Windows Event ID 1004 – Application Error: Application Crash or Hang Detection

Start by examining the specific details of Event ID 1004 to identify the failing application and fault module.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter for Event ID 1004 by right-clicking Application → Filter Current Log
4. Enter 1004 in the Event IDs field and click OK
5. Double-click the most recent Event ID 1004 entry to view details
6. Record the Faulting application name, Faulting module name, and Exception code
7. Note the application path and version information for further investigation

Use PowerShell to extract multiple Event ID 1004 entries for pattern analysis:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1004} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Verify application compatibility with current Windows version and check for available updates.

1. Identify the failing application from Event ID 1004 details
2. Right-click the application executable and select Properties
3. Navigate to the Compatibility tab
4. Check if compatibility mode is enabled for older Windows versions
5. Try running the application as administrator by checking Run this program as an administrator
6. Visit the software vendor's website to check for updates or patches
7. Use Windows Update to ensure system components are current:

Get-WindowsUpdate -AcceptAll -Install -AutoReboot

Check for pending Windows updates that might resolve compatibility issues:

Get-WUList | Where-Object {$_.Title -like "*Compatibility*" -or $_.Title -like "*Application*"}

Analyze system resources and memory usage patterns that might contribute to application crashes.

1. Open Performance Monitor by running perfmon.msc
2. Create a new Data Collector Set for application monitoring
3. Add counters for Memory\Available MBytes, Process\Working Set, and Process\Handle Count
4. Monitor the failing application during normal operation
5. Check system memory usage with PowerShell:

Get-Counter "\Memory\Available MBytes", "\Memory\Committed Bytes", "\Paging File(_Total)\% Usage" -SampleInterval 5 -MaxSamples 10

Analyze memory dumps if available:

Get-ChildItem -Path "C:\Windows\Minidump" -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

Check for memory-related issues in System log:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001,1003,41} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Check for driver conflicts and system file corruption that might cause application instability.

1. Run System File Checker to identify corrupted system files:

sfc /scannow

2. Check DISM for Windows image health:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

3. Verify driver integrity and check for problematic drivers:

Get-WindowsDriver -Online | Where-Object {$_.DriverSignature -eq "NotSigned" -or $_.DriverDate -lt (Get-Date).AddYears(-2)} | Format-Table DriverSignature, DriverDate, OriginalFileName

Check for driver-related events that correlate with application crashes:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=219,1001,1003} -MaxEvents 30 | Where-Object {$_.TimeCreated -gt (Get-Date).AddDays(-7)} | Format-Table TimeCreated, Id, Message -Wrap

Review recently installed drivers:

Get-WinEvent -FilterHashtable @{LogName='Setup'; Id=2} -MaxEvents 20 | Format-Table TimeCreated, