Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature.\n \nThis feature is not enabled by default. Enabling the feature requires administrator privileges. To enable and configure the feature, use the following registry values under the \n\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps key.\n\n\nhttp:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/bb787181(v=vs.85).aspx\n\n\nWER Settings - http:\/\/msdn.microsoft.com\/en-us\/library\/windows\/desktop\/bb513638(v=vs.85).asp\n\nhttps:\/\/www.google.com\/search?num=100&hl=en&newwindow=1&safe=off&site=&source=hp&q=windows+error+reporting+localdumps&oq=windows+error+reprting%5Cl&aq=0l&aqi=g-l5g-lv5&aql=1&gs_l=hp.1.0.0i13l5j0i13i15l5.340l24851l0l27274l24l24l0l0l0l0l119l1967l20j4l24l0.crnk_fspiked.1.\n\n\n\nCourtesy of John Carrona -\n\n Russinovich uses the dps command to find 3rd party drivers that arent evident in the stack. It's in the last section (the one on BSOD's) here: \n\nThe Case of the Unexplained 2010...Troubleshooting with Mark Russinovich - \n\nhttp:\/\/channel9.msdn.com\/Events\/TechEd\/Europe\/2010\/WCL301\n\nGreat stuff, John!