Windows Error Reporting and the Problem Reports and Solutions Feature in Windows Vista

In This Section

Benefits and Purposes of Windows Error Reporting and the Problem Reports and Solutions Feature

Overview: Using Windows Error Reporting and the Problem Reports and Solutions Feature in a Managed Environment

How Windows Error Reporting Communicates with a Site on the Internet

Controlling Error Reporting to Prevent the Flow of Information to and from the Internet

Procedures for Configuring Error Reporting

Note

The Problem Reports and Solutions feature is an interface that displays information from Windows Error Reporting and communicates with the Internet only through Windows Error Reporting.

Benefits and Purposes of Windows Error Reporting and the Problem Reports and Solutions Feature

In Windows Vista, Windows Error Reporting and the Problem Reports and Solutions feature work together to make it easy to find solutions to computer problems online:

  • Windows Error Reporting: Windows Error Reporting in Windows Vista is a feature that allows Microsoft to track and address errors relating to the operating system, Windows features, and applications. Windows Error Reporting gives users the opportunity to send data about errors to Microsoft and to receive information about solutions. Solution information can include instructions for working around a problem, or a link to the Windows Update Web site or another Web site for updated drivers, patches, or Microsoft Knowledge Base articles. Microsoft developers can use Windows Error Reporting as a problem-solving tool to address customer problems in a timely manner and to improve the quality of Microsoft products.

  • Problem Reports and Solutions: The Problem Reports and Solutions feature in Control Panel helps users track problem reports and any solution information they have received from Microsoft. Problem Reports and Solutions only helps the user store information. All Internet communication related to problem reports and solutions is handled by Windows Error Reporting, although the display of solution information in Problem Reports and Solutions uses a Web browser control.

In Windows Vista, Windows Error Reporting has multiple "consent levels" to help you (or a user with administrative credentials) control how Windows Error Reporting prompts before sending data:

  • Ask each time a problem occurs: Windows Error Reporting always prompts for consent before sending an error report.

  • Automatically check for solutions (also known as "Send parameters"): Windows Error Reporting sends the minimum data required to check for an existing solution, for example, the application name and version, module name and version, and exception code. After sending this data, Windows Error Reporting prompts for consent before sending any additional data requested by Microsoft.

  • Automatically check for solutions and send additional information, if needed (also known as "Send parameters and safe additional data"): Windows Error Reporting sends the minimum data required to check for an existing solution as well as data that the developer of the program has designated as being highly unlikely to contain personally identifiable information. Windows Error Reporting then prompts for consent before sending any additional data requested by Microsoft.

  • Send all data (Group Policy setting only): This setting can only be configured through Group Policy, not through the Control Panel interface. Any data requested by Microsoft will be sent, without prompts.

Options for Controlling Error Reporting on a Computer Running Windows Vista

If a prompt appears for a user who is logged on as an administrator, the user can choose to report application and operating system errors. If a prompt appears for a user who is not logged on as an administrator, the user can choose to report application errors plus errors for operating system software that does not require administrative credentials to run.

Error reporting can be controlled through Control Panel\System and Maintenance\Problem Reports and Solutions\Change settings\Advanced settings. An administrator, or a user with administrative credentials, can modify the settings to:

  • Enable or disable Windows Error Reporting, for all users or a specific user.

  • Set the consent level (described earlier) for Windows Error Reporting, for all users or a specific user.

  • Specify programs for which error reports should never be sent.

Overview: Using Windows Error Reporting and the Problem Reports and Solutions Feature in a Managed Environment

In a managed environment, you can choose to disable Windows Error Reporting or control it in several ways:

  • You can use Group Policy or an answer file for unattended installation to control the consent level (described earlier) to determine the amount of prompting that the user sees before information about a software problem is sent to Microsoft. For example, you can set the consent level so the user is always prompted before information is sent.

  • You can use Group Policy to disable Windows Error Reporting.

