Windows Error Reporting

Windows Error Reporting (WER) is a built‑in Windows feature that collects crash data, fault information, and problem signatures when applications or system components fail. It has existed since Windows Vista and continues to be part of Windows 10 and Windows 11 as Reliability Monitor

Windows Error Reporting (WER) helps identify why an application or system component crashed. It collects fault data, error codes, and problem signatures that can be used to diagnose issues.

Common Windows Error Reporting Codes

  • 0xc0000005 — Access violation
  • 0xc0000409 — Stack buffer overrun
  • 0xc0000008 — Invalid handle
  • 0xc000001d — Illegal instruction
  • 0xc0000094 — Integer division by zero
  • 0xc00000fd — Stack overflow
  • 0xc0000374 — Heap corruption
  • 0xe06d7363 — C++ exception

Fault Buckets

Fault buckets are numeric identifiers used by Windows Error Reporting to group similar crashes. They help determine whether multiple failures share the same cause.

  • Each crash is assigned a bucket ID.
  • Crashes with the same bucket ID share the same fault pattern.
  • Bucket IDs help identify widespread or repeating issues.

Problem Signatures

Problem signatures describe the details of a crash. They include the application name, module name, exception code, and other diagnostic information.

  • Application name (e.g., app.exe)
  • Faulting module (e.g., kernel32.dll)
  • Exception code (e.g., 0xc0000005)
  • Fault offset
  • Process path
  • Report ID

How to Interpret Crash Logs

  • Faulting application: The program that crashed.
  • Faulting module: The DLL or component that caused the crash.
  • Exception code: The type of error that occurred.
  • Fault offset: The memory location where the crash happened.
  • Bucket ID: Used to identify similar crashes.
  • Report ID: Unique identifier for the crash report.
  • Event ID: Helps locate related entries in Event Viewer.

Using Reliability Monitor

  • Open Reliability Monitor.
  • Look for red X icons indicating critical events.
  • Select an event to view details such as faulting application, error code, and crash path.
  • Use the timeline to see patterns in crashes or failures.

Using Event Viewer

  • Open Event Viewer and go to Windows Logs → Application.
  • Look for “Application Error” or “Windows Error Reporting” entries.
  • Open an entry to view faulting module, exception code, and process path.
  • Use the event ID and error code to identify the cause of the crash.

Using WER Report Files

  • Go to C:\ProgramData\Microsoft\Windows\WER\.
  • Open ReportArchive or ReportQueue folders.
  • Each folder contains crash reports with metadata and error details.
  • Use the report files to see fault buckets, problem signatures, and crash parameters.

Where Windows Error Reporting Stores Data

  • C:\ProgramData\Microsoft\Windows\WER\ReportArchive
  • C:\ProgramData\Microsoft\Windows\WER\ReportQueue
  • C:\ProgramData\Microsoft\Windows\WER\Temp

Windows Error Reporting Versions

  • Windows Vista — First version of WER
  • Windows 7 — Improved crash signatures and reporting
  • Windows 8 / 8.1 — Added automatic crash analysis
  • Windows 10 — Expanded WER and updated Reliability Monitor location
  • Windows 11 — Same WER system with improved logging

How to Access Windows Error Reporting in Each Version

Windows Vista

  • Control Panel → Problem Reports and Solutions
  • Event Viewer → Windows Logs → Application
  • C:\ProgramData\Microsoft\Windows\WER\

Windows 7

  • Control Panel → Action Center → View reliability history
  • Event Viewer → Windows Logs → Application
  • C:\ProgramData\Microsoft\Windows\WER\

Windows 8 / 8.1

  • Control Panel → Action Center → View reliability history
  • Event Viewer → Windows Logs → Application
  • C:\ProgramData\Microsoft\Windows\WER\

Windows 10

  • Control Panel → System and Security → Security and Maintenance → Reliability Monitor
  • Event Viewer → Windows Logs → Application
  • services.msc → Windows Error Reporting Service
  • C:\ProgramData\Microsoft\Windows\WER\

Windows 11

  • Control Panel → System and Security → Security and Maintenance → Reliability Monitor
  • Event Viewer → Windows Logs → Application
  • services.msc → Windows Error Reporting Service
  • C:\ProgramData\Microsoft\Windows\WER\
Scroll to Top