Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Users
  3. <utilisateur>
  4. AppData
  5. Local
  6. Microsoft
  7. Windows
  8. WER
FolderRisk: Safe

WER C:\Users\<utilisateur>\AppData\Local\Microsoft\Windows\WER

Per-user WER folder: incident reports (ReportArchive, ReportQueue) from applications run under the user's account, next to the machine-wide WER folder.

Updated on By AltF4 Formation

What it’s for

This is the user’s own Windows Error Reporting queue. When an application started under that account crashes, the report is left here, whereas reports for the system and services go to the machine-wide C:\ProgramData\Microsoft\Windows\WER (see that page for file details).

What it contains

The same subfolders as the machine-wide folder: ReportQueue for reports waiting to be sent, ReportArchive for those already handled, sometimes Temp. Each report is a folder with a Report.wer, a readable text file, and sometimes a minidump. A profile with no recent incident has an empty folder here, or none at all.

Risks and best practices

  • You can delete everything. Neither Windows nor the applications depend on it; you only lose that account’s incident history.
  • Minidumps hold fragments of application memory. Review them before handing them to a third party.
  • When a user leaves, or on a shared workstation, decide under your policy whether these reports travel with the profile or get purged.
  • Enablement, sending and retention are set by Group Policy (Windows Components > Windows Error Reporting) or in the registry.

Useful commands

Fenêtre de terminal
# Current account's reports, newest first
Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Windows\WER" -Recurse -Filter Report.wer -Force -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending | Select-Object FullName, LastWriteTime


# Matching events in the Application log (ID 1001)
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Windows Error Reporting'; Id=1001} -MaxEvents 10 |
    Select-Object TimeCreated, Message

Report a mistake