Maintaining Desktop Health : Understanding Windows Error Reporting (part 3) - Architecture of Windows Error Reporting, Configuring Windows Error Reporting

5. Architecture of Windows Error Reporting

This section discusses the main Windows Error Reporting components.

Wer.dll

Wer.dll contains the major parts of the WER infrastructure and is responsible for showing the user interface (dialogs), exposing the WER APIs, and report management.

Wermgr.exe

Wrmgr.exe is responsible for WER error queue management.

Problem Reports And Solutions Control Panel

The Problem Reports And Solutions control panel provides a user interface to access the following actions:

• View any solutions to your problems
  
  
• Configure Windows Error Reporting
  
  
• View problem history
  
  
• Check for new solutions (to sent or unsent reports)
  
  
• Clear solutions and problem history
  
  
• Learn more about WER Privacy
  
  
• Change your Customer Experience Improvement Program Settings
  
  

The Problems And Reports control panel is implemented entirely within the following binaries:

• Wercon.exe

• Wercplsupport.dll

Problem Reports And Solutions Control Panel Support Service

You use the Problem Reports And Solutions Control Panel Support service to manage error reports in the Problem Reports And Solutions control panel when needed for UAC support. This service is set to a Manual startup type and starts on demand when called by WER.

Windows Error Reporting Service

The Windows Error Reporting Service is responsible for obtaining the information that is provided to the back-end Watson servers when an application exception occurs. The service library, wersvc.dll, is hosted in its own svchost.exe process. When a process crashes, the Windows Error Reporting service calls werfault.exe (or werfaultsecure.exe, discussed later in this section) to obtain all of the necessary data for the crashing/hanging process. Werfault.exe loads dbgeng.dll and dbghelp.dll to collect the application error data. It also loads faultrep.dll to perform the reporting to the back-end Watson servers. If the Windows Error Reporting Service is not started when an application exception occurs, werfault.exe and the dependent libraries will still be started to perform the data collection and reporting tasks for the fault.

WER in Windows Vista also supports error reporting for secure processes. Secure processes are processes that contain data encrypted with a private key and restricted permission. If a crash occurs in a secure process, the Windows Error Reporting service uses werfaultsecure.exe to obtain the necessary data for the crashing/hanging process. The report is encrypted when created and queued automatically to prevent any possibility of exploitation through the user interface. The encrypted data is then sent to the back-end Watson servers, where it is decrypted and analyzed.

The following components have been removed because of the error-reporting redesign for Windows Vista and no longer install as part of the operating system:

• ErSvc.dll

• Drwtsn32.exe

• Dwwin.exe

• Dumprep.exe

Store.lock

To ensure that WER and the Problem Reports And Solutions control panel are synchronized, wercon.exe creates a store.lock file in each of the four report folders when the Problems Reports And Solutions control panel is open. WER will still function to obtain the error report data even though the stores (report folders) are locked, but it will not write the data to any of the stores. The collected report data remains in the user’s Temp folder when the stores are locked.

The store.lock file is deleted when the Problems Reports And Solutions control panel is closed; the report data is then written to the destination store folder. Because of this locking feature, errors that occur when the Problems Reports And Solutions control panel is open will not be immediately displayed but will be displayed when the Problems Reports And Solutions control panel is closed and then reopened.

6. Configuring Windows Error Reporting

You can configure Windows Error Reporting by selecting options in the Problem Reports And Solutions control panel, by directly editing the registry, or by using Group Policy settings. This section describes the registry keys used to store per-computer, per-user, and Group Policy settings.

Per-Machine Registry Settings

Per-machine settings are stored in the following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting
							

Per-User Registry Settings

Per-user settings are stored in the following registry key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting
							

Group Policy Registry Settings

Each WER registry setting has a corresponding Group Policy setting.

Per-Machine Group Policy Settings

The per-machine WER Group Policy settings are located in the following Group Policy container:

Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting

These settings are stored in the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting
								

					  

Per-User Group Policy Settings

The per-user WER Group Policy settings are located in the following Group Policy container:

User Configuration\Administrative Templates\Windows Components\Windows Error Reporting

These settings are stored in the following registry key:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Error Reporting
								

					  

WER Registry Values

WER uses the same registry value names for per-computer, per-user, and Group Policy settings described in the preceding section. Table 1 describes WER registry values.

The order of preference for applying the configured settings is:

If WER has been configured using Group Policy settings, the Problems And Reports user interface will appear dimmed and be unavailable.

Note