  • You can use Group Policy to redirect error reports to a server on your intranet by using the Group Policy setting, Corporate Windows Error Reporting. If you do this, you will also need to purchase software and software services for analyzing the errors that you capture on your servers. Based on your policies and the data in the error reports, you can filter the reports before they are sent to Microsoft. Such software is also useful for determining the types of problems users are experiencing most often. For more information about Microsoft software designed for use with the Group Policy setting, Configure Corporate Windows Error Reporting, see the following Microsoft Web sites:

For more information about the answer-file entries or Group Policy settings described in this subsection, see "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet," later in this section.

How Windows Error Reporting Communicates with a Site on the Internet

The data that Microsoft collects through Windows Error Reporting is used strictly for the purpose of tracking and solving problems that users are experiencing. This subsection describes various aspects of the data that is sent to and from the Internet during error reporting, and how the exchange of information takes place. The next subsection provides additional details.

  • Specific information sent or received (see details in later subsections): In most cases, the information collected for an error report only includes software "parameters," which includes such information as the application name and version, module name and version, and exception code. In unusual cases, a more complete crash report might be collected, and rarely, some information that uniquely identifies the user might unintentionally be collected as part of this. This information, if present, is not used to identify a user.

    Microsoft may send solution information back to the user about a problem, including links to Web sites.

Note

For more details about the information sent or received, see later subsections.

  • Default settings: By default, error reporting is enabled on clients running Windows Vista.

    Note that when Windows Vista is installed and the computer is started for the first time, prompts appear to help the user configure settings for various recommended features. If Use recommended settings is selected at this time, the consent level of Windows Error Reporting is Automatically check for solutions. If any other selection is made, the consent level is Ask each time a problem occurs. For details about consent levels, see "Consent Levels in Windows Error Reporting," earlier in this section.

  • Triggers: The opportunity to send an error report is triggered by application or system errors.

  • User notification: User notification depends on the consent level. See "Consent Levels in Windows Error Reporting," earlier in this section.

    Note that Windows Vista also provides reminders (balloon notifications) to the user to check for solutions to reports that have not been sent, for example, reports that were generated in the background or while the user was offline.

  • Logging: Descriptions of system and application errors are recorded in the event log. In addition, the Problem Reports and Solutions feature records information about problem reports sent and solution information received on that computer, so that solutions can be looked up later (although new solutions might eventually overwrite old solutions if the number of stored solutions exceeds the allowed maximum).

  • Encryption: All report data that could include personally identifiable information is encrypted (HTTPS) during transmission. The software "parameters" information, which includes such information as the application name and version, module name and version, and exception code, is not encrypted.

  • Access: Microsoft employees and contingent staff may access the error reports to maintain Windows Error Reporting or improve Microsoft products. They may not use the reports for other purposes.

    If the error report indicates that one or more non-Microsoft products were involved in causing the problem, Microsoft may send the report to the respective companies. Qualified software or hardware developers (employed by Microsoft or one of its partners) will analyze the fault data and try to identify and correct the problem.

  • Privacy: The privacy statement for Microsoft Error Reporting is located at the following Web site:

    https://go.microsoft.com/fwlink/?LinkId=70677

    Details related to privacy of data are presented in "Types of Data Collected," later in this section.

  • Transmission protocol and port: The transmission protocols are HTTP through port 80 and HTTPS through port 443.

  • Ability to disable: The feature can be disabled through Group Policy or on an individual computer running Windows Vista. You can also control the feature in other ways, as described in "Overview: Using Windows Error Reporting and the Problem Reports and Solutions Feature in a Managed Environment," earlier in this section, and "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet," later in this section.

Types of Data Collected

This section provides an overview of the data that Windows Error Reporting collects and information about data that might be collected from four different sources:

  • Application errors

  • Handwriting recognition errors

  • Errors from the Japanese Input Method Editor

  • Windows Kernel failures

Overview of the Data that Windows Error Reporting Collects

Windows Error Reporting collects information about the computer configuration, what the software was doing when the problem occurred, and other information directly related to the problem. Windows Error Reporting does not intentionally collect anyone’s name, address, e-mail address, or computer name. It is possible that such information may be captured in memory or in the data collected from open files, but Microsoft does not use it to identify users. Windows Error Reporting collects Internet Protocol (IP) addresses, but the addresses are not used to identify users, and in many cases, they are the address of a Network Address Translation (NAT) computer or proxy server, not a specific client behind that NAT computer or proxy server. IP address information is used in aggregate by the operators who maintain the servers that receive error reports. The other use for IP address information is to locate error reports that come from computers inside Microsoft—errors on those computers can be more thoroughly investigated as needed.

In rare cases, such as problems that are especially difficult to solve, Microsoft may request additional data, including sections of memory (which may include memory shared by any or all applications running at the time the problem occurred), some registry settings, and one or more files from the user’s computer. When additional data is requested, the user can review the data and choose whether to send the information.

Data Collected from Application Errors

Any application can be written in a way that uses the Error Reporting functionality. If an application error occurs for which Error Reporting is available and the user chooses to send the report, the information included is as follows:

  • The Digital Product ID, which can be used to identify your license.

  • Information regarding the condition of the computer and the application at the time the error occurred. This includes data stored in memory and stacks, information about files in the application's directory, as well as the operating system version and the computer hardware in use. This information is packaged into a minidump (a small memory dump). The minidump contains:

    • Exception information: This is information regarding the problem that occurred. It tells Microsoft what kind of instruction the application received that caused it to generate an error.

    • System information: This is data about the kind of CPU (processor) you have and what operating system you are running.

    • A list of all the modules that are currently loaded and their version information.

    • A list of all the threads that are currently running. For each thread, the current context and the whole stack are collected.

    • Global data.

    The minidump data is shown as a hexadecimal representation that the user cannot read.

Note

For information about the minidump format, see the following article on the MSDN Web site:

[https://go.microsoft.com/fwlink/?LinkId=73072](https://go.microsoft.com/fwlink/?linkid=73072)  
  

Data Collected from Handwriting Recognition Errors

If a user uses the Tablet PC Input Panel and encounters a handwriting recognition error, the user can start the error reporting tool for these errors and then select corrected handwriting samples to send in an error report. Such handwriting samples are not considered part of "safe additional data" and are handled according to the consent level setting, which in most cases will mean they are sent only when the user explicitly consents. If the user chooses to send this type of error report, the report can contain recently corrected handwriting samples. The user can choose which samples to send. No personal information is intentionally collected; however, the samples that are chosen may include personal information. This information will not be used to personally identify the user.

You can disable the reporting of handwriting recognition errors by using a specific Group Policy, as described in "Setting for Disabling the Reporting of Handwriting Recognition Errors," later in this section.

Data Collected from the Japanese Input Method Editor

With the Japanese version of Windows Vista, the user can generate a "word registration report" through the Japanese Input Method Editor (IME) and then choose to send the report to Microsoft. The reports are like error reports, but they record a word or word pair to improve the selection of the ideograms displayed. Each time such a report is generated, the user is asked whether to send the report to Microsoft. The user can view the information contained in the report before choosing to send it.

If you configure Windows Error Reporting as described in "Procedures for Configuring Error Reporting," later in this section, you control word registration reports in the same way that you control error reports. For more information about word registration reports, see the description of Input Method Editor in the Windows Vista privacy statement at:

https://go.microsoft.com/fwlink/?LinkId=70682

Data Collected from Windows Kernel Failures

When a kernel-mode (system) error occurs, Windows Vista displays a Stop message and writes diagnostic information to a memory dump file. When a user restarts the computer by using normal mode or Microsoft Windows Safe Mode (with networking) and logs on to Windows Vista as an administrator, Windows Error Reporting responds. Just as with other errors, Windows Error Reporting uses the consent level setting to determine when to prompt before sending a kernel fault report.

Windows kernel fault reports contain information about what the operating system was doing when the problem occurred. These event reports contain the minimum information that can help identify why the operating system stopped unexpectedly. If the user chooses to send the report, it includes the:

  • Operating system name (for example, Windows Vista).

  • Operating system version (a series of numerals starting with 6.0).

  • Operating system language as represented by the locale identifier (LCID)—(for example, the standard international numeric abbreviation, 1033, for United States English).

  • Loaded and recently unloaded drivers. These identify the modules used by the kernel when the Stop error occurred and the modules that were used recently.

  • List of drivers in the Drivers folder on the hard disk (systemroot\System32\Drivers).

  • File size, date created, version, manufacturer, and full product name for each driver.

  • Number of available processors.

  • Amount of random access memory (RAM).

  • Time stamp that indicates when the Stop error occurred.

  • Messages and parameters that describe the Stop error.

  • Processor context for the process that stopped. This includes the processor, hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts (requests from software or devices for processor attention).

  • Process information and kernel context for the halted process. This includes the offset (location) of the directory table and the database that maintains the information about every physical page (block of memory) in the operating system.

  • Process information and kernel context for the thread that stopped. This information identifies registers (data-storage blocks of memory in the processor) and interrupt-request levels, and it includes pointers to data structures for operating system data.

  • Kernel-mode call stack for the interrupted thread. This is a data structure that consists of a series of memory locations and one or more pointers.

Controlling Error Reporting to Prevent the Flow of Information to and from the Internet

To control the flow of information to and from the Internet when users report errors, you can configure error reporting with Group Policy or by using an answer file with unattended installation. The following subsections provide more details.

Using an Answer File with Unattended Installation

You can control the consent level for Windows Error Reporting by using an answer file with unattended installation. To configure a consent level of Always ask before sending data, confirm that your answer file includes the following line:

<DefaultConsent>1</DefaultConsent>

For more information, see "To Control the Consent Level for Error Reporting by Using an Answer File for Unattended Installation," later in this section.

Selected Group Policy Settings for Windows Error Reporting

This section provides information about a small set of the Group Policy settings available for Windows Error Reporting. For information about viewing these and other Group Policy settings, see "To Locate Group Policy Settings for Configuring Error Reporting," later in this section.

Setting for Corporate Windows Error Reporting

This setting is located at Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting\Advanced Error Reporting Settings.

Important

When you look at Group Policy settings for Windows Error Reporting on Windows Vista, on the Extended tab, view the Requirements (operating system requirements) listed for the setting. Some settings are supported on Windows Vista, and some are not.

  • Configure Corporate Windows Error Reporting: Use this setting to specify a server in your organization to which you want error reports to be sent (instead of being sent directly to Microsoft). If you enable the setting, you can specify your server name and port, and choose whether the reports should be sent using Secure Sockets Layer (SSL), which provides additional security for the connection. For more information about using this setting, see "Overview: Using Windows Error Reporting and the Problem Reports and Solutions Feature in a Managed Environment," earlier in this section.

Note that two settings in the Advanced Error Reporting Settings refer to the "Report Queue" and the "Report Archive." These both refer to information stored on the local computer running Windows Vista. The Report Queue temporarily stores error reports that, for one reason or another, are waiting to be sent. The Report Archive stores reports so that the Problem Reports and Solutions interface can display them.

Setting for Controlling the Degree of Prompting that Occurs Before Data is Sent

You can control the degree to which Windows Error Reporting prompts for consent before data is sent. This setting is located under either Computer Configuration or User Configuration in Administrative Templates\Windows Components\Windows Error Reporting\Consent.

Important

When you look at Group Policy settings for Windows Error Reporting on Windows Vista, on the Extended tab, view the Requirements (operating system requirements) listed for the setting. Some settings are supported on Windows Vista, and some are not.

  • Configure Default consent: If you enable this setting, you can select one of the following levels:

    • Always ask before sending data: Windows Error Reporting always prompts for consent before sending an error report.

    • Send parameters: Windows Error Reporting sends the minimum data required to check for an existing solution, for example, the application name and version, module name and version, and exception code. After sending this data, Windows Error Reporting prompts for consent before sending any additional data requested by Microsoft.

    • Send parameters and safe additional data: Windows Error Reporting sends the minimum data required to check for an existing solution as well as data that the developer of the program has designated as being highly unlikely to contain personally identifiable information. Windows Error Reporting then prompts for consent before sending any additional data requested by Microsoft.

