How to Clear the Windows Error Reporting (WER) Cache via PowerShell

The Telemetry Bloat

Whenever a Windows application crashes—whether it’s Microsoft Word or a third-party background service—the operating system quietly intercepts the crash. It generates a massive memory dump file (often several gigabytes in size) and queues it for transmission to Microsoft via the Windows Error Reporting (WER) service. This telemetry data helps developers identify and fix bugs.

However, if a specific service is trapped in a crash-loop (e.g., crashing and restarting every 10 seconds), the WER service will rapidly generate hundreds of memory dumps. This can catastrophically fill a server’s C: drive overnight, dropping the free space to 0 bytes and causing the entire operating system to freeze.

Before you can resolve the underlying application crash, you must immediately reclaim the disk space by forcefully purging the WER Cache via PowerShell.

Locating the WER Caches

Windows isolates error reporting files into two highly protected system directories:

1. C:\ProgramData\Microsoft\Windows\WER\ReportQueue\ (System-level crashes waiting to be uploaded)
2. C:\ProgramData\Microsoft\Windows\WER\ReportArchive\ (Historical crash data)

Because these directories are heavily locked down by the SYSTEM account, you cannot easily delete the files using the GUI File Explorer without changing NTFS ownership.

Purging the Cache via PowerShell

You must open an elevated PowerShell session as an Administrator to bypass the NTFS restrictions.

Step 1: Stopping the WER Service

Before deleting the files, you must stop the WER service (WerSvc) so it releases its lock on the memory dump files.

Stop-Service -Name WerSvc -Force

Step 2: Obliterating the Report Directories

Use PowerShell to recursively delete all contents within the Queue and Archive directories. The -Force and -Recurse flags will bypass standard permissions.

$WER_Queue = "C:\ProgramData\Microsoft\Windows\WER\ReportQueue"
$WER_Archive = "C:\ProgramData\Microsoft\Windows\WER\ReportArchive"

if (Test-Path $WER_Queue) { Remove-Item -Path "$WER_Queue\*" -Recurse -Force -ErrorAction SilentlyContinue }
if (Test-Path $WER_Archive) { Remove-Item -Path "$WER_Archive\*" -Recurse -Force -ErrorAction SilentlyContinue }

Step 3: Restarting the Service

Once the disk space is reclaimed, restart the service to allow Windows to function normally.

Start-Service -Name WerSvc

Disabling WER Permanently (For High-Availability Servers)

If you are managing a mission-critical SQL server and you absolutely cannot risk a telemetry process filling the hard drive, you can permanently disable Windows Error Reporting using PowerShell to manipulate the Registry.

# Disable Windows Error Reporting globally
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name "Disabled" -Value 1 -Type DWord

By changing this registry key to 1, Windows will still register application crashes in the Event Viewer for IT debugging, but it will completely cease generating and caching the massive gigabyte-sized memory dump files, permanently protecting the server’s storage capacity.