All Products: Configure Windows Error Reporting to Save Crashes of RepMgr in set location

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Capture crash Dumps using Windows Error Reporting to a specified location when generated

Environment

• Microsoft Windows: All Supported Versions

Resolution

1. Open regedit.exe
2. Open key

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps

3. Edit DumpFolder (REG_EXPAND_SZ) to target directory

Additional Information

You can further refine what is captured by creating a folder off DumpFolder named the specific Application desired.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RepMgr.exe

Setting a key named DumpFolder in this path will allow you to specify custom locations for the Dumps. For example,

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\RepMgr.exe

DumpFolder (REG_EXPAND_SZ) %LOCALAPPDATA%\CrashDumps

This would save Crash Dumps of RepMgr directly to the Local App Data folder directory named CrashDumps. 

ProcDump provides additional options as well for this.