Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

All Products: Configure Windows Error Reporting to Save Crashes of RepMgr in set location

All Products: Configure Windows Error Reporting to Save Crashes of RepMgr in set location

Environment

  • Microsoft Windows: All Supported Versions

Objective

Capture crash Dumps using Windows Error Reporting to a specified location when generated

Resolution

  1. Open regedit.exe
  2. Open key
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps
  3. Edit DumpFolder (REG_EXPAND_SZ) to target directory

Additional Notes

You can further refine what is captured by creating a folder off DumpFolder named the specific Application desired.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RepMgr.exe

Setting a key named DumpFolder in this path will allow you to specify custom locations for the Dumps. For example,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RepMgr.exe

DumpFolder (REG_EXPAND_SZ) %LOCALAPPDATA%\CrashDumps
This would save Crash Dumps of RepMgr directly to the Local App Data folder directory named CrashDumps. 

ProcDump provides additional options as well for this. 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-15-2021
Views:
619
Contributors