDumps is disabled

Make sure that there is no DWORD Disabled with a value of 1 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

Use of REG_SZ instead of REG_EXPAND_SZ

I have seen people using a REG_SZ for DumpFolder in combination with %APPDATA%. Only REG_EXPAND_SZ will expand environment variables.