Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
A local dump can preserve diagnostic state for an intermittently crashing server application without continuously running an interactive debugger.
Prerequisites
- The exact executable name is known.
- Sufficient protected disk space is available.
- The software vendor has approved dump collection and secure transfer.
Configuration procedure
- Create a restricted dump directory.
- Configure LocalDumps for the specific executable under Windows Error Reporting.
- Choose a dump type appropriate for the investigation and set a small retention count.
- Reproduce or wait for the crash.
- Securely copy the dump to the authorized analysis location and remove collection settings after evidence is captured.
PowerShell commands
New-Item -Path "C:\CrashDumps" -ItemType Directory -Force
$k="HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\App.exe"
New-Item -Path $k -Force
New-ItemProperty -Path $k -Name DumpFolder -Value "C:\CrashDumps" -PropertyType ExpandString -Force
New-ItemProperty -Path $k -Name DumpCount -Value 3 -PropertyType DWord -Force
New-ItemProperty -Path $k -Name DumpType -Value 2 -PropertyType DWord -Force
Verification
After a controlled crash, a time-stamped DMP file appears in the restricted folder and the Application event log identifies the same executable and time.
Rollback
Remove the executable-specific LocalDumps registry key and delete diagnostic files after the approved retention period.
Security and operations
- Full dumps may contain credentials, personal data, encryption material, and customer content.
- Limit folder access to the incident team.
- Never upload a dump to a public file-sharing service.
Related resources
Build your Canadian Windows VPS environment with networkmanager.info. Consult the Microsoft Windows Server documentation before production deployment.
