How to fix Windows Error Reporting Event ID 1001?

Event ID 1001 is not an error of its own: it is the line Windows writes when it files a problem report, or after it restarts from a blue screen. The real fault is named inside the entry. Open it in Event Viewer, read the source and the Event Name, and fix the app or driver it points to.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What Windows Error Reporting Event ID 1001 means

Windows Error Reporting (WER) is the part of Windows that collects data when something fails. Microsoft describes it as the feature that lets users notify Microsoft of "application faults, kernel faults, unresponsive applications, and other application specific problems". Each time WER files such a report, it writes Event ID 1001 to the Application log. So the event is a receipt, not the failure.

The number 1001 is also used by other sources. The one that worries people most is BugCheck in the System log, with the text "The computer has rebooted from a bugcheck." That one means a blue screen happened. The picture shows how to tell them apart.

A typical Windows Error Reporting entry (shortened)

Log Name: Application
Source: Windows Error Reporting
Event ID: 1001
Level: Information
Fault bucket <number>, type <number>
Event Name: APPCRASH
Response: Not available
Problem signature:
P1: <the program, for example app.exe>
P4: <the module that faulted, for example a .dll>
Attached files:
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\<report folder>

• Event Name is the kind of report: APPCRASH, AppHangB1, BEX64, LiveKernelEvent, BlueScreen and others.
• P1 is the program the report is about. For an app crash, P4 is the module where it failed and P7 the exception code.
• Fault bucket is the group Microsoft sorts the report into. It is useful to support, not to you.
• These files may be available here gives the folder with the report files, under C:\ProgramData\Microsoft\Windows\WER.

Why Event ID 1001 appears: causes ranked

Because 1001 only records a report, its causes are the causes of the failure it reports. The table orders them by what the entries we read show most, and ties each one to a fix on this page.

How to fix Event ID 1001

Fix 1 tells you which kind of 1001 you have and what it names. Fix 2 solves most app crash reports. Fixes 3 and 4 are for blue screens and driver failures. Fixes 5 to 7 are for crashes that move between apps. Do them in order and check Reliability Monitor after each one.

Fix 1. Open the Event ID 1001 entry and read its source, Event Name and P1

5 minutesNo riskEveryone, before changing anything: the entry names what failed.

Event ID 1001 is a record written after a report. Microsoft notes that the event properties of a bug check list its four stop code parameters, and a WER entry lists the program and module in its problem signature. Reading them tells you which fix applies.

1. Press Win + R, type eventvwr and press Enter.
2. Expand Windows Logs and select Application. Select Filter Current Log on the right, type 1001 in the <All Event IDs> box and select OK.
3. Open an entry with the source Windows Error Reporting. Write down the Event Name, P1 and, for APPCRASH, P4 and P7.
4. Look at the entry just before it. An Event ID 1000 with source Application Error shows the same app and module in plain words.
5. Now select System under Windows Logs and filter it for 1001 the same way. An entry with the source BugCheck shows the stop code after "The bugcheck was:".
6. For a timeline, press Win + R, type perfmon /rel and press Enter. Red marks show the days with crashes; View technical details opens the same report.

Fix 2. Update, repair or reinstall the app named in P1

15 minutesLow riskEvent Name APPCRASH, AppHangB1 or BEX64, with the same app in P1 each time.

An app crash report means the app itself failed, so the app is what needs fixing. A newer version often contains the fix, and a repair or reinstall replaces damaged program files and settings.

1. Update the app from inside it, from the Microsoft Store library, or from its maker's site. Restart the PC and try again.
2. If the crash began right after an app update, check the maker's site or forum for a known issue with that version.
3. For a Store app or an app with a Repair option, open Settings > Apps > Installed apps, select the three dots next to the app and open Advanced options. Select Repair, then Reset if that did not help. On Windows 10 the list is under Settings > Apps > Apps & features.
4. If P4 names a plug-in or add-on .dll of the app, start the app without add-ons, or remove the newest one.
5. If nothing helped, uninstall the app, restart, and install the newest version from its maker.

Full steps with screenshots: How to repair or reset an app in Windows and Uninstall a program or app in Windows. If P1 is a game, verify its files in the game launcher first: How to verify game files in Steam, Epic Games, Xbox app, EA app, Battle.net and GOG Galaxy. If P4 names a Microsoft runtime such as a msvcp or vcruntime file, repair the Visual C++ packages: How to repair Microsoft Visual C++ Redistributable and .NET Framework.

Fix 3. Update or roll back the driver behind a BugCheck or LiveKernelEvent 1001

20 minutesLow riskSource BugCheck, Event Name BlueScreen or LiveKernelEvent, or a blue screen you saw yourself.

Microsoft estimates that about three quarters of stop code errors are caused by faulty drivers. The bugcheck code in the 1001 entry tells you which kind of failure it was, and its date tells you which driver change to undo.

