The Windows Concept Journey — WER (Windows Error Reporting)

The goal of WER (“Windows Error Reporting”) is to provide users with the ability to notify Microsoft in case of such as kernel faults/unresponsive applications/application faults. Microsoft can use the reports sent for providing customers with troubleshooting information and/or solutions. Users can enable WER manually or it can be enabled by an administrator using group policy (https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting).

Moreover, WER supports five different operation modes. Headless reporting which allows collecting reports which out interfering the users (this option can only be used with corporate reporting). Corporate reporting allows sending all data to a file share instead of uploading it to Microsoft (it can’t be used with internet reporting mode). Internet reporting mode sends all data to Microsoft. Shared memory reporting is in case the application security context is the same as the logged on user, thus the error reporting stem can use a block of shared memory for communication. In case the security context is different a file is used for communication in a manifest reporting mode (https://learn.microsoft.com/en-us/windows/win32/wer/using-wer).

Lastly, information regarding the WER error codes, functions, settings, data structures and enums can be found as part of the Microsoft documentation (https://learn.microsoft.com/en-us/windows/win32/wer/wer-reference). By the way, applications can save their state/data before exiting due to an unhandled exception or when the application stops responding. There is also an option of restarting the application (https://learn.microsoft.com/en-us/windows/win32/recovery/application-recovery-and-restart-portal). We can view the reports sent to Microsoft from the “Control Panel” (https://medium.com/@boutnaru/the-windows-concept-journey-control-panel-34bf84ca7ff0) in the following location “System and Security\Security and Maintenance\Problem Reports” — as shown in the screenshot below.

See you in my next writeup ;-) You can follow me on twitter — @boutnaru (https://twitter.com/boutnaru). Also, you can read my other writeups on medium — https://medium.com/@boutnaru. You can find my free eBooks at https://TheLearningJourneyEbooks.com.