jcgriff2 Administrator, General Manager, BSOD Kernel Dump Expert, Microsoft MVP Staff member Joined Feb 19, 2012 Posts 20,052 Location New Jersey Shore Apr 13, 2012 #1 Starting with Windows Server 2008 and Windows Vista with Service Pack 1 (SP1), Windows Error Reporting (WER) can be configured so that full user-mode dumps are collected and stored locally after a user-mode application crashes. Applications that do their own custom crash reporting, including .NET applications, are not supported by this feature. This feature is not enabled by default. Enabling the feature requires administrator privileges. To enable and configure the feature, use the following registry values under the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps key. Click to expand... http://msdn.microsoft.com/en-us/library/windows/desktop/bb787181(v=vs.85).aspx WER Settings - http://msdn.microsoft.com/en-us/library/windows/desktop/bb513638(v=vs.85).asp https://www.google.com/search?num=1...l24l0l0l0l0l119l1967l20j4l24l0.crnk_fspiked.1. Courtesy of John Carrona - Russinovich uses the dps command to find 3rd party drivers that arent evident in the stack. It's in the last section (the one on BSOD's) here: The Case of the Unexplained 2010...Troubleshooting with Mark Russinovich - http://channel9.msdn.com/Events/TechEd/Europe/2010/WCL301 Great stuff, John!