1. Copy the code after "The bugcheck was:", for example 0x0000009f. Drop the leading zeros: that is stop code 0x9F, which Microsoft lists in its bug check code reference with its name.
2. Think back: did the blue screens start after a new driver, a Windows update or a new device? That driver is the first suspect.
3. Right-click Start and select Device Manager. Open the device you suspect, for example under Display adapters, and open the Driver tab.
4. If the crashes began after a driver update, select Roll Back Driver. Otherwise download the newest driver from the device or PC maker and install it.
5. Install the newest BIOS and chipset driver from the motherboard or PC maker's support page. Follow its instructions exactly.
6. Use the PC normally for a few days and check the System log for a new BugCheck 1001.

Device Manager steps for every case: Update, roll back or reinstall a driver. For a LiveKernelEvent, the code tells you more: see LiveKernelEvent 124 for a hardware error that Windows survived.

Fix 4. Make sure Windows can save the crash dump

10 minutesLow riskA BugCheck 1001 without a dump path, an empty C:\Windows\Minidump folder, or a paging file you turned off.

A BugCheck 1001 entry normally ends with "A dump was saved in:" and a path. That dump is what a technician opens with WinDbg and !analyze. Windows writes it through the paging file on the system drive, so a removed paging file or a full drive leaves you without evidence.

1. Press Win + R, type sysdm.cpl and press Enter. Open the Advanced tab.
2. Under Performance, select Settings, open the Advanced tab and select Change under Virtual memory.
3. Tick Automatically manage paging file size for all drives, or make sure drive C: has System managed size. Select OK.
4. Back on the Advanced tab of System Properties, select Settings under Startup and Recovery.
5. Under Write debugging information, choose Automatic memory dump or Small memory dump. Note the folder shown for the dump.
6. Free some space on drive C: if it is almost full: Free up disk space and delete temporary files. Restart the PC.

Fix 5. Start Windows with a clean boot to find a program that interferes

30 minutesLow riskDifferent apps crash, or P4 names the same third-party module in several reports.

Overlays, tuning tools and security suites load their modules into other programs. When one of them fails, WER files the report under the app that crashed, not under the program that caused it. A clean boot removes them for a test.

1. Search the web for the module name in P4. If it belongs to a program you installed, update or remove that program first.
2. Otherwise run a clean boot: press Win + R, type msconfig, open Services, tick Hide all Microsoft services and select Disable all.
3. Open the Startup tab, select Open Task Manager and disable every startup app. Restart.
4. Use the apps that crashed. If they work, turn the services back on in halves until the crash returns.
5. When you find the program, update or uninstall it, then undo the clean boot in msconfig.

Full steps and how to undo them: How to perform a clean boot in Windows. If your security suite is the suspect, pause it for one test only and turn it back on: Turn off Microsoft Defender protection for a moment.

Fix 6. Test the memory and remove overclocks

30 minutes to several hoursNo riskMany apps crash, blue screens show different stop codes, or the PC uses XMP, EXPO or an overclock.

Bad memory corrupts whatever program uses it, so the 1001 reports name a different app or stop code each time. That pattern is the sign to test the hardware rather than reinstall apps.

1. Save your work. Press Win + R, type mdsched.exe and press Enter.
2. Select Restart now and check for problems (recommended). For a deeper test, press F1 on the blue test screen, choose Extended and press F10.
3. After Windows starts, open Event Viewer and look in the System log for MemoryDiagnostics-Results.
4. If you use XMP, EXPO or an overclock, load the BIOS defaults and see whether the 1001 entries stop.
5. If the test finds errors, test one memory module at a time to find the faulty one.

Steps with screenshots: How to test your RAM with Windows Memory Diagnostic.

Fix 7. Repair Windows system files with DISM and SFC

30 to 60 minutesLow riskWindows parts such as Explorer crash, or you did Fixes 2 to 6 and want to exclude Windows.

When P1 or P4 names a Windows file, a damaged system file can be the cause. DISM repairs the Windows image and SFC then replaces damaged files from it. It is last because it rarely helps with a third-party app crash.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

1. Run DISM and SFC as the procedure shows, then restart.
2. On Windows 11, if errors remain, open Settings > System > Recovery and select Reinstall now next to Fix problems using Windows Update. It keeps your files and apps: Reinstall Windows without losing files.

If Event ID 1001 keeps coming back: collect the evidence

At this point the app is current, the drivers are updated or rolled back, the memory passed and Windows is repaired. What is left is to give the maker of the app, the PC or the part the files that prove what happens.

• The entries. In Event Viewer, filter for 1001 and select Save Filtered Log File As to export them.
• The report files. Copy the folder named under "These files may be available here", inside C:\ProgramData\Microsoft\Windows\WER\ReportArchive or ReportQueue.
• Blue screen dumps. Zip C:\Windows\Minidump and, if present, C:\Windows\MEMORY.DMP. A technician opens them in WinDbg with !analyze -v.
• App crash dumps. Windows can keep a full dump of each app crash. This setting is off by default and is described below.

Microsoft documents the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps. Create it, and Windows saves crash dumps to %LOCALAPPDATA%\CrashDumps, keeping 10 by default. Add the value DumpType (DWORD) set to 2 for a full dump. Delete the key when support has the files.

How to keep Event ID 1001 entries from coming back

Event ID 1001 entries from Windows Error Reporting will still appear now and then on a healthy PC, because every app crash and some background failures create one. A single entry is not a reason to act. A pattern is: the same app, the same module or the same stop code week after week.

Frequently asked questions

What is Event ID 1001?

It is the entry Windows writes when Windows Error Reporting files a problem report, or, from the source BugCheck, when the PC has restarted after a blue screen. The WER entry sits in the Application log at level Information and lists the kind of report (Event Name), the program (P1) and where the report files are. The BugCheck entry sits in the System log at level Error and gives the stop code and the dump path. In both cases the event is a record of a failure, and the fix belongs to the program, driver or part it names.

Is Windows Error Reporting Event ID 1001 harmful?

The entry itself is harmless: it is only a record that a report was made. What it describes can matter. An APPCRASH or AppHangB1 report means an app failed, and a BugCheck entry means Windows stopped with a blue screen. If the 1001 entries name a Windows component, nothing on your PC crashes and you do not notice any problem, you can leave them. If an app closes, the PC freezes or restarts, read the entry and follow the fix it points to.

What does "The computer has rebooted from a bugcheck" mean?

It means Windows hit a stop error, showed a blue screen and restarted. A bugcheck is Microsoft's name for that stop. The entry has the source BugCheck and Event ID 1001 in the System log, and gives the stop code with its four parameters after "The bugcheck was:". It usually ends with "A dump was saved in:" and a path, often C:\Windows\MEMORY.DMP or a file in C:\Windows\Minidump. Look up the stop code in Microsoft's bug check code reference, then follow Fix 3 on this page.

Why do I have so many Event ID 1001 entries?

Every report Windows files creates one entry, so a single app that crashes on every start fills the log quickly. Look at P1 in several entries. If it is the same app each time, fix that app (Fix 2). If it changes, look at P4 for a shared module (Fix 5) or test the memory (Fix 6). Some entries also come from background tasks that failed quietly and do not affect you. Turning off error reporting hides the entries but does not stop the failures behind them.

Can I turn off Windows Error Reporting to stop Event 1001?

You can limit what Windows sends to Microsoft in the privacy settings, and administrators can control WER with Group Policy, as Microsoft notes. It is not a fix. The app or driver that fails keeps failing, and you lose the record that tells you which one it is. Microsoft also states that local crash dumps work independently of the rest of WER. Fix the cause the entry names instead, and the entries stop on their own.

What is LiveKernelEvent in an Event ID 1001 entry?

It means a driver or a device failed but Windows recovered without a blue screen, and took a memory snapshot called a live dump. The code that follows tells you which kind: 141 and 117 are graphics driver timeouts, while 124 is a hardware error reported by the processor, memory or a PCI Express device. Start with the graphics driver (Fix 3). For code 124, read our guide on LiveKernelEvent 124, because the fix there is in the BIOS settings and the hardware.

What is Wininit Event ID 1001?

It is a different event with the same number. When Windows runs a disk check during startup, it writes the result to the Application log as Event ID 1001 with the source Wininit. The text shows what the check found and fixed on the drive. It is not a crash report. If the text says it found and fixed errors more than once, check the drive's health and back up your files. If it says no problems were found, nothing needs to be done. Steps for checking a disk: Check a disk for errors (chkdsk).

What is error ID 1001 in Quick Heal?

That is a code of the Quick Heal security program, not the Windows event this page covers. Programs may use 1001 for their own messages, and the meaning is decided by their maker. We could not confirm from Quick Heal what its error 1001 means. Open the message or the program's log to read the full text, update Quick Heal, and contact its support with that text. If Quick Heal's own module appears in P4 of Windows Error Reporting entries, Fix 5 on this page shows how to test it.

What is "Error 1001. Exception occurred while initializing the installation"?

That message comes from a program installer, not from Event Viewer. In setups built with Windows Installer, error 1001 is shown when a custom step of the setup fails, often one that needs the .NET Framework. Run the installer as administrator, make sure the .NET versions it needs are installed and repaired (How to repair Microsoft Visual C++ Redistributable and .NET Framework), and download a fresh copy from the maker. If it still fails, send the maker the full message, because only the maker knows which step of its setup fails.

Is Event ID 7001 the same as Event ID 1001?

No. Event ID 7001 comes from the Service Control Manager in the System log and says that one Windows service could not start because a service it depends on failed. The entry names both services. Start with the service that failed first: find it in an earlier 7000 or 7009 entry, then check whether it is turned off or broken. Our guide to Event ID 7000 covers that first failure. It has nothing to do with crash reports.