LiveKernelReports C:\Windows\LiveKernelReports

C:\Windows\LiveKernelReports: "live kernel" dumps written without stopping Windows when a driver or kernel component times out (watchdog).

Updated on 12 November 2026 By AltF4 Formation

What it’s for

When a kernel component or a driver hits a recoverable problem (a timeout, a watchdog), Windows can capture a dump without stopping the system. These “live kernel” dumps land in LiveKernelReports. The default location is %systemroot%\LiveKernelReports, and the Windows Error Reporting LiveKernelReportsPath setting changes it.

What it contains

.dmp files, filed in subfolders named after the event type or component, such as WATCHDOG, NDIS or USBHUB3.
Files tied to Windows Error Reporting, which may upload them afterwards.
The folder can be empty or missing until an event occurs.

Risks and best practices

These dumps are diagnostic data. Deleting them changes nothing about how Windows runs, but it costs you the analysis of the matching incident. Delete the files, not the folder.
Do not mix them up with MEMORY.DMP and Minidump, which come from stop errors (blue screens). Here the machine kept running.
LiveKernelEvent entries in Reliability Monitor point to these files. A code such as 141 or 117 often means the graphics driver.

Useful commands

# Contents, newest first (as administrator)
Get-ChildItem "$env:windir\LiveKernelReports" -Recurse -Force -File -ErrorAction SilentlyContinue |
  Sort-Object LastWriteTime -Descending | Select-Object FullName, Length, LastWriteTime

# Configured location, if any (missing value = default location)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -ErrorAction SilentlyContinue |
  Select-Object LiveKernelReportsPath

# Delete the dumps (as administrator; remove -WhatIf to run)
Get-ChildItem "$env:windir\LiveKernelReports" -Filter *.dmp -Recurse -File | Remove-Item -WhatIf

Report a mistake