Configure Windows Error Reporting Dump Registry Key

This article explains how to locate and configure the Windows Registry key responsible for managing Windows Error Reporting (WER) user-mode memory dump generation. It covers the specific registry path, the primary value entries used to control dump types and storage locations, and how to configure custom crash dump behaviors for individual applications.

The WER LocalDumps Registry Key

The primary registry key that manages the behavior of user-mode memory dump generation in Windows is:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

By default, the LocalDumps subkey may not exist. When created, it instructs the Windows Error Reporting service to save local crash dumps (minidumps or full dumps) whenever an application crashes.

Key Configuration Values

Inside the LocalDumps key, several DWORD and String values determine how memory dumps are captured:

• DumpFolder (REG_EXPAND_SZ or REG_SZ): Specifies the directory path where crash dump files will be saved. The default path is %LOCALAPPDATA%\CrashDumps.
• DumpCount (REG_DWORD): Defines the maximum number of dump files to retain in the dump folder. When the limit is reached, the oldest dump file is overwritten. The default value is 10.
• DumpType (REG_DWORD): Specifies the type of dump generated:
  • 0: Custom dump.
  • 1: Mini dump (captures basic thread and stack information).
  • 2: Full dump (captures entire process memory).
• CustomDumpFlags (REG_DWORD): Sets custom dump options when DumpType is set to 0.

Configuring Application-Specific Dumps

To collect dumps for a specific process rather than globally, you can create a subkey under LocalDumps matching the executable name.

Example: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\MyApp.exe

Values placed inside the MyApp.exe key will override global settings for that specific application.

Kernel Dumps vs. User-Mode Dumps

Note that the LocalDumps key only manages user-mode application crashes. For system-level blue screen (BSOD) kernel memory dumps, Windows manages settings through a separate key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl