windows XP Service Pack 3 download

Windows® XP Service Pack 3 (SP3) includes all previously released updates for the operating system. This update also includes a small number of new functionalities, which do not significantly change customers’ experience with the operating system. This white paper summarizes what is new in Windows XP SP3.

Windows® XP Service Pack 3 (SP3) includes all previously released updates for the operating system. This update also includes a small number of new functionalities, which do not significantly change customers’ experience with the operating system. This white paper summarizes what is new in Windows XP SP3.


Windows XP service pack3 link 1

Windows XP service pack3 link 2

Windows XP service pack3 link 3

Windows XP service pack3 link 4

Windows XP service pack3 link 5

Windows XP service pack3 link 6

Windows XP service pack3 link 7

Windows XP service pack3 link 8

Windows XP service pack3 link 9

Windows XP service pack3 link 10

Windows XP service pack3 link 11

Windows XP service pack3 link 12

after download all files, don't forget to join it them with filesplitter, download here the tools filesplitter

OR download from here if you will not use filesplitter tools

How Windows Error Reporting Works

An end user experiencing a crash is shown a dialog box that asks whether to send an error report to Microsoft. If the user chooses to send the report, then Microsoft Windows Error Reporting (WER) collects information about the application and the module involved in the crash and sends the encrypted information to a secure server at Microsoft. In some cases, additional data is also collected in a .cab file and sent with the report.

When Microsoft receives the report, it is sorted according to its contents, and wherever possible the information is associated with a particular hardware vendor, software vendor, or system manufacturer.

The vendor that owns the component associated with the crash can use Windows Quality Online Services (Winqual) to access WER data for its products, analyze the data to locate the source of the problem, and then provide solutions both through the end-user error dialog boxes and by providing updated files on Windows Update.

Using Windows Server 2003 in a Managed Environment

Benefits and Purposes of Windows Error Reporting

The Windows Error Reporting feature in Microsoft Windows Server 2003 family operating systems provides a service which allows Microsoft to track and address errors relating to the operating system, Windows components, and applications. This service, called the Error Reporting service, gives administrators and users with administrative credentials the opportunity to send data about errors to Microsoft and to receive information about them. Moreover, developers can use the Error Reporting service as a problem-solving tool to address customer problems in a timely manner and to improve the quality of Microsoft products.

In addition to having users or administrators send information to Microsoft, in some cases Microsoft may provide information, such as a way to work around a problem or a link to a Web site for updated drivers, patches, or Microsoft Knowledge Base articles.

Overview: Using Windows Error Reporting in a Managed Environment

In Windows Server 2003 family operating systems, error reporting is enabled by default and you can report system and application errors to Microsoft if you choose to. When an error occurs, a dialog box is displayed, giving you the option to report the problem. If you choose to report the problem, technical information about it is collected and then sent to Microsoft over the Internet. No information is sent unless you confirm that the error report be sent to Microsoft.

On Windows Server 2003 family operating systems you can configure or disable error reporting through the Control Panel\System\Advanced tab. You can configure error reporting to send specified information such as system errors only, unplanned shutdowns, or errors for Windows components, such as Windows Explorer, Paint, or Microsoft Internet Explorer. You can also send information for applications, such as Microsoft Word. An operating system error causes the computer to display a Stop error screen with error values. An application or component error causes the application or component to stop working.

The default settings for the Windows Server 2003 family are:

•

Enable error reporting for the operating system, unplanned computer shutdowns, and applications. For application errors, you can configure error reporting in one of two ways: either have the error reporting dialog box appear as soon as an error occurs for any user, or do not have the dialog box appear until the next time an administrator logs on. Windows treats operating system errors and unplanned shutdowns differently from the way it treats application errors. If an operating system error or unplanned shutdown occurs, Windows writes the error information to a log file. The next time an administrator logs on, the error reporting dialog box prompts them to report the error.

•

Force queue mode for application errors. The queued mode displays the last ten errors the next time the administrator logs on to the computer. Each error is displayed in its own window so the administrator can choose the errors to report to Microsoft. In this mode errors are displayed only to an administrator; if users logged on to the server they would not see the errors.

Since error reporting is a valuable service, we do not recommend that IT administrators disable it, but that they control what information is reported and where it is sent. For an organization where privacy is a concern, we recommend that the IT department review and filter error reports before they are sent to Microsoft. The best method to use to prevent the automatic flow of error reporting information to and from the Internet is to redirect error reports to a server on your intranet by using Group Policy and to set up Corporate Error Reporting (CER). You can configure error reporting to control various aspects of how errors are reported.

IT administrators can use the Corporate Error Reporting tool to manage error reports that have been redirected to a network server. You use the tool to review the redirected error reports and then filter the reports that are sent to Microsoft based on your policies and the data contained within the error report. The tool is also useful for determining the types of problems users are experiencing most often.

If you have not yet deployed the operating system, you can use unattended installation files to configure error reporting in the same way as in Group Policy. If it is necessary in your organization to completely disable Windows Error Reporting you can do so with the unattended installation file or with Group Policy. For more information about these methods, see "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet," later in this section.

How Windows Error Reporting Communicates with Sites on the Internet

The data that Microsoft collects is used strictly for the purpose of tracking down and solving problems that users or administrators are experiencing. The information is stored in a secure database with limited access. This subsection describes various aspects of the data that is sent to and from the Internet during error reporting, and how the exchange of information takes place.

•	Specific information sent or received: Microsoft collects various types of information related to two types of errors, user mode or application errors, and kernel mode or operating system failures. Some information that uniquely identifies the user might inadvertently be collected as part of the crash report. This information, if present, is never used to contact a user. The specific data collected is described later in this subsection. Also, Microsoft may send information about a problem, including links to Web sites.
•	Default and recommended settings: Error reporting for application and system errors is enabled by default. For more information about recommended settings, see "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet," later in this section.
•	Triggers: The opportunity to send an error report is triggered by application or system errors.
•	User notification: A dialog box appears notifying users that an error has occurred and asks if they want to send an error report to Microsoft. Users can review the data that will be sent.
•	Logging: Descriptions of system and application errors are recorded in the event log.
•	Encryption: All data that could include personally identifiable information is encrypted (HTTPS) during transmission. The "crash signature," which includes such information as the application name and version, module name and version, and offset (location) is not encrypted.
•	Access: Microsoft employees and contingent staff who have submitted a business justification for reviewing the information are granted access to the data.
•	Privacy statement: The privacy statement for Microsoft Error Reporting is located at the following Web site: watson.microsoft.com/dw/1033/dcp.asp Details related to privacy of data are presented in "Types of data collected," later in this section.
•	Transmission protocol and port: The transmission protocol is HTTP and the ports are HTTP 80 and HTTPS 443.
•	Ability to disable: The feature can be disabled through Group Policy or by administrators on individual servers.

Types of Errors Reported

There are two types of errors that are reported, user mode and kernel mode.

User Mode Reporting

When a user mode error occurs, such as an application error, the Error Reporting service does the following:

•

Displays an alert stating that the operating system detected a problem. Users can choose to report the problem or not. If they do report it, they will see that the information is being sent to Microsoft.

•

Sends a problem report to Microsoft. Users may then be queried for additional computer information and again may choose to send it or not. If they choose to do so, the Error Reporting service sends the error report to Microsoft. Users might be prompted to provide additional information to complete the error report. When the process is complete, users have the option of selecting More Information, which directs them to updated drivers, patches, or Microsoft Knowledge Base articles.

If the error report indicates that one or more non-Microsoft products were involved in causing the problem, Microsoft may send the report to the respective companies. Qualified software or hardware developers (employed by Microsoft or one of its partners) will analyze the fault data and try to identify and correct the problem.

Kernel Mode Reporting

When a kernel mode or system error occurs, Windows displays a Stop message and writes diagnostic information to a memory dump file. When you restart your computer using normal mode or Safe Mode (with networking) and log on to Windows, the Error Reporting service gathers information about the problem and displays a dialog box that gives you the option of sending a report to Microsoft.

Types of Data Collected

The Error Reporting service collects Internet Protocol (IP) addresses, which are not used to identify users. It does not intentionally collect anyone's name, address, e-mail address, computer name, or any other form of personally identifiable information. It is possible that such information may be captured in memory or in the data collected from open files, but Microsoft does not use it to identify users.

In rare cases, such as problems that are especially difficult to solve, Microsoft may request additional data, including sections of memory (which may include memory shared by any or all applications running at the time the problem occurred), some registry settings, and one or more files from the user's computer. The user's current documents may also be included. When additional data is requested, the user can review the data and choose to send the information or not.

The specific type of data that is collected when application errors or kernel failures occur is as follows.

Application Errors

If you have an application error the Error Reporting service collects the following information:

•

The Digital Product ID, which can be used to identify your license.

•

Information regarding the condition of the computer and the application at the time the error occurred. This includes data stored in memory and stacks, information about files in the application's directory, as well as the operating system version and the computer hardware in use. This information is packaged into what is called a "minidump." The minidump contains the following: • Exception information: This is information regarding the problem that occurred; it tells Microsoft what kind of instruction the application received that caused it to generate an error. • System information: This is data about the kind of CPU (processor) you have and what operating system you are running. • A list of all the modules that are currently loaded and their version information. • A list of all the threads that are currently running. For each thread, the current context and the whole stack are collected. • Global data. The minidump data is shown as a hexadecimal representation that the user cannot read. Note: For the exact specification of the minidump format, see the Microsoft Platform SDK, which is available on the Microsoft Developers Network (MSDN) Web site.

Windows Kernel Failures

Windows kernel fault reports contain information about what your operating system was doing when the problem occurred. These event reports contain the minimum information that can help to identify why the operating system stopped unexpectedly. The report includes:

•	The operating system name (for example, Microsoft Windows 2000).
•	The operating system version (for example, 5.1.2426 0.0).
•	The operating system language as represented by the locale identifier (LCID) (for example, 1033 for United States English). This is a standard international numeric abbreviation.
•	The loaded and recently unloaded drivers. These identify the modules used by the kernel when the Stop error occurred, and the modules that were used recently.
•	The list of drivers in the Drivers folder on your hard disk, that is, systemroot\System32\Drivers.
•	The file size, date created, version, manufacturer, and full product name for each driver.
•	The number of available processors.
•	The amount of random access memory (RAM).
•	The time stamp that indicates when the Stop error occurred.
•	The messages and parameters that describe the Stop error.
•	The processor context for the process that stopped. This includes the processor, hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts (requests from software or devices for processor attention).
•	The process information and kernel context for the halted process. This includes the offset (location) of the directory table and the database that maintains the information about every physical page (block of memory) in the operating system.
•	The process information and kernel context for the thread that stopped. This information identifies registers (data-storage blocks of memory in the processor) and interrupt request levels, and includes pointers to data structures for operating system data.
•	The kernel-mode call stack for the interrupted thread. This is a data structure that consists of a series of memory locations and includes a pointer to the initial location.

