Collecting User-Mode Dumps: WER

Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes.

This feature is not enabled by default. Enabling the feature requires administrator privileges. To enable and configure the feature


1. Launch Regedit

2. Navigate into HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting

3. Create a new Key called LocalDumps (check if already there)

4. Select LocalDumps and create three new entries:

A. DumpFolder of type REG_EXPAND_SZ give it a path value of an existing folder where you want the crash dump files to appear when an event occurs.

B. DumpCount of type REG_DWORD give it a value of decimal 10

C. DumpType of type REG_DWORD give it a value of decimal 2




No reboot is required to activate these keys.


When the ccavona.exe/ccavona64.exe crashes again, a .dmp file will be created at the specified location above.