Getting Started with Windows App Crash Dump Collection: WER, ProcDump, and WinDbg

The short answer

The easiest way to think about crash dump collection is to layer it in this order:

1. Start with WER LocalDumps configured per app (no extra tooling required)
2. Add ProcDump when you need more (low-repro field investigations, hangs, first chance exceptions)
3. Reach for MiniDumpWriteDump only when you want full control of your own collection

What a crash dump tells you

• The exception code that brought the process down
• Which thread crashed
• The call stack at the moment of failure
• The modules that were loaded
• Heap state and the contents of objects (when included)

Do not try to solve everything from a dump alone. Combine it with logs and heartbeats.

Overview of collection methods

Configuring WER LocalDumps

Registry settings

The per-app subkey is the easiest to manage.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe

Example configuration

reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe" /v DumpFolder /t REG_EXPAND_SZ /d "C:\CrashDumps\MyApp" /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe" /v DumpCount /t REG_DWORD /d 10 /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe" /v DumpType /t REG_DWORD /d 2 /f

What to verify

1. .dmp files actually appear in the expected folder
2. The size matches what your operations can carry
3. WinDbg can open them
4. The Application log in Event Viewer shows the crash

Using ProcDump

Common options

Typical command lines

# Full dump on unhandled exception for a process that is already running
procdump -accepteula -ma -e 1234 C:\CrashDumps\MyApp

# Wait for the next launch and monitor it
procdump -accepteula -ma -e -w MyApp.exe C:\CrashDumps\MyApp

# Capture first chance exceptions as well
procdump -accepteula -ma -n 3 -e 1 MyApp.exe C:\CrashDumps\MyApp

# Capture a hang
procdump -accepteula -h MyApp.exe C:\CrashDumps\MyApp

Mini dump vs full dump

Rule of thumb: full dumps on dev and staging, mini or full on customer machines depending on operational constraints.

Analyzing the dump

Install WinDbg

winget install Microsoft.WinDbg

Open the dump

windbg -z C:\CrashDumps\MyApp\MyApp_YYMMDD_HHMMSS.dmp

Set up symbols

.symfix C:\Symbols\Microsoft
.sympath+ C:\Symbols\MyApp
.reload

Run the automatic analyzer

!analyze -v

From there, look at the exception code, the faulting module, whether your own code shows up on the stack, and whether any thread other than the faulting one is stuck on a suspicious wait.

Decisions to make up front

1. How you keep PDBs and binaries: archive the exact build of the EXE/DLL you shipped together with its matching PDB. Without those, dumps cannot be read.
2. Output location and retention: do not write to the system drive root. Use a dedicated folder and cap the count.
3. Who is allowed to look: full dumps may contain confidential data (connection strings, tokens, customer data).

Common pitfalls

• Dumps captured but no PDB on hand. Plan PDB archival alongside the collection setup.
• DumpFolder ACLs not checked. Confirm the process can actually write there before you wait for a crash.
• Full dumps written to the production system drive forever. A classic disk-space incident.
• Trying to catch hangs with WER alone. Hangs and first chance exceptions are ProcDump territory.
• Leaving -e 1 on permanently and getting buried in exceptions. Cap the count or run it for a short window.

Wrap-up

Crash dumps are a strong observation point for low-repro failures. The order to reach for them is WER, then ProcDump, then MiniDumpWriteDump. Archiving PDBs is just as important as the dumps themselves.

References

• Microsoft Learn: Collecting User-Mode Dumps - Win32 apps
• Microsoft Learn: ProcDump v11.1 - Sysinternals
• Microsoft Learn: MiniDumpWriteDump function (minidumpapiset.h) - Win32
• Microsoft Learn: User-mode dump files - Windows drivers
• Microsoft Learn: Analyzing a User-Mode Dump File - Windows drivers
• Microsoft Learn: Install Windows Debugger - Windows drivers
• Microsoft Learn: Symbol path for Windows debuggers - Windows drivers
• Microsoft Learn: !analyze (WinDbg) - Windows drivers
• Microsoft Learn: Troubleshoot processes by using Task Manager - Windows Server
• Microsoft Learn: Enabling Postmortem Debugging - Windows drivers