An app hangs without a blue screen, so Windows writes nothing. LocalDumps and the Task Manager dump command both produce a file support can read, and both work without installing a debugger.
Enable **LocalDumps** under **HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting**, set **DumpType 2** for a full dump, reproduce the hang, then read the file. Task Manager can dump a process instantly.
**Task Manager** creates a dump of a live process on demand. For a hang that is still visible in the list, this is faster than configuring anything.
taskmgr
:: Details tab > right-click the process > Create dump file
:: file lands in %TEMP% as <name>.DMP
dir $env:TEMP\*.DMP**LocalDumps** makes Windows Error Reporting write a file every time the app crashes. The keys are machine-wide by default, and a subkey named after the executable narrows it to one app.
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpFolder /t REG_EXPAND_SZ /d C:\CrashDumps /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpType /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /v DumpCount /t REG_DWORD /d 5 /f
mkdir C:\CrashDumps**DumpFolder** must be REG_EXPAND_SZ, otherwise a path with an environment variable silently fails. Reading the key back shows the type as well as the value.
reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /sDumps appear only when the process fails on its own. Watch the folder while you work, and note the failure type the event log records beside it.
Start-Process notepad
:: force a crash of the sample app to test the configuration
Get-ChildItem C:\CrashDumps | Sort-Object LastWriteTime -Descending | Select-Object -First 3 Name,Length,LastWriteTime
Get-WinEvent -LogName Application -MaxEvents 20 | Where-Object ProviderName -eq 'Application Error' | Select-Object TimeCreated,MessageA dump is identified by its module list and the faulting thread. Without a debugger you can still read the header strings to see which module appears, which often names the culprit.
Select-String -Path C:\CrashDumps\*.dmp -Pattern 'clr.dll|ntdll|kernel32|d3d11' -Encoding Byte -ErrorAction SilentlyContinue
Get-ChildItem C:\CrashDumps | Select-Object Name,LengthLeft in place, the configuration fills the disk quietly. Remove the key after the investigation, or narrow it to the single application you are chasing.
reg delete "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" /f
reg query "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps"The crash is not handled by WER, or a policy disables it. Check Get-MpComputerStatus and the WER service status, and try the Task Manager dump while the app hangs.
Access denied or the process is protected. Run Task Manager as administrator, or use procdump from the Sysinternals suite with the -ma switch.
DumpType 1 is a minidump with limited data. Set it to 2 and reproduce again for a full memory dump.
DumpCount limits how many files are kept. Lower it to three and point DumpFolder at a drive with free space.
No. A blue screen is a kernel fault and writes to C:\Windows\Minidump. This guide captures a single user-mode application.
Yes, that is the point. Full dumps can contain personal data, so prefer a minidump unless support asks for memory.
Delete the LocalDumps key with reg delete, and remove the files under C:\CrashDumps. Dumps created by Task Manager stay in %TEMP% until you delete them.
Free · no account needed · tracks your progress