    • Send all data: Any data requested by Microsoft will be sent, without prompts. (This setting can only be configured through Group Policy, not through the Control Panel interface.)

Setting for Disabling the Reporting of Handwriting Recognition Errors

You can use a Group Policy setting to specifically disable the reporting of handwriting recognition errors. This setting is located under either Computer Configuration or User Configuration in Administrative Templates\System\Internet Communication Management\Internet Communication settings.

  • Turn off handwriting recognition error reporting: If you enable this setting, users cannot start the error reporting tool for handwriting recognition errors, and corrected handwriting samples will never be sent by Windows Error Reporting.

Setting for Disabling Windows Error Reporting

This setting is located at Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings:

  • Turn off Windows Error Reporting: If you enable this setting, the user can still click Problem Reports and Solutions in Control Panel, but a pop-up message appears saying that Windows problem reporting has been turned off.

Important

You can also restrict Internet access for Windows Error Reporting and a number of other features by applying the Restrict Internet communication policy setting, which is located in Computer Configuration\Administrative Templates\System\Internet Communication Management. For more information about this Group Policy and the policies that it controls, see Appendix C: Group Policy Settings Listed Under the Internet Communication Management Category in Windows Vista.

Procedures for Configuring Error Reporting

The following procedures explain how to:

  • View or change settings for Windows Error Reporting on a computer running Windows Vista.

  • Use the Configure Corporate Windows Error Reporting policy setting so error reports are sent to a server on your intranet instead of to Microsoft.

  • Locate the Group Policy settings for configuring error reporting.

  • Disable the reporting of handwriting recognition errors.

  • Disable Windows Error Reporting by using Group Policy.

  • Control the consent level for error reporting by using an answer file for unattended installation.

To View or Change Settings for Windows Error Reporting on a Computer Running Windows Vista

  1. Click Start, and then either click Control Panel, or point to Settings and then click Control Panel.

  2. Either click System and Maintenance and then click Problem Reports and Solutions, or double-click Problem Reports and Solutions.

  3. On the left, click Change settings. View or change settings.

  4. Click Advanced settings. View or change settings, including the setting to turn problem reporting on or off.

To Configure Corporate Windows Error Reporting

  1. See Appendix B: Resources for Learning About Group Policy for Windows Vista for information about using Group Policy. Using an account with domain administrative credentials, log on to a computer running Windows Vista, open Group Policy Management Console (GPMC) by running gpmc.msc, and then edit an appropriate Group Policy object (GPO).

Note

You must perform this procedure by using GPMC on a computer running Windows Vista (GPMC is included in Windows Vista).

  1. Expand Computer Configuration, expand Administrative Templates, expand Windows Components, expand Windows Error Reporting, and then click Advanced Error Reporting Settings.

  2. In the details pane, double-click Configure Corporate Windows Error Reporting, and then click Enabled.

  3. Specify the name and port of the server to which error reports should be sent, and choose whether the reports should be sent using Secure Sockets Layer (SSL).

Important

When configuring this setting, be sure to open Advanced Error Reporting Settings and use the Configure Corporate Windows Error Reporting setting. Avoid using a similar setting that supports Windows XP and is designed for use with older versions of the tool for analyzing errors that you capture on your servers. This setting is at Computer Configuration\Administrative Templates\Windows Components\Windows Error Reporting\Configure Error Reporting. (In this setting, you can specify the corporate upload file path.)

For more information about using the **Configure Corporate Windows Error Reporting** setting, see "Overview: Using Windows Error Reporting and the Problem Reports and Solutions Feature in a Managed Environment," earlier in this section.  
  

To Locate Group Policy Settings for Configuring Error Reporting

  1. See Appendix B: Resources for Learning About Group Policy for Windows Vista for information about using Group Policy. Using an account with domain administrative credentials, log on to a computer running Windows Vista, open Group Policy Management Console by running gpmc.msc, and then edit an appropriate GPO.

Note

You must perform this procedure by using GPMC on a computer running Windows Vista (GPMC is included in Windows Vista).

