1

I have an x64-platform application running on Windows 8.1, x64...it crashes from time to time (its a multibyte, COM+ object hosted in a Windows service). I wanted to get the OS to write mini-dump files whenever an exception happens, so I set the following keys up in my registry:

enter image description here

Yet when a crash does occur, I see nothing in %LOCALAPPDATA%\CrashDumps. Why is this happening? Is it because the service is running under the Local System account?

Alexandru
  • 12,264
  • 17
  • 113
  • 208

1 Answers1

5

As it turns out, the dumps were being created. They were being created in C:\Windows\System32\%LOCALAPPDATA%\CrashDumps. This is because %LOCALAPPDATA% maps contextually under the context of a user account. If you use the Local System account for a service, this doesn't translate to anything...so it just appends to the default path of Local System which is C:\Windows\System32. Kind of a funny way to handle this case, M$...

Alexandru
  • 12,264
  • 17
  • 113
  • 208
  • Any idea what created that key? It's not there on all systems I checked, so I wonder if it's created by some software rather than shipping as a default. – Factor Mystic Jun 10 '14 at 14:34
  • Maybe some application is creating it for its own debugging purposes. Use process of elimination...delete the key and then see if running certain apps re-generate it. – Alexandru Jun 10 '14 at 14:36
  • I'm not sure which Windows version you've been using, but on a modern Windows `C:\Windows\System32\%LOCALAPPDATA%\CrashDumps` is a bad path, because `%LOCALAPPDATA%` on its own expands to something like `C:\Users\XYZ\AppData\Local` for ordinary users, to `%WINDIR%\ServiceProfiles` for Network and Local Services, and to `C:\Windows\System32\config\systemprofile\AppData\Local` (64-bit) or `C:\Windows\SysWOW64\config\systemprofile\AppData\Local` (32-bit) for Local System. – AntonK Jan 20 '22 at 13:31