svnscha - Profile Picture
Windows: Crash Dump Locations
Posted on

Common locations where Windows stores application crash dump files.

User Account Crash Dumps

# e.g: C:\Users\{username}\AppData\Local\CrashDumps\
%LOCALAPPDATA%\CrashDumps\

System Account Crash Dumps

# Local System
C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\

Enabling Crash Dumps

Registry Configuration

Enable automatic crash dump creation for applications:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps]
"DumpFolder"="%LOCALAPPDATA%\\CrashDumps"
"DumpCount"=dword:00000010
"DumpType"=dword:00000002
"CustomDumpFlags"=dword:00000000

Per-Application Configuration

Configure crash dumps for a specific executable:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe]
"DumpFolder"="C:\\MyApp\\CrashDumps"
"DumpCount"=dword:00000005
"DumpType"=dword:00000001

Dump Type Values

  • 0: Custom dump
  • 1: Mini dump
  • 2: Full dump

PowerShell Script to Enable

# Enable crash dumps globally
New-Item -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Name "DumpFolder" -Value "%LOCALAPPDATA%\CrashDumps"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Name "DumpCount" -Value 10 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Name "DumpType" -Value 2 -Type DWord

System Memory Dumps (Blue Screen Dumps)

Default System Dump Location

# Default location for system memory dumps (BSOD)
C:\Windows\MEMORY.DMP
C:\Windows\Minidump\*.dmp

Enabling System Memory Dumps

Configure system crash dump settings via registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"CrashDumpEnabled"=dword:00000007
"DumpFile"="C:\\Windows\\MEMORY.DMP"
"MinidumpDir"="C:\\Windows\\Minidump"
"LogEvent"=dword:00000001
"SendAlert"=dword:00000001
"AutoReboot"=dword:00000001

System Dump Types

  • 0: None
  • 1: Complete memory dump
  • 2: Kernel memory dump
  • 3: Small memory dump (64 KB)
  • 7: Automatic memory dump

PowerShell Script for System Dumps

# Enable automatic system memory dumps
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "CrashDumpEnabled" -Value 7 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "DumpFile" -Value "C:\Windows\MEMORY.DMP"
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "MinidumpDir" -Value "C:\Windows\Minidump"
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "LogEvent" -Value 1 -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl" -Name "AutoReboot" -Value 1 -Type DWord

# Verify settings
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"

Via System Properties GUI

Alternative method using system properties:

  1. Right-click This PC → Properties
  2. Advanced system settings → Settings (under Startup and Recovery)
  3. Under System failure, configure:
    • Write debugging information: Automatic memory dump
    • Dump file: C:\Windows\MEMORY.DMP
    • ✓ Automatically restart

Referenced from Helge Klein's blog post on creating application crash dumps - consulted approximately a quadrillion times.