Win2008 R2 WER (error report) LocalDumps blocked by what?

Question

I just want to restore crash dumps of my own 32-bit applications.

I tried the following:

• I followed the steps on MSDN's “Collecting User-Mode Dumps”: http://msdn.microsoft.com/en-us/library/windows/desktop/bb787181%28v=vs.85%29.aspx

• Somewhere on the Internet, I saw mention of WER registry keys for 32-bit applications should not be added to HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps\

• In addition, the value ..\Windows NT\AeDebug\Auto (REG_SZ) must be "0"

In addition, I have WER error records in the "system event viewer" in "Windows Logs\Applications&Services\Microsoft\Windows\WER-Diagnostics\Operational" Displaying Messages "Possible Heap Detection (code 3221225477)"

I don't know if this post is related to my test application creating NPE, or if it has a WER problem?

I just can't get it to work :( Can someone give me some clues?

---

Update: For another new 2008R2 x64 machine, I just did

 HKLM\Software\... Reporting\LocalDumps\DumpFolder = "c:\crashdumps" HKLM\Software\... Reporting\LocalDumps\DumpType = 2 (REG_DWORD) HKLM\Software\... Reporting\LocalDumps\DumpCount = 20 decimal (REG_DWORD) 

And the launch of nulpointer-terster worked as expected.

So, I think that these other machines should have settings that prohibit the use of LocalDumps, although there are LocalDumps registry keys.

Answer 1

• Create Key: HKLM \ Software \ Microsoft \ Windows \ Windows Error Reporting \ LocalDumps
• Create a REG_DWORD value: HKLM \ Software \ Microsoft \ Windows \ Windows Error Reporting \ LocalDumps as 2 (= full dump).
• Create a REG_EXPAND_SZ value: HKLM \ Software \ Microsoft \ Windows \ Windows Error Reporting \ LocalDumps like C: \ Dumps or wherever you like. Make sure this folder really exists.

Answer 2

I think you have already checked most of the common problems. There are 3 more:

Folder permissions to write to

Looking at the permissions of the folder C:\ProgramData\Microsoft\Windows\WER , it has

• Read and execute
• List Folder Contents
• Read

Creating a subfolder of LocalDumps inherits permissions.

Therefore, you must either change the permissions of this folder or use another folder with write permissions.

Registry Key Permissions

Windows may not be able to read the registry settings if permissions do not allow this. For example. The following (really stupid) permissions will prevent the use of LocalDump:

LocalDumps is disabled

Make sure there is no DWORD Disabled with a value of 1 in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps