Skip to content
littleden.blogEvidence-led Windows troubleshooting, without the guesswork
FixesError codesComponentsCommandsWindows updatesWindows 11
Research statusMethodology
Windows command reference

Get-WinEvent — Application Hang

Read recent Application Hang Event ID 1002 records to establish which process hung and when before correlating WER, Reliability Monitor or wait-chain evidence.

Risk: LowReviewed: 2026-09-17
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1002; StartTime=(Get-Date).AddDays(-7)}

When to use it

Use when a Not responding problem repeats and you need a short event timeline instead of scrolling through the full Application log.

When not to use it

Event ID 1002 identifies a hang record; it does not prove the root cause. Do not clear the Application log during diagnosis.

Primary reference

Reviewed source

Related authority records

Continue with the same failing system

These links share the same component or repair context; they are not generic keyword suggestions.

ErrorEvent ID 1002 — Application Hang: the app stopped interacting with Windows

Treat Application Hang evidence as proof of a non-responsive process state, then correlate the process, report ID, wait chain and WER record before assigning cause.

GuideApplication keeps crashing in Windows 11: correlate Event ID 1000 with WER and the faulting module

Use repeated Application Error/WER records to identify the failing process, module and exception before reinstalling Windows or unrelated drivers.

GuideApplication not responding in Windows 11: inspect the wait chain before forcing repairs

A hung app may be waiting on another process, service or resource. Preserve the process and dependency evidence before reinstalling Windows or killing unrelated tasks.

ErrorEvent ID 1000 — Application Error: application or service crash record

Preserve the faulting application, module and exception code and correlate repeated Event 1000 entries with Windows Error Reporting Event 1001.

GuideUse Windows Error Reporting evidence to separate app crashes from app hangs

WER can preserve report identifiers and crash/hang context that help connect an incident to the correct process without turning every report into a root-cause claim.

CommandWEVTUTIL — query recent Event ID 41 records

Read recent matching events from the Windows System log without changing or clearing the log.