Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. ProgramData
  3. Microsoft
  4. Windows
  5. WER
FolderRisk: Safe

WER C:\ProgramData\Microsoft\Windows\WER

C:\ProgramData\Microsoft\Windows\WER: machine-wide error reports, queued (ReportQueue) or sent (ReportArchive), with their dumps.

Updated on By AltF4 Formation

What it’s for

When an application crashes, hangs or a component fails, Windows Error Reporting (WER) files the report here. ReportQueue holds reports waiting to be sent to Microsoft and ReportArchive holds those that have gone. It is the first place to look for the faulting module of an application crash, before you reach for a debugger.

Reports from applications that a user launched are written in that user’s profile, under %LOCALAPPDATA%\Microsoft\Windows\WER. This folder receives the machine-wide ones: services and system processes.

What it contains

  • ReportQueue: one folder per pending report (for example AppCrash_<application>_<hash>), with a Report.wer file and related files.
  • ReportArchive: reports already sent. Their data is deleted but the Report.wer file stays.
  • Temp: temporary collection files, present depending on the version.
  • Memory dumps attached to a report (.dmp, .hdmp), sometimes large.

Report.wer is a text file. Its Sig[n] lines give the application name (AppName), the faulting module and the exception code.

Risks and best practices

  • You can empty it with no consequence for Windows: you only lose the incident history and the attached dumps. Keep it while an analysis is in progress.
  • Empty the contents, not the folder. Disk Cleanup offers “Windows error reports and feedback diagnostics” to do it cleanly.
  • Dumps can hold sensitive data (a process’s memory), so review them before sending them to anyone.
  • To switch the feature off, use Group Policy or the Disabled value under HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting, and only with a good reason: these reports are a diagnostic asset.

Useful commands

Fenêtre de terminal
# Reports waiting to be sent and archived reports
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER\ReportQueue" -Force -ErrorAction SilentlyContinue | Select-Object Name, LastWriteTime
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER\ReportArchive" -Force -ErrorAction SilentlyContinue | Select-Object Name, LastWriteTime


# Read the essentials of a report: application, faulting module, exception code
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER" -Recurse -Filter Report.wer -ErrorAction SilentlyContinue |
  Select-Object -First 1 | Select-String -Pattern '^(AppName|Sig\[\d+\]\.(Name|Value))'


# Latest event 1001 entries in the Application log (source Windows Error Reporting)
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Windows Error Reporting'} -MaxEvents 10 |
  Select-Object TimeCreated, Message


# Purge the contents (as administrator; remove -WhatIf to run)
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER\ReportArchive", "$env:ProgramData\Microsoft\Windows\WER\ReportQueue" -Force |
  Remove-Item -Recurse -WhatIf

Folder contents

Folders 2

Report a mistake