Win2008 R2 WER ( error reporting ) LocalDumps blocked by what?

Question

I Just want to recover crash dumps of my own 32bit applications.

I tried the following:

• I followed the steps at MSDN "Collecting User-Mode Dumps": http://msdn.microsoft.com/en-us/library/windows/desktop/bb787181%28v=vs.85%29.aspx

• Somewhere on the internet I saw a mention about WER registry keys for 32 bit apps do NOT have to be added under HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting\LocalDumps\

• Also that the ..\Windows NT\AeDebug\Auto (REG_SZ) value must be "0"

Additionally, I have WER error entries in the 'system event viewer' under "Windows Logs\Applications&Services\Microsoft\Windows\WER-Diagnostics\Operational" Showing messages "Possible heap corruption detected (code 3221225477)"

I don't know if this message relates to my test-app creating a NPE, or if this is WER itself having a problem?

I just can't get it to work :( Can anyone give me some clues ?

---

Update : For another fresh 2008R2 x64 machine, i just did the

HKLM\Software\... Reporting\LocalDumps\DumpFolder = "c:\crashdumps"
HKLM\Software\... Reporting\LocalDumps\DumpType = 2   (REG_DWORD)
HKLM\Software\... Reporting\LocalDumps\DumpCount = 20 decimal (REG_DWORD)

And running the nulpointer-terster worked as expected.

So im thinking there must be a settings in these other machines which prohibit LocalDumps from being used, although the LocalDumps registry-keys are there..

Answer 1

1. Create key: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps
2. Create REG_DWORD value: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps as 2 (=full dump).
3. Create REG_EXPAND_SZ value: HKLM\Software\Microsoft\Windows\Windows Error Reporting\LocalDumps as C:\Dumps or where you like. Ensure that this folder actually exists.