Windows Application Log · Event 1001
Event 1001: Windows Error Reporting filed a crash report
This is the paperwork that follows a crash, not the crash itself. Windows Error Reporting bundled up what happened, gave it a bucket number, and recorded where any dump file went. It reports that something already went wrong somewhere else.
Also written as Windows Error Reporting 1001Fault bucket type 0Event Name: APPCRASHWER 1001 event log
- How oftenFires often
- Vendor calls itInformation
- LogApplication
- SourceWindows Error Reporting
The fields that decide it
Everything else in the log line is context.
- Fault bucket
- Microsoft's classification of the crash. Identical buckets across machines mean the same underlying defect, which is the fastest way to prove a fleet-wide problem is one bug and not many.
- Event Name
- What kind of failure was reported.
-
APPCRASHA user-mode program crashed. Pairs with Application Error 1000. -
AppHangB1 or AppHangXProcB1A program stopped responding. Pairs with Application Hang 1002. -
BlueScreenThe machine bug-checked. Pairs with the System log Event 1001. -
PnPDriverImportErrorA driver package failed to install. -
MoAppCrashA packaged Store app crashed. - Response
- What Microsoft's servers said. Almost always 'Not available', which simply means no known fix was matched.
- Cab Id
- Whether a cabinet file of diagnostic data was created. A zero here means there is nothing left to collect.
- Report Id
- The identifier shared with the event that recorded the actual failure. This is how you join the two.
- Report Status
- A bitfield describing how far reporting got. Non-zero values usually mean upload was disabled by policy, not that anything else went wrong.
Common questions
Is Windows Error Reporting Event 1001 an error?
No. It is logged at Information level and it records that a report was filed about a problem, not the problem itself. Look for the event immediately before it — usually Application Error 1000 or Application Hang 1002 — which names what actually failed.
There are two different Event 1001s in my logs. Which is which?
The one in the Application log from Windows Error Reporting is a crash report. The one in the System log — shown as source BugCheck, provider Microsoft-Windows-WER-SystemErrorReporting — is a blue screen. Windows event IDs are only unique per provider, so always read the log name and the source before looking a number up.
Where is the dump file mentioned in Event 1001?
Under %LOCALAPPDATA%\CrashDumps for user-mode dumps, or under %PROGRAMDATA%\Microsoft\Windows\WER\ReportArchive and ReportQueue for the full report folders. If the Cab Id is 0 and the queue folder is empty, no dump was kept — Windows discards most of them once a bucket is already known.
Can I turn Windows Error Reporting off to stop these events?
You can, through Group Policy or by disabling the Windows Error Reporting Service, but it is rarely worth it. The events are harmless, and turning the service off also removes the dumps you would want the next time something crashes for real.
Read next
- Usually comes before Event 1000: An application crashed The application crash this report describes. Match on Report Id.
- Usually comes before Event 1002: A program stopped responding and was closed The application hang this report describes, when Event Name is AppHangB1.
- The equivalent of Event 1001 BugCheck: Windows recorded a blue screen The System log Event 1001, which is a whole-machine bug check. Same number, different log, completely different meaning.
- The equivalent of Event 1026: A .NET program threw an exception nobody caught A .NET unhandled exception, which is reported here as an APPCRASH with a CLR bucket.
Mentioned by
Vendor documentation
Last reviewed 6 September 2026