How Windows Error Reporting Works

An end user experiencing a crash is shown a dialog box that asks whether to send an error report to Microsoft. If the user chooses to send the report, then Microsoft Windows Error Reporting (WER) collects information about the application and the module involved in the crash and sends the encrypted information to a secure server at Microsoft. In some cases, additional data is also collected in a .cab file and sent with the report.

When Microsoft receives the report, it is sorted according to its contents, and wherever possible the information is associated with a particular hardware vendor, software vendor, or system manufacturer.

The vendor that owns the component associated with the crash can use Windows Quality Online Services (Winqual) to access WER data for its products, analyze the data to locate the source of the problem, and then provide solutions both through the end-user error dialog boxes and by providing updated files on Windows Update.

How WER Collects and Classifies Error Reports
How WER collects kernel-mode and user-mode driver and application crash data.

Debugging OCA Minidump Files
How to analyze dump files, use symbols, and integrate WER into applications.

Providing Solutions to Reported Errors
How to use Windows Quality Online Services to provide updated drivers and other solutions.


Looking for help with your personal computer?Looking for help with your personal computer?