Re: PSA - check if your crash logs are eating up your spare C: disk space

VanguardLH wrote:
> Maria Sophia <[email protected]> wrote:
> 
>> PSA - check if your crash logs are eating up your spare C: disk space
>> 
>> For whatever reason... I had "something" eating up disk space. 
>>  a. The moment I clear all files, C: filled up to zero spare bytes.
>>  b. Time and again, for weeks on end this happened to varying degrees.
>>  c. So I bit the bullet and dug into how to find the culprit.
>> 
>> Long story short:
>>  The Windows Crash Log directory was filled with browser crash dumps.
>>  <https://www.supportyourtech.com/articles/how-to-view-crash-logs-in-windows-10-a-step-by-step-guide/>
>> 
>> Many apps (including browsers) write dumps to:
>>  A. %LOCALAPPDATA%\CrashDumps
>>  B. %LOCALAPPDATA%\Microsoft\Windows\WER
>>  C. %PROGRAMDATA%\Microsoft\Windows\WER
> 
> For me, the first folder was empty, the second folder did not exist, and
> the third folder had subfolder, but no files.
> 
>> If desired, you can turn off crash dumps with this admin command:
>>  reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" /v Disabled /t REG_DWORD /d 1 /f
> 
> Or run the Power shell cmdlet "Disable-WindowsErrorReporting" (see
> https://learn.microsoft.com/en-us/powershell/module/windowserrorreporting/disable-windowserrorreporting).
> 
> As you mention, edit the registry to disable error reporting.  0 (zero)
> is the default if the Disabled data item is not defined.  Define and set
> to 1 to enable the disable.  
> 
> Mine was already set to 1, but I don't remember doing it via regedit.
> Probably set it long ago since I see no value to sending Microsoft
> information they likely would not review, and even more so after they
> discontinued Windows 10.  
> 
> Likely I used WinAero Tweaker under Behavior -> Error Reporting.  Their
> tweaks usually have a help article, and this one has an info page at:
> 
> https://winaero.com/disable-error-reporting-windows-10/
> 
> Under Control Panel\All Control Panel Items\Security and Maintenance,
> you can check for a list of app crashes.  After the above registry edit,
> the "Check for solutions to problems reports" is "Off".  Click on "View
> reliability history" to see the critical app crashes (which get rather
> lost in all the other errors in Event Viewer).
> 
> There is also the "Windows Error Reporting Service" service you could
> disable in services.msc, but unneeded if you do the registry edit.


Thanks to Vanguard for adding useful details about disabling Windows
Error Reporting. His notes on the PowerShell cmdlet, registry values,
and the related Control Panel and services.msc locations give us all a
clearer picture of how WER behaves and how to turn it off cleanly.

One more technical note worth adding for anyone chasing down disappearing
disk space in addition to the WER folders mentioned above, is that Windows
has several other diagnostic locations that can quietly accumulate multi-GB
files over time.

If you're still seeing unexplained space loss, these are worth checking:

 C:\Windows\LiveKernelReports
      Kernel dumps can be hundreds of MB each, especially if a driver is
      misbehaving.

 C:\Windows\Minidump
      Traditional BSOD dumps. Usually small, but they add up.

 C:\Windows\Memory.dmp
      A full memory dump can be several gigabytes on its own.

 %LOCALAPPDATA%\Temp
      Some apps leave behind enormous temp files that never auto-clean.

If we want to keep crash dumps enabled but avoid runaway growth, we can
also limit dump size or restrict Windows to generating only mini-dumps.
That gives us useful diagnostic data without the multi-GB surprises.

For anyone trying to identify *which* app is repeatedly crashing, the
Reliability Monitor (Win+R -> perfmon /rel) is another view in addition to
Event Viewer. Repeated failures from the same process usually point to a
bad extension, plugin, or driver rather than Windows itself.

Finally, a PowerShell one-liner that helps surface the worst offenders:

    Get-ChildItem -Recurse "$env:LOCALAPPDATA\CrashDumps",
        "$env:LOCALAPPDATA\Microsoft\Windows\WER",
        "$env:PROGRAMDATA\Microsoft\Windows\WER" |
        Sort-Object Length -Descending |
        Select-Object FullName,
            @{Name="SizeMB";Expression={[math]::Round($_.Length/1MB,2)}} |
        Format-Table -AutoSize

It's a quick way to see which dumps are consuming the most space and which
applications are generating them.

Hopefully this helps someone else avoid the same "mysteriously shrinking
C: drive" rabbit hole.