Controlling Error Reporting to Prevent the Flow of Information to and from the Internet

To prevent the automatic flow of information to and from the Internet when users and administrators report errors, you can configure error reporting in two ways: while deploying the operating system using answer files with unattended or remote installation, or after deployment using Group Policy. There may be some aspects of error reporting you want to configure using answer files, and others you may want to configure using Group Policy. Review the tables in this subsection to determine the configuration options that will work best for your organization.

Using Unattended Installation

You can configure error reporting by using standard methods for unattended or remote installation. You use the [PCHealth] section of an answer file to make entries for this feature. The following table describes those entries.

Entries for configuring error reporting in an answer file (for unattended installation)

Entry	Description
ER_Display_UI	Specifies whether Setup notifies the user that an error has occurred and shows details about the error. When the entry is ER_Display_UI = 0, Setup does not notify the user that an error has occurred.
ER_Enable_Applications ER_Include_EXE(n) and ER_Exclude_EXE(n)	ER_Enable_Applications = All Reports errors for all applications except for those listed in ER_Exclude_EXE(n). ER_Enable_Applications = Listed Reports errors only for those applications listed in ER_Include_EXE(n). You can automatically include Microsoft applications by using ER_Include_MSApps. ER_Enable_Applications = None Reports no application errors. Examples of entries that list included applications are: ER_Include_EXE1 = iexplore.exe ER_Include_EXE2 = explorer.exe Examples of entries that list excluded applications are: ER_Exclude_EXE1 = calc.exe ER_Exclude_EXE2 = notepad.exe
ER_Enable_Kernel Errors	Specifies whether Windows reports errors in the Windows kernel. When the entry is ER_Enable_Kernel Errors = 0, Windows does not report errors in the Windows kernel.
ER_Enable_Reporting	Specifies whether Windows automatically reports errors. When the entry is ER_Enable_Reporting = 0, Windows does not report errors.
ER_Enable_Windows_ Components	Specifies whether to report errors in Windows components. When the entry is ER_Enable_Windows_Components = 0, Windows does not report errors in Windows components. To exclude individual Windows components, use ER_Exclude_EXE(n), as described earlier in this table.
ER_Force_Queue_Mode	Specifies whether to send all reports in queue mode. When the entry is ER_Force_Queue_Mode = 0, Windows does not send reports in queue mode.
ER_Include_MSApps	Specifies whether to track and report errors in Microsoft applications. When the entry is ER_Include_MSApps = 0, errors in Microsoft applications are not tracked and reported.
ER_Include_Shutdown_ Errs	Specifies whether to report shutdown errors. When the entry is ER_Include_Shutdown_Errs = 0, shutdown errors are not reported.

For complete details about the entries for error reporting, see the resources listed in Appendix A, "Resources for Learning About Automated Installation and Deployment." Be sure to review the information in the Deploy.chm file (whose location is provided in that appendix).

Using Group Policy

To enable Corporate Error Reporting, perform these steps:

•	Configure the Error Reporting policy settings in Group Policy so that error reports go to a server on your intranet.
•	Use the Corporate Error Reporting tool to filter reports.

Enable error reporting through Group Policy so you can override actions users or administrators might take, and so you can redirect error reports to a server on your intranet instead of to the Internet. Once you have initiated Corporate Error Reporting, you can use this tool to manage error reports.

In addition to the Error Reporting policy settings, this subsection also includes a list of the Advanced Error Reporting policy settings you may want to use for additional configuration options.

Using Error Reporting Policy Settings

To configure servers for Corporate Error Reporting you need first to enable the Report Errors policy setting. Once you enable this policy setting, you can enter a file path to a server on your intranet, limit data that is exchanged on the Internet when errors are reported, control how users and administrators interact with the Error Reporting service, and take other steps to control information.

For details about locating the error reporting policy settings, see "Procedures for Configuring Error Reporting," later in this section. The following table describes the policy settings.

Group Policy settings for configuring error reporting

Policy setting	What it does	Configuration options
Report Errors (enabled)	Errors are reported to Microsoft through the Internet or to a server on your intranet. Enabling Report Errors will override any settings made using Control Panel for error reporting. Default values will be used for any error reporting settings that are not configured, even if settings were adjusted through Control Panel.	Can select: • Do not display links to any Microsoft provided "more information" Web sites • Do not collect additional files • Do not collect additional computer data • Force queue mode for application errors (note that this is the default configuration for servers) Can enter: • Corporate file path • Text to replace instances of the word "Microsoft"
Report Errors (disabled)	Users will not be given the option to report errors. If Display Error Notification is enabled, users will still get a message indicating that a problem occurred, but they will not have the option to report it. Disabling Report Errors is useful for servers that do not have interactive users.	Not applicable
Report Errors (not configured)	Users will be able to adjust the setting using Control Panel, which is set to "enable reporting" by default.	Not applicable
Display Error Notification (enabled)	This setting controls whether a user is given the choice to report an error. When enabled, the user will be notified that an error has occurred and will be given access to details about the error.	Not applicable
Display Error Notification (disabled)	The user is not given the choice of whether to report the error. If Report Errors is enabled, the error will be automatically reported, but the user will not be notified that an error has occurred. Disabling this setting is useful for servers that do not have interactive users. (Default setting for servers.)	Not applicable
Display Error Notification (not configured)	The user will be able to adjust the setting through Control Panel, which is set to enable notification by default.	Not applicable

Using Advanced Error Reporting Policy Settings

When you enable error reporting you can choose to specify the types of errors that are reported. In a highly managed environment administrators might want to do this based on the kinds of information included in the error report (see "Types of data collected," in the previous subsection).

With Advanced Error Reporting you can configure the following policy settings:

•	Default application reporting settings
•	List of applications to always report errors for
•	List of applications to never report errors for
•	Report operating system errors
•	Report unplanned shutdown events

These policy settings are located in Computer Configuration\Administrative Templates\System\Error Reporting. When you configure these policy settings they will override any adjustments to error reporting administrators might make through Control Panel. You can configure these same policy settings in an answer file for unattended installation.

To find more information about editing Group Policy, see Appendix B, "Resources for Learning About Group Policy."

How Controlling Error Reporting can Affect Administrators

What administrators will see on a server when an error occurs depends on how you have configured the Error Reporting policy settings. You can have certain administrators sending error reports to your intranet server only and others using CER to filter reports and send selected ones on to Microsoft. On some servers, for example, administrators may see only operating system or unplanned computer shutdown error reports and not application errors. Or, on some servers you might choose not to have error notification on.

Top of page

Procedures for Configuring Error Reporting

This subsection presents the recommended procedure for enabling Corporate Error Reporting by configuring the Report Errors policy setting in Group Policy, for IT administrators who want to control the information that goes out to the Internet. This subsection also presents steps for configuring error reporting during unattended installation of the operating system by using an answer file.

Use the following procedure to configure the Report Errors policy setting so error reports are sent to a server on your intranet instead of to Microsoft.

To Enable Corporate Error Reporting by Using Group Policy

1.	Use the resources described in Appendix B, "Resources for Learning About Group Policy," to learn about the Group Policy Management Console, and to find information in Help about Group Policy. Follow the instructions in Help to apply Group Policy objects (GPOs) to an organizational unit, a domain, or a site, as appropriate for your situation.
2.	Click Computer Configuration, click Administrative Templates, click System, and then click Error Reporting.
3.	In the details pane, double-click Display Error Notification, and then select Enabled.
4.	Click Next Setting, and then under Report Errors, select Enabled.
5.	In the Corporate upload file path box, enter a UNC (Universal Naming Convention) path (\\servername\sharename).

Note: Administrators can then filter the error reports using the CER tool described in the previous subsection, "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet."

To Configure Error Reporting During Unattended Installation by Using an Answer File

1.

Using the methods you prefer for unattended installation or remote installation, create an answer file. For information about unattended installation, and for details about the entries for error reporting, see the resources listed in Appendix A, "Resources for Learning About Automated Installation and Deployment." Be sure to review the information in the Deploy.chm file (whose location is provided in that appendix).

2.

In the [PCHealth] section of the answer file, create entries according to the table in "Using unattended installation," earlier in this section. For example, to disable error reporting the entry is:

How Windows Error Reporting Communicates with Sites on the Internet

The data that Microsoft collects is used strictly for the purpose of tracking down and solving problems that users are experiencing. The information is stored in a secure database to which access is limited. This subsection describes various aspects of the data that is sent to and from the Internet during error reporting, and how the exchange of information takes place.

• Specific information sent or received: For Windows XP with SP1, Microsoft collects various types of information related to two types of errors, user mode or application errors, and kernel mode or operating system failures. Some information that uniquely identifies the user might unintentionally be collected as part of the crash report. This information, if present, is never used to identify a user. The specific data collected is described later in this subsection. Also, Microsoft may send information about a problem, including links to Web sites.

• Default and recommended settings: Error reporting for application and system errors is enabled by default on clients running Windows XP with SP1. For more information about recommended settings, see "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet," later in this section.

• Triggers: The opportunity to send an error report is triggered by application or system errors.

• User notification: A dialog box appears notifying users that an error has occurred and asks if they want to send an error report to Microsoft. Users can review the data that will be sent.

• Logging: Descriptions of system and application errors are recorded in the event log.

• Encryption: All data that could include personally identifiable information is encrypted (HTTPS) during transmission. The "crash signature," which includes such information as the application name and version, module name and version, and offset (location) is not encrypted.

• Access: Microsoft employees and contingent staff may access the error reports to maintain the Error Reporting service or improve Microsoft products, and may not use the reports for other purposes.

  If the error report indicates that one or more non-Microsoft products were involved in causing the problem, Microsoft may send the report to the respective companies. Qualified software or hardware developers (employed by Microsoft or one of its partners) will analyze the fault data and try to identify and correct the problem.

• Privacy: The privacy statement for Microsoft Error Reporting is located at the following Web site:

  http://go.microsoft.com/fwlink/?LinkId=825

  Details related to privacy of data are presented in "Types of Data Collected," later in this section.

• Transmission protocol and port: The transmission protocol is HTTP and the ports are HTTP 80 and HTTPS 443.

• Ability to disable: The feature can be disabled through Group Policy or by users on their own computers.

Types of Errors Reported

In Windows XP with SP1 there are two types of errors that are reported, user mode and kernel mode.

User Mode Reporting

When a user mode error occurs, such as an application error, the Error Reporting service does the following:

• Displays an alert stating that Windows XP detected a problem.

  Users can choose to report the problem or not. If they do report it, they will see that the information is being sent to Microsoft.

• Sends a problem report to Microsoft.

  Users may then be queried for additional computer information (to complete the error report) and again may choose to send it or not.

• When more information is available, offers it to users.

  Users might be offered the option of selecting More Information, which directs them to updated drivers, patches, or Microsoft Knowledge Base articles.

If the error report indicates that one or more non-Microsoft products were involved in causing the problem, Microsoft may send the report to the respective companies. Qualified software or hardware developers (employed by Microsoft or one of its partners) will analyze the fault data and try to identify and correct the problem.

Kernel Mode Reporting

When a kernel-mode (system) error occurs, Windows XP with SP1 displays a Stop message and writes diagnostic information to a memory dump file. When a user restarts the computer by using normal mode or Safe Mode (with networking) and logs on to Windows XP as an administrator, the Error Reporting service gathers information about the problem and displays a dialog box that gives the user the option of sending a report to Microsoft.

Types of Data Collected

The Error Reporting service collects information about the computer configuration, what the software was doing when the problem occurred, and other information directly related to the problem. The Error Reporting service does not intentionally collect anyone’s name, address, e-mail address, computer name, or any other form of personally identifiable information. It is possible that such information may be captured in memory or in the data collected from open files, but Microsoft does not use it to identify users. The Error Reporting service collects Internet Protocol (IP) addresses, but the addresses are not used to identify users, and in many cases are the address of a Network Address Translation (NAT) computer or proxy server, not a specific client behind that NAT computer or proxy server. IP address information is used in aggregate by the operators who maintain the servers that receive error reports. The other use for IP address information is to locate error reports that come from computers inside Microsoft—errors on those computers can be more thoroughly investigated as needed.

In rare cases, such as problems that are especially difficult to solve, Microsoft may request additional data, including sections of memory (which may include memory shared by any or all applications running at the time the problem occurred), some registry settings, and one or more files from the user’s computer. When additional data is requested, the user can review the data and choose to send the information or not.

In Windows XP with SP1 the specific types of data that are collected when application errors or kernel failures occur is as follows.

Application Errors

If an application error occurs for which Error Reporting is available and the user chooses to send the report, the information included is as follows:

• The Digital Product ID, which can be used to identify your license.

• Information regarding the condition of the computer and the application at the time when the error occurred. This includes data stored in memory and stacks, information about files in the application's directory, as well as the operating system version and the computer hardware in use. This information is packaged into a minidump—a small memory dump. The minidump contains the following:

  • Exception information: This is information regarding the problem that occurred. It tells Microsoft what kind of instruction the application received that caused it to generate an error.

  • System information: This is data about the kind of CPU (processor) you have and what operating system you are running.

  • A list of all the modules that are currently loaded and their version information.

  • A list of all the threads that are currently running. For each thread, the current context and the whole stack are collected.

  • Global data.

  The minidump data is shown as a hexadecimal representation that the user cannot read.

  Note For the exact specification of the minidump format, see the Microsoft Platform SDK, which is available on the MSDN Web site.

Windows Kernel Failures

Windows kernel fault reports contain information about what your operating system was doing when the problem occurred. These event reports contain the minimum information that can help to identify why the operating system stopped unexpectedly. If the user chooses to send the report, it includes:

• The operating system name (for example, Microsoft Windows XP).

• The operating system version (for example, 5.1.2600 0.0).

• The operating system language as represented by the locale identifier (LCID) (for example, 1033 for United States English). This is a standard international numeric abbreviation.

• The loaded and recently unloaded drivers. These identify the modules used by the kernel when the Stop error occurred, and the modules that were used recently.

• The list of drivers in the Drivers folder on your hard disk (systemroot\System32\Drivers).

• The file size, date created, version, manufacturer, and full product name for each driver.

• The number of available processors.

• The amount of random access memory (RAM).

• The time stamp that indicates when the Stop error occurred.

• The messages and parameters that describe the Stop error.

• The processor context for the process that stopped. This includes the processor, hardware state, performance counters, multiprocessor packet information, deferred procedure call information, and interrupts (requests from software or devices for processor attention).

• The process information and kernel context for the halted process. This includes the offset (location) of the directory table and the database that maintains the information about every physical page (block of memory) in the operating system.

• The process information and kernel context for the thread that stopped. This information identifies registers (data-storage blocks of memory in the processor) and interrupt request levels, and includes pointers to data structures for operating system data.

• The kernel-mode call stack for the interrupted thread. This is a data structure that consists of a series of memory locations and one or more pointers.

Windows Error Reporting

Benefits and Purposes of Windows Error Reporting

The Windows Error Reporting feature in Windows XP Professional with Service Pack 1 (SP1) provides a service that allows Microsoft to track and address errors relating to the operating system, Windows components, and applications. This service, called the Error Reporting service, gives users the opportunity to send data about errors to Microsoft and to receive information about them. Microsoft developers can use the Error Reporting service as a problem-solving tool to address customer problems in a timely manner and to improve the quality of Microsoft products.

When users send information to Microsoft, in some cases Microsoft may provide information to users, such as a way to work around a problem or a link to a Web site for updated drivers, patches, or Microsoft Knowledge Base articles.

Overview: Using Windows Error Reporting in a Managed Environment

In Windows XP with SP1, error reporting is enabled by default and users can choose to report errors to Microsoft. When an error occurs, a dialog box is displayed allowing the user to report the problem. When a user chooses to report the problem, technical information about the problem is collected and then sent to Microsoft over the Internet. No information is sent unless the user confirms that the error report is to be sent to Microsoft. A user who is logged on as an administrator can choose to report system and application errors. A user who is not logged on as an administrator can choose to report application errors.

Users with administrative credentials can configure or disable error reporting through Control Panel\System\Advanced. They can configure error reporting to send specified information such as system errors (Stop errors) only, or errors for Windows components, such as Windows Explorer or Microsoft Internet Explorer. Users can also send information for applications, such as Microsoft Word.

Since error reporting is a valuable service, we recommend that IT administrators not disable it, but that they control what information is reported and where it is sent. For an organization where privacy is a concern, we recommend that the IT department review and filter error reports before they are sent to Microsoft. Though it is not recommended, you can also completely disable error reporting on client computers by using Group Policy.

The best method to use to prevent the automatic flow of error reporting information to and from the Internet is to redirect error reports to a server on your intranet by using Group Policy and to set up Corporate Error Reporting (CER).

If you qualify for Corporate Error Reporting as a Software Assurance benefit, you can use the Corporate Error Reporting tool to manage error reports that have been redirected to a network server. You use the tool to review the redirected error reports and then filter the reports that are sent to Microsoft based on your policies and the data contained within the error report. The tool is also useful for determining the types of problems users are experiencing most often.

If you have not yet deployed Windows XP with SP1, you can use unattended installation files to configure error reporting in the same way as in Group Policy. If it is necessary in your organization to completely disable Windows Error Reporting, you can do so with the unattended installation file or with Group Policy. For more information about these methods, see "Controlling Error Reporting to Prevent the Flow of Information to and from the Internet," later in this section.

Description of the end user privacy policy in application error reporting when you are using Office

Privacy and our customers

When Microsoft, other technology companies, and most governmental bodies talk about privacy, they are referring to the collection and use of personal data (such as name, age, addresses, hobbies, and so on). This approach is in keeping with the privacy regulations of the European Union (EU) as well as the Fair Information Practice Principles of the Federal Trade Commission. To view the Fair Information Practice Principles, visit the following Federal Trade Commission Web site:

http://www.ftc.gov/reports/privacy3/fairinfo.htm (http://www.ftc.gov/reports/privacy3/fairinfo.htm)

With the Application Error Reporting tool, the only data that is initially collected is technical data about the state of the program and your computer when the crash occurred. Your document (or any data contained in it) is not intentionally sent with the other report information. To ensure further security, the data that is collected is transmitted via a secure connection and is kept confidential and anonymous in a limited-access database.

In some cases, Microsoft may need to collect additional data, including user documents, in order to continue research on correcting a specific problem. However, before any data is collected, a message appears that clearly informs you about what data Microsoft needs to upload and allows you to cancel the transmission before any additional data is collected.

User notification and consent

One of the goals of Application Error Reporting is to clearly notify you any time information is being collected. In the Application Error Reporting dialog box, you are notified that the program will close and a report is being generated about the problem. At this point, you can choose to view the technical information contained in the report. You can then choose whether to send the report information to Microsoft. The dialog box also states that if you choose to send the application crash information, the information will be kept strictly confidential and private.

Data collection, use, and protection

You may ask, "Why do companies collect personal information?" Microsoft does this for several reasons:

•	Personalization: Many Web sites collect user information to better personalize their sites for each user. Among the best examples of this is the Microsoft Web site (http://www.microsoft.com (http://www.microsoft.com)), which uses the personal information you type in to better customize itself for you.
•	Business Model: Many sites ask users for personal information so that advertisers can better personalize the goods and services shown to customers. In return, customers receive free content and services. For example, the Microsoft MSN Web site (http://www.msn.com/ (http://www.microsoft.com/) offers free e-mail, Web sites, chats, bulletin boards, and a variety of other services to its customers. In return, those customers are exposed to products and services more tailored to their individual interests.
•	Product Communication: Many companies, especially those that offer e-products or software products, collect personal information so that you can be notified of updates, new releases, or upgrades. Application Error Reporting offers you a special version of those services: If you choose to send the report, the Application Error Reporting tool checks to see whether any fixes, service packs, or product upgrades are available that may help with the problem you are having. If information is available that may be helpful, your browser takes you to that Web site when you click the More Information link on the Thank You dialog box that appears when your report is sent. Note If you do not want to have the technical data sent to Microsoft, please click the Don't Send button.

Introducing Windows Error Reporting

Leverage Microsoft’s Feedback System for Your Applications

Windows Error Reporting is the set of feedback technologies built-in to Microsoft Windows XP, Windows Vista, and Microsoft Windows Server 2003 operating systems. WER captures software crash and hang data from end-users who agree to report it. You can access the data that is related to your applications online at https://winqual.microsoft.com.

Using the WER service is like having thousands of testers reporting bugs on your company's applications. You can monitor error trends and download debug information to help your developers determine the precise causes for application errors. WER categorizes and prioritizes your data for you, and includes a response feature to provide solutions to your end-users.

How WER Adds Value to Software Development

1. During Development: We provide tools to check your code for performance and reliability on Windows platforms. Tools like Microsoft Application Verifier and FXCop remove unseen bugs before testing begins.
2. During Beta Testing: Windows Error Reporting works with your test versions.
• Get early feedback on errors seen by end-users. WER provides you with an easy-to-use reporting summary. Error types are categorized for you, and hit counts show real-world impact.
• WER makes it easier for you to debug your applications. You can download debug data on errors in Minidump format. We provide a Minidump reader, Windows Debugger. (Visual Studio also reads Minidumps). Windows Debugger also helps manage Symbols, which help you identify problem functions.
3. After Release: Use WER to understand the top crash and hang issues affecting your customers.
• Increase customer satisfaction by fixing top customer issues. Microsoft has found that fixing the top 1% of issues can cut customer pain (crashes/hangs) by more than half.
• Reduce support costs by responding directly to a customer with a ready-made resolution. Once bugs are resolved, you can submit responses that fix them. These responses can be patches, updates, workarounds, or surveys; and these responses will be passed on to users the next time the same failure occurs.
4. At End of Life: Ask your customers to upgrade! WER responses can inform your users that a new version is available and how to get it.

Register for Windows Error Reporting Services

Step 1 - Register Your Company on https://winqual.microsoft.com/SignUp/
Please note: a digital certificate is required. For your protection, and the protection of our end-users, Microsoft requires all ISVs to be identified by a digital certificate. We want to ensure that access to data related to your applications is secure. And, of course, we all want to protect the privacy of our end-users’ data. As of 3/1/2006, the cost from VeriSign for the digital certificate is four hundred dollars ($400). Microsoft does not charge ISVs for use of the WER software services.

Step 2 - Accept the Windows Error Reporting Terms of Use Agreement
This agreement grants usage rights for error reporting data collected by Microsoft. The data is to be used solely for resolving software problems.

Step 3 - Create User Accounts
Give your staff access to the feedback data.

Step 4 - Sign in and Map Your Files
WER collects data on your applications automatically, but needs to know which files are yours. Map your binary files online to start receiving your applications’ data.

Success Stories

Microsoft has benefited from Windows Error Reporting during the development and after product release. The Office product group fixed 50% of all reported errors in Service Pack 2. The Visual Studio product group fixed 74% of reported failures by Beta 1 for Visual Studio 2005. And the Windows product group fixed 29% of problems reported on Windows XP in Windows XP Service Pack 1.

Many ISVs have already signed up – we have over 1,900 already! We hear many wonderful stories of their successes in improving their code and reducing support costs.

Windows Error Reporting: Getting Started

Windows Error Reporting (WER) is a set of Windows technologies that capture software crash data and support end-user reporting of crash information. Through Winqual services, software and hardware vendors can access reports in order to analyze and respond to these problems. WER technologies are implemented in Windows XP and Microsoft Windows Server 2003 operating systems.

Vendors can use WER to view error reports at no charge. This service is available for all products, even those that do not qualify for the "Designed for Windows" logo—although we strongly recommend that you submit your products to the Windows Logo Program.

How to View Error Reports

Microsoft sorts error reports received through Windows Error Reporting into virtual "buckets." A bucket is a categorization of all instances of a specific error associated with a particular version of a driver, application, Windows feature, or other component.

You can use the Winqual website to view driver-specific, application-specific, or operating system-specific errors associated with your organization. Each error report provides details related to that bucket, and you can then request a file of the associated data.

To view error reports:

1.	Establish a Winqual account. To protect companies from impersonation and to ensure that the error reports go to a representative from the correct company, the Winqual Web site requires your company to have a valid VeriSign ID. • Check with your Legal Department; your company might already have a VeriSign ID (also called a Software Publisher's Digital ID for Authenticode). • Check on Winqual to see if your company already has an account.
2.	Accept the Windows Error Reporting Agreement.
3.	Sign in to the Winqual site.
4.	Click Windows Error Reports.

If you do not see your company's error reports, users of your products might not have submitted error reports to Microsoft. However, it might also be because Microsoft does not have sufficient information to match your company with error reports related to your products.

How to Map Files: Matching Error Reports with Your Company's Products

For you to be able to view error reports for your company's software, Microsoft needs to know which software associated with a specific bucket belongs to your organization. Making this connection in Windows Quality Online Services is referred to as "mapping files."

To associate particular error report buckets as belonging to your company:

1.	Complete the Request file mapping or Request file unmapping forms on the Winqual Web site. (Use the resources listed at the bottom of this page to find up-to-date directions.)
2.	When you are viewing the files associated with your organization, click a file name to add or remove a file from the list.

How System Manufacturers Can Obtain and Analyze System Data

System manufacturers can choose to include a special file, called a "marker file," on their systems. This file is used to help associate WER data with specific computer models, so that the manufacturer can view and analyze crash dumps from those systems.

To help system manufacturers identify and resolve issues related to kernel-mode error data, Microsoft can provide the following assistance:

•	Driver vendor and other developer support contacts.
•	Help facilitating discussions between vendors and manufacturers.
•	Data mining and trend analysis, upon request.

Minidump files can be made available on a case-by-case basis, based on the signed terms of use agreement. Driver vendors may also choose to share their minidumps directly with specific OEMs.

Windows Error Reporting

The error reporting feature enables users to notify Microsoft of application faults, kernel faults, and unresponsive applications. Microsoft can use the error reporting feature to provide customers with troubleshooting information, solutions, or updates for their specific problems. Developers can use this infrastructure to receive information that can be used to improve their applications.

Users can enable fault reporting through the Windows user interface. They can choose to report errors in various parts of the system or from specific applications. Administrators can override these settings using Group Policy.