  1. If you are interested in policy settings that apply to all users of a computer and that come into effect when the computer starts or when Group Policy is refreshed, expand Computer Configuration. If you are interested in policy settings that apply to users and that come into effect when users log on or when Group Policy is refreshed, expand User Configuration.

  2. Expand Administrative Templates, and then expand Windows Components.

  3. Click Windows Error Reporting, and then view the settings that are available.

Important

When you look at Group Policy settings for Windows Error Reporting on Windows Vista, on the Extended tab, view the Requirements (operating system requirements) listed for the setting. Some settings are supported on Windows Vista, and some are not.

  1. Click Advanced Error Reporting Settings, and then view the settings that are available. (Note that what you clicked in step 2 affects what you see in Advanced Error Reporting Settings. You must start by clicking Computer Configuration in step 2 if you want to locate the setting called Configure Corporate Windows Error Reporting.)

  2. On the left, click Consent, and then view the settings that are available. For more information about Configure Default Consent, see "Setting for Controlling the Degree of Prompting that Occurs Before Data is Sent," earlier in this section.

To Disable the Reporting of Handwriting Recognition Errors

  1. See Appendix B: Resources for Learning About Group Policy for Windows Vista for information about using Group Policy. Using an account with domain administrative credentials, log on to a computer running Windows Vista, open Group Policy Management Console by running gpmc.msc, and then edit an appropriate GPO.

Note

You must perform this procedure by using GPMC on a computer running Windows Vista (GPMC is included in Windows Vista).

  1. If you are interested in policy settings that apply to all users of a computer and that come into effect when the computer starts or when Group Policy is refreshed, expand Computer Configuration. If you are interested in policy settings that apply to users and that come into effect when users log on or when Group Policy is refreshed, expand User Configuration.

  2. Expand Administrative Templates, expand System, expand Internet Communication Management, and then click Internet Communication settings.

  3. In the details pane, double-click Turn off handwriting recognition error reporting, and then click Enabled.

Important

You can also restrict Internet access for Windows Error Reporting and a number of other features by applying the Restrict Internet communication policy setting, which is located in Computer Configuration\Administrative Templates\System\Internet Communication Management. For more information about this Group Policy and the policies that it controls, see Appendix C: Group Policy Settings Listed Under the Internet Communication Management Category in Windows Vista.

To Disable Windows Error Reporting by Using Group Policy

  1. As needed, see Appendix B: Resources for Learning About Group Policy for Windows Vista, and then edit an appropriate GPO.

  2. Expand Computer Configuration, expand Administrative Templates, expand System, expand Internet Communication Management, and then click Internet Communication settings.

  3. In the details pane, double-click Turn off Windows Error Reporting, and then click Enabled.

    If you enable this setting, the user can still click Problem Reports and Solutions in Control Panel, but a pop-up message appears, saying that Windows problem reporting has been turned off.

Important

You can also restrict Internet access for Windows Error Reporting and a number of other features by applying the Restrict Internet communication policy setting, which is located in Computer Configuration\Administrative Templates\System\Internet Communication Management. For more information about this Group Policy and the policies that it controls, see Appendix C: Group Policy Settings Listed Under the Internet Communication Management Category in Windows Vista.

  1. Using the methods you prefer for unattended installation or remote installation, create an answer file. For detailed information about entries to include in the answer file, see Unattend.chm in the Windows Automated Installation Kit, which can be downloaded from the Microsoft Web site at:

    https://go.microsoft.com/fwlink/?LinkId=70684

  2. Confirm that your answer file includes one of the following lines:

    • For a consent level of Always ask before sending data:

      <DefaultConsent>1</DefaultConsent>
      
    • For a consent level of Send parameters:

      <DefaultConsent>2</DefaultConsent>
      
    • For a consent level of Send parameters and safe additional data:

      <DefaultConsent>3</DefaultConsent>
      
    • For a consent level of Send all data:

      <DefaultConsent>4</DefaultConsent>
      

      For additional information about unattended installation, see the resources listed in Appendix A: Resources for Learning About Automated Installation and Deployment for Windows Vista.

Additional References