How to Clear the Windows Error Reporting (WER) Archive using PowerShell

The Silent Archive

Whenever an application crashes in Windows (whether it is an IIS worker process, a massive SQL database, or a simple instance of Notepad), the operating system automatically generates an error report. This report often contains a “minidump” or a full memory dump—a snapshot of everything that was residing in the RAM at the exact millisecond the crash occurred. These files are collected by the Windows Error Reporting (WER) service.

If you are actively debugging a proprietary application, these dumps are invaluable. However, if a server has been running for three years and experiencing occasional crashes, the WER archive can silently balloon to dozens of gigabytes. Because memory dumps are highly incompressible raw binary data, they can quickly consume the entire system drive (C: drive), bringing the server to a grinding halt.

To safely reclaim this disk space without corrupting the active operating system, you must forcefully clear the WER archive using PowerShell.

Locating the WER Archive

WER files are stored in a hidden, heavily protected system directory. The primary archive is located at:

C:\ProgramData\Microsoft\Windows\WER\ReportArchive

A secondary queue (for reports waiting to be sent to Microsoft) is located at ReportQueue in the same directory.

Clearing the Archive using PowerShell

Because these directories are owned by the SYSTEM account, standard users (and even basic administrators operating in a non-elevated context) will be denied access to delete the files.

You must open PowerShell with Run as Administrator privileges.

To forcefully delete the contents of both the Archive and the Queue, execute the following script:

# Stop the Windows Error Reporting Service to unlock active files
Stop-Service -Name WerSvc -Force

# Delete the Archive folder contents
Remove-Item -Path "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\*" -Recurse -Force

# Delete the Queue folder contents
Remove-Item -Path "C:\ProgramData\Microsoft\Windows\WER\ReportQueue\*" -Recurse -Force

# Restart the service
Start-Service -Name WerSvc

This script halts the telemetry engine, aggressively deletes every memory dump and XML report inside the directories (using the -Recurse flag to wipe subfolders), and then restarts the engine.

Disabling WER Permanently (Optional)

If you are managing a locked-down production server where you absolutely never intend to send diagnostic data to Microsoft, you can prevent the WER archive from ever filling up again by disabling the service entirely via the registry.

You can execute this single PowerShell command to flip the registry key:

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name "Disabled" -Value 1 -Type DWord

Once disabled, Windows will still log a standard event in the Event Viewer when an application crashes, but it will no longer generate the massive, space-consuming memory dump files on the hard drive.