Diagnostics & reliability troubleshooting
Event Viewer, Reliability Monitor, crash/restart evidence, memory checks and system-history correlation.
Build a timeline first: exact event source/ID, timestamp, bugcheck or app name, and the change immediately before the failure. Separate a hang, app crash, bugcheck and power-loss restart before collecting deeper evidence.
Use process dumps, crash dumps, memory/storage tests or vendor hardware diagnostics only when the evidence points beyond a normal application or configuration failure. A dump is evidence for analysis, not an automatic diagnosis.
Match the failure to the exact time instead of scanning unrelated warnings.
The source plus ID matters; the number alone can be ambiguous across providers.
Preserve stop code, dump path, faulting app/module or restart context when present.
Look for driver, app or Windows changes immediately before failures began.
State what is missing before moving from correlation to a cause claim.
Escalate with the timestamp, events and dumps preserved when interpretation needs a vendor, IT team or debugger.
Unexpected restart in Windows 11: use Event ID 41 as a timeline clue, not the diagnosis
Kernel-Power Event ID 41 confirms Windows detected an unclean restart; correlate its fields with bugcheck, power and recent-change evidence before deciding why.
Find repeated app crashes with Reliability Monitor before reinstalling everything
Use the Windows reliability timeline to identify when failures began and whether they line up with a specific app, driver, update or installation.
Windows Memory Diagnostic: when to run it and how to read the result
Use the built-in memory test when repeated stop errors or instability make RAM plausible, then read the recorded result instead of assuming a clean test proves all hardware is healthy.
Application keeps crashing in Windows 11: correlate Event ID 1000 with WER and the faulting module
Use repeated Application Error/WER records to identify the failing process, module and exception before reinstalling Windows or unrelated drivers.
Find Windows crash dump files: Minidump vs MEMORY.DMP and what each tells you
Locate the dump that matches a Windows stop error and verify dump configuration before assuming Windows failed to capture the crash.
Application not responding in Windows 11: inspect the wait chain before forcing repairs
A hung app may be waiting on another process, service or resource. Preserve the process and dependency evidence before reinstalling Windows or killing unrelated tasks.
Capture a user-mode app dump with Task Manager in Windows 11
Preserve a crashing or hung application state for vendor or debugger analysis without crashing the whole PC.
No memory dump after a Windows blue screen: verify capture settings before blaming the crash
A missing MEMORY.DMP or Minidump can reflect dump configuration, paging-file requirements, disk space or an incomplete write—not proof that no bugcheck occurred.
Use Windows Error Reporting evidence to separate app crashes from app hangs
WER can preserve report identifiers and crash/hang context that help connect an incident to the correct process without turning every report into a root-cause claim.
Error records in this system
Kernel-Power: Windows restarted without a clean shutdown
Event ID 41 confirms an unexpected shutdown/restart occurred; it does not by itself name the failed component.
Open error record →Windows clientEvent ID 6008EventLog unexpected shutdown: a timestamp clue, not a root cause
Event ID 6008 records that the previous shutdown was unexpected; correlate it with Event ID 41, bugcheck records and the failure timeline.
Open error record →Windows clientEvent ID 1000Application Error: application or service crash record
Preserve the faulting application, module and exception code and correlate repeated Event 1000 entries with Windows Error Reporting Event 1001.
Open error record →Windows application hang contextEvent ID 1002Application Hang: the app stopped interacting with Windows
Treat Application Hang evidence as proof of a non-responsive process state, then correlate the process, report ID, wait chain and WER record before assigning cause.
Open error record →Commands used in this system
Reliability Monitor
perfmon /relOpen Reliability Monitor to review a time-oriented history of Windows reliability events and repeated application/system failures.
Low riskWindows Memory Diagnostic
mdschedSchedule the built-in Windows memory test, which restarts the PC and tests system memory before Windows loads normally again.
Low riskWEVTUTIL — query recent Event ID 41 records
wevtutil qe System /q:"*[System[(EventID=41)]]" /c:5 /rd:true /f:textRead recent matching events from the Windows System log without changing or clearing the log.
Low riskTask Manager — Analyze wait chain
Task Manager > Details > right-click process > Analyze wait chainDisplay whether a running process is waiting on another process or resource, which can help explain a Not responding state without modifying Windows configuration.
Low riskTask Manager — Create memory dump file
Task Manager > Processes/Details > right-click process > Create memory dump fileCapture a memory dump of one user-mode process so its state can be analyzed or provided to a support vendor without deliberately crashing Windows.
Low riskGet-WinEvent — Application Hang
Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1002; StartTime=(Get-Date).AddDays(-7)}Read recent Application Hang Event ID 1002 records to establish which process hung and when before correlating WER, Reliability Monitor or wait-chain evidence.
Low riskPowerShell — list WER report archive
Get-ChildItem "$env:ProgramData\Microsoft\Windows\WER\ReportArchive" -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 20 Name,LastWriteTimeList recent Windows Error Reporting archive directories so report timing can be correlated with an application crash or hang without deleting or changing the reports.
Low riskPowerShell — read CrashControl settings
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' | Select-Object CrashDumpEnabled,DumpFile,MinidumpDir,OverwriteRead the main Windows crash-dump configuration values without changing them, useful when a real bugcheck is not producing the expected dump file.