App Control: How to enable Local Dumps when parity.exe is crashing.

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to enable local dumps on Windows endpoints when parity.exe crashes. 

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Open regedit.exe
2. Open the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps
3. Create the registry key LocalDumps if it is not present already.
4. Create a new "expandable string value " (REG_EXPAND_SZ) and named it DumpFolder
5. Double click on the "DumpFolder " value and enter the following string for the "value data": %LOCALAPPDATA%\CrashDumps
6. Wait for the crash to happen and once then grab the parity .dmp files from the path %LOCALAPPDATA%\CrashDumps

Additional Information

If the parity .dmp files are missing in %LOCALAPPDATA%\CrashDumps,please look for them in the following path C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps