Windows Event ID 1002 – Application Error: Application Hang Detection

Start by examining the specific details of the hang event to identify the problematic application and gather initial diagnostic information.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter for Event ID 1002 by right-clicking the Application log and selecting Filter Current Log
4. Enter 1002 in the Event IDs field and click OK
5. Double-click the most recent Event ID 1002 entry to view detailed information
6. Note the application name, process ID, and hang duration from the event description
7. Check the Details tab for additional technical information including stack traces

Use PowerShell to query multiple hang events for pattern analysis:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1002} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Use built-in Windows tools to monitor the problematic application's resource usage and identify performance bottlenecks causing hang conditions.

1. Launch Resource Monitor by typing resmon.exe in the Start menu
2. Click the CPU tab and locate the hanging application in the processes list
3. Check the Average CPU column for unusually high or zero CPU usage patterns
4. Switch to the Memory tab and examine the application's memory consumption
5. Review the Disk tab for excessive I/O operations that might cause blocking
6. Monitor the Network tab for applications waiting on network responses

Use Performance Monitor to create custom counters for the specific application:

# Create a custom performance counter set for application monitoring
$counterSet = @(
    "\Process(ApplicationName)\% Processor Time",
    "\Process(ApplicationName)\Working Set",
    "\Process(ApplicationName)\Handle Count",
    "\Process(ApplicationName)\Thread Count"
)
Get-Counter -Counter $counterSet -SampleInterval 5 -MaxSamples 60

Enable detailed crash dump collection and configure WER settings to capture comprehensive diagnostic information for hang analysis.

1. Open Registry Editor as administrator by typing regedit in the Start menu
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
3. Create a new DWORD value named DontShowUI and set it to 1 to prevent user prompts
4. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps
5. Create a new key with the exact name of the problematic executable (e.g., notepad.exe)
6. Within this key, create the following DWORD values:
   • DumpType = 2 (full dump)
   • DumpCount = 5 (keep 5 dumps)
   • DumpFolder = C:\CrashDumps (REG_EXPAND_SZ)

Use PowerShell to configure WER settings programmatically:

# Enable application-specific crash dump collection
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\YourApp.exe"
New-Item -Path $regPath -Force
Set-ItemProperty -Path $regPath -Name "DumpType" -Value 2 -Type DWord
Set-ItemProperty -Path $regPath -Name "DumpCount" -Value 5 -Type DWord
Set-ItemProperty -Path $regPath -Name "DumpFolder" -Value "C:\CrashDumps" -Type ExpandString

Create the dump folder and set appropriate permissions:

New-Item -Path "C:\CrashDumps" -ItemType Directory -Force
icacls "C:\CrashDumps" /grant "Everyone:(OI)(CI)F"

Investigate application dependencies, compatibility settings, and potential conflicts that may cause hang conditions in modern Windows environments.

1. Use Dependency Walker or PowerShell to analyze application dependencies:

# Get loaded modules for a running process
$processName = "YourApplication"
Get-Process -Name $processName | Select-Object -ExpandProperty Modules | Select-Object ModuleName, FileName, FileVersionInfo

2. Check application compatibility settings by right-clicking the executable and selecting Properties → Compatibility
3. Test with different compatibility modes (Windows 8, Windows 10) if the application is older
4. Disable visual themes and desktop composition temporarily to isolate graphics-related issues
5. Run the application as administrator to eliminate permission-related hang causes

Use Application Compatibility Toolkit (ACT) for enterprise environments:

# Query application compatibility database
sdbinst -q -n "YourApplication.exe"

# Check for known compatibility fixes
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" | Where-Object { $_.PSChildName -like "*YourApplication*" }

Perform deep diagnostic analysis using advanced tools to identify the root cause of application hangs through system call tracing and memory analysis.

1. Download and run Process Monitor (ProcMon) from Microsoft Sysinternals
2. Set filters to monitor only the problematic application:
   • Process and Thread Activity: Include process name
   • File System Activity: Include process name
   • Registry Activity: Include process name
3. Reproduce the hang condition while ProcMon captures system activity
4. Analyze the last operations before the hang occurs, looking for:
   • Failed file or registry operations
   • Infinite loops in system calls
   • Blocked I/O operations

Use Windows Performance Toolkit (WPT) for advanced analysis:

# Start ETW tracing for application hang analysis
wpr -start GeneralProfile -start CPU -start FileIO -start Registry

# Reproduce the hang condition, then stop tracing
wpr -stop C:\Traces\AppHang.etl

# Analyze with Windows Performance Analyzer
wpa C:\Traces\AppHang.etl

Create a custom PowerShell script for automated hang detection:

# Monitor for application hangs and collect diagnostic data
function Monitor-ApplicationHang {
    param([string]$ProcessName, [int]$TimeoutSeconds = 30)
    
    while ($true) {
        $process = Get-Process -Name $ProcessName -ErrorAction SilentlyContinue
        if ($process) {
            $responding = $process.Responding
            if (-not $responding) {
                Write-Host "Hang detected for $ProcessName at $(Get-Date)"
                # Collect memory dump
                $dumpPath = "C:\Dumps\$ProcessName-$(Get-Date -Format 'yyyyMMdd-HHmmss').dmp"
                Start-Process -FilePath "tasklist" -ArgumentList "/svc /fi `"PID eq $($process.Id)`"" -Wait
            }
        }
        Start-Sleep -Seconds $TimeoutSeconds
    }
}