Developers can register with Windows Quality Online Services to get information about the problems customers are experiencing with their applications and help customers fix these problems. Developers can also use Application Recovery and Restart to ensure that customers do not lose data when their application crashes and allow users to quickly return to their tasks.

Disable Error Reporting by Using a System Policy

To change the Application Error Reporting tool to not report errors by using a system policy, follow these steps:

1.	Start the System Policy Editor, and then make sure that the Office10.adm template is loaded.
2.	Double-click Default User profile.
3.	Expand Microsoft Office XP.
4.	Expand Corporate Error Reporting.
5.	Click to select the Disable application error reporting check box.
6.	Click to select the Check to enforce setting on; uncheck to enforce setting off check box.
7.	Click OK.

Test Changes in Error Reporting Configuration

To test the configuration of your Error Reporting Server, you can use the Office XP Application Recovery tool that is installed with Office XP. To do this, follow these steps:

1.	Star a Microsoft Office program.
2.	One the Start menu, point to All Programs, point to Microsoft Office Tools, and then click Microsoft Office Application Recovery.
3.	In the Microsoft Office Application Recovery box, select the program that you started in step 1, and then click Recover Application.

These steps will generate an application error. Additionally, you may be prompted to send an error repor

Disable Error Reporting by Changing a Registry Entry

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
To change the Application Error Reporting tool so that it does not report errors, follow these steps:

1.	Start Registry Editor (Regedit.exe).
2.	Locate and then click the following key in the registry: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\10.0\Common
3.	On the Edit menu, point to New, and then click DWORD Value.
4.	Type DWNeverUpload.
5.	Double-click the new value, type 1 in the Value data box, and then click OK.
6.	Quit Registry Editor.

How Windows Error Reporting Helps Customers

From Bill Gates at PDC 2003:
One thing that's been amazing at Microsoft is the impact that our monitoring data has had on how we prioritize our software work. I'm sure you've all seen in Windows XP that whenever an application or the system malfunctions, you get the ability to send a report back to Microsoft.

We get a lot of those reports, and we've created very good data-management systems to go in and look at those things, and therefore understand what drivers aren't reliable.

We allow anyone who has an application that runs on Windows to sign up and get the reports that relate to their application, and we've got winqual.microsoft.com where people can do that.

Today we've seen a lot of that activity from the driver manufacturers, but we want to see even more at the application level so it gets us working together on anything where a user is not having a great experience.

With data from Microsoft Windows Error Reporting (WER), you can identify the most common real-world customer problems and quickly provide a solution to your customers. While customer support calls provide information about common issues, they do not always provide enough detail to debug the actual code. Further, support records indicate only those problems which prompted calls. Because it is much easier for users to submit an error report than to contact customer support, WER can provide a more comprehensive picture of the problems your customers are having. And because WER collects data at the point of failure, you can get a more detailed picture of what is going wrong.

You can take advantage of WER to investigate the most frequently reported software crashes, resolve the problems, and inform your customers of the fixes, establishing a strong feedback loop with your customers.

Broad-based trend analysis of error reporting data shows that across all the issues that exist on the affected Windows platforms and the number of incidents received:

•	Fixing 20 percent of the top-reported bugs can solve 80 percent of customer issues.
•	Addressing 1 percent of the bugs would address 50 percent of the customer issues.

The same analysis results are generally true on a company-by-company basis.

The data that WER provides can show you the product problems that are causing your customers the most serious problems.

WER data is available to software vendors, hardware vendors, and system manufacturers. Microsoft does not charge for using the service, and your products do not need to have the "Designed for Windows" logo in order to use the WER service. However, you will need a valid Winqual account and a VeriSign ID.

How To Configure and Use Error Reporting in Windows XP

SUMMARY

There is an error reporting feature included with Windows XP that you can use to report computer and program errors to Microsoft. Microsoft can use your reports to track and fix problems with the operating system and with programs. This article describes how you can configure error reporting in Windows XP.

How to Configure and Use Error Reporting

You can enable, disable, or modify the way that error reporting works on a Windows XP-based computer. When an error occurs, a dialog box is displayed that prompts you to report the problem to Microsoft. If you want to report the problem, technical information about the problem is sent to Microsoft over the Internet. You must be connected to the Internet to use the feature. If a similar problem has been reported by other users and information about the problem is available, you receive a link to a Web page that contains information about the problem.

To access the settings for the reporting feature:

1.	Click Start.
2.	Right-click My Computer, then click Properties.
3.	Click the Advanced tab.
4.	Click Error Reporting.

To configure the error reporting feature:

•	By default, error reporting is enabled. To disable it, click Disable error reporting. To continue to be notified when errors occur without being prompted to report the errors, click to select the But notify me when critical errors occur check box.
•	Specify whether you want to use error reporting for the Windows operating system, for programs, or for both Windows and programs.
•	To report errors only for selected programs, click Choose Programs, click All programs in this list, and then click the programs that you do not want to include.
•	To add a program that is not listed, click Add, type the name of the program, or click Browse to find the program on your computer.
•	If many programs are listed, you may want to create an exclude list. In the Do not report errors for these programs box, click Add, type the name of each program that you want to exclude from error reporting, or click Browse to find the program on your computer.

NOTE: Because all error reports are confidential and anonymous, Microsoft Support Professionals do not have access to any error report that you send to Microsoft over the Internet by using the Error Reporting service. As a result, you need to send a Dr. Watson item for Windows log file to a support personnel by the method they prefer.