How do I prevent Windows Error Reporting from deleting my live kernel dump file?

I have a system (Windows 10, version 20H2, OS Build 19042.1052) that locks up regularly for a few minutes. It doesn't crash/blue screen, but a live kernel dump is logged in the Application event log:

Windows Error Reporting event id 1001:

Fault bucket , type 0
Event Name: LiveKernelEvent
Response: Not available
Cab Id: 0
Problem signature:
P1: 1a1
P2: ffffe08a2d98c540
P3: 0
P4: 0
P5: 0
P6: 10_0_19042
P7: 0_0
P8: 256_1
P9:
P10:
Attached files:
\\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog\PoW32kWatchdog-20210615-0615.dmp
\\?\C:\WINDOWS\TEMP\WER-417554453-0.sysdata.xml
\\?\C:\WINDOWS\LiveKernelReports\PoW32kWatchdog-20210615-0615.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76C9.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76DA.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER76E8.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7709.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31
Analysis symbol:
Rechecking for solution: 0
Report Id: 23199732-b72b-44e5-b26f-f179c6892d31
Report Status: 4
Hashed bucket:
Cab Guid: 0

I would like to view the PoW32kWatchdog-20210615-0615.dmp file in WinDbg.exe so I can see the stack trace of the faulting thread. However, the .dmp file is nowhere to be found:

C:\WINDOWS\LiveKernelReports\ -> the file is no longer there, presumably because Windows Error Reporting attached it to its report C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 -> does no longer exist, presumably because the report has been sent to Microsoft before I am able to access it C:\ProgramData\Microsoft\Windows\WER\ReportArchive\Kernel_1a1_b56071bcde394c864256bb672ce88048e33283f_00000000_cab_23199732-b72b-44e5-b26f-f179c6892d31 -> I find a report.wer file here, but it is an name-value-pair file of a few kb, not the .dmp file I'm looking for.

How do I prevent Windows Error Reporting from deleting the .dmp file? Or is there another way to make a copy / backup of the .dmp file before it is deleted by Windows Error Reporting?

1 Reset to default

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

You Might Also Like