Configure WER User-Mode (Application) crash dumps PowerShell-style
Note: This blogpost is also posted on my personal blog – https://itmicah.wordpress.com.
When you’re a system administrator you’re likely to encounter a few application crashes during your career. In order to troubleshoot these crashes Windows Error Reporting (WER) comes in handy. It can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. You can than send the dumps to the software supplier or analyse it yourself using your tool of choice.
The configuration is done by setting a few registry keys (for more info: link). Because it’s a hassle to set these keys manually I’ve created PowerShell functions to configure user-mode dumps on either your local machine or a remote machine. It uses remote registry for this so it works even if PowerShell remoting is disabled in your environment.
These are the functions with some examples on how to use them:
Enable-WERUserModeDumps
Enables User-Mode (Application Crash) dumps using Windows Error Reporting on a local or remote computer. Requires to be run under an account with admin rights on the computer.
Example:
PS\> Enable-WERUserModeDumps -ComputerName PC001,PC002 -Process iexplore.exe -DumpFolder D:\Dumps -DumpType FullDump
Enables User-Mode dumps on PC001 and PC002 using default values: 10 full dump maximum in folder ‘D:\Dumps’ for application Internet Explorer (iexplorer.exe)
Disable-WERUserModeDumps
Disables User-Mode (Application Crash) dumps on a local or remote computer. Requires to be run under an account with admin rights on the computer.
Example:
PS\> Disable-WERUserModeDumps -ComputerName PC001,PC002
Disables User-Mode dumps on PC001 and PC002.
Example:
PS\> Get-ADComputer -Filter "Name -like 'PCTEST*'" | Select * | Enable-WERUserModeDumps
Retreives all computers with a name that starts with PCTEST from AD and enables User-Mode dumps on them (The command is first piped to the Select command because of issues with AD object types in the pipeline).
You can find the functions here.
Hope it helps!
Michaja van der Zouwen
Is an all-round IT engineer with special skills in Microsoft, Citrix, RES and VMware products. Loves a challenge in his work and has taught himself scripting. Initially batch scripts, and later PowerShell. This helps him to automate processes and procedures, and to develop his own management tools which can be used every day.
Core qualities
Team player, enthusiastic, eager to learn, sociable, positive
Hobbies
Football, playing music, watching movies and series
Job description
Senior Technical Specialist