Log Dejargonizer

Windows Application Log · Event 1002

Event 1002: A program stopped responding and was closed

Windows decided a program had stopped answering its window messages and closed it for you. This is a freeze, not a crash — the program never faulted, it just stopped listening, which is why there is no faulting module to blame.

Also written as Application Hang 1002Event ID 1002 hangprogram not responding event log

What it means for you

On a personal computer

The program froze — the window went white or grey and said 'not responding' — and Windows shut it down. Nothing was damaged. What matters is what it was waiting on: a slow disk, a network drive that is not there any more, or a printer that is offline.

For an analyst

Hangs are diagnosed from a dump, not from the event, because the event has no fault address. Set the WER LocalDumps registry key for the executable before asking a user to reproduce it, otherwise you get a second useless 1002. Fleet-wide, group by application and by the hour — hangs that cluster at 9am are almost always a login-script or mapped-drive problem, not an application bug.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The program excelapp.exe version 16.0.17328.20124 stopped interacting with Windows and was closed.

Process ID: 2f10
Start Time: 01dcf000a1b2c3d4
Termination Time: 47
Application Path: C:\Program Files\Contoso\excelapp.exe
Report Id: 0a1b2c3d-0000-0000-0000-00000000abcd
Faulting package full name:
Faulting package-relative application ID:
Hang type: Top level window is idle

The fields that decide it

Everything else in the log line is context.

The program
Name and version of the program that stopped responding.
Process ID
The hexadecimal PID. Useful only if you were already collecting process telemetry at the time.
Start Time / Termination Time
How long the program had been running before it was killed. A hang seconds after launch points at startup work — licence checks, profile loading, add-in enumeration.
Hang type
Why Windows classified it as hung.
  • Top level window is idleThe main window stopped pumping messages. The classic freeze.
  • Cross-threadA thread the UI depends on is blocked, often on a lock or an I/O call.
  • UnknownWindows could not classify it, which usually means the process was killed before it could be examined.
Report Id
The Windows Error Reporting identifier. Match it against the Event 1001 that follows to find any dump that was written.

Ordinary reasons this happens

Most of the time it is one of these.

  • A mapped network drive or file share that has gone away — the program blocks on it and the UI stops answering until the SMB timeout expires.
  • A default printer that is offline. Anything that enumerates printers at startup or on a print dialog will freeze until it gives up.
  • A slow or failing disk making a routine file read take tens of seconds.
  • A very large file being opened, where the program does the work on the UI thread instead of in the background.
  • A shell extension or add-in blocking on something of its own — cloud storage sync clients are a common source.
  • The user clicking during a slow operation, which makes Windows offer to close a program that was going to finish on its own.

When it is not ordinary

Code injected into the process blocking its main thread.

What gives it awayHangs in a program that has never hung before, starting on a specific date, with an unfamiliar module loaded into it. Check Sysmon Event 8 or 10 around the same time.

ATT&CK T1055

Security software being made unresponsive rather than stopped outright, because a stopped service is noisier than a hung one.

What gives it awayRepeated 1002s naming an antivirus or EDR user-interface process while its service keeps running.

ATT&CK T1562.001

What to do next

  1. Establish whether the program was doing anything involving the network or a printer at the time. That accounts for most hangs and needs no dump.
  2. Check whether the hang always happens at the same point — at launch, on open, on save, on print. The point tells you what it is waiting for.
  3. Look for a matching Event 1001 with the same Report Id; that is where any dump file is recorded.
  4. If you need a dump, set HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\<exe> with DumpType=2 and reproduce. Without this, hangs are not diagnosable after the fact.
  5. Disconnect mapped drives and set the printer to a local one, then retry. This is a two-minute test that resolves a surprising share of cases.
  6. If several unrelated programs hang together, stop looking at the programs and look at the disk — Events 153 and 129 in the System log confirm it.

Queries to run

powershell Filter on the provider as well as the ID — several sources write a 1002 into the Application log. 
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application Hang'; Id=1002} -MaxEvents 50 | Select-Object TimeCreated, Message | Format-List
kql Hangs clustered into one hour across many hosts point at shared infrastructure rather than at the application. 
Event | where EventLog == 'Application' and Source == 'Application Hang' and EventID == 1002 | extend App = extract(@'The program (\S+)', 1, RenderedDescription) | summarize hangs = count(), hosts = dcount(Computer) by App, bin(TimeGenerated, 1h) | order by hangs desc
splunk 
index=wineventlog sourcetype=WinEventLog:Application EventCode=1002 | rex "The program (?<app>\S+)" | timechart span=1h count by app

Common questions

What is the difference between Event 1002 and Event 1000?

Event 1000 is a crash: the program executed something illegal and Windows terminated it, and the event names the exact module and exception code. Event 1002 is a hang: the program was still running perfectly well but stopped answering window messages, so there is no faulting module and no exception code to look up. Crashes are usually a bug in identifiable code; hangs are usually the program waiting on something outside itself.

Why does Windows close a program that says 'not responding'?

It does not, immediately. Windows marks a window unresponsive after roughly five seconds without it processing messages, and only ends the process when someone chooses to close it or an automatic recovery kicks in. Many programs marked 'not responding' would have recovered on their own — Event 1002 often records a hang that a little patience would have outlasted.

How do I find out what a program was waiting for when it hung?

You need a dump taken while it was hung, because the event itself records nothing about the cause. Set the LocalDumps registry key for that executable under Windows Error Reporting, reproduce the hang, and open the resulting dump. Before doing any of that, check the two things that cause most hangs: an unreachable network drive and an offline default printer.

Should I worry about Event 1002 on a home PC?

Not on its own. A program freezing occasionally is ordinary. It is worth attention when several different programs hang around the same time — that points at the disk or the network rather than at any one program — or when a program that has always been stable starts hanging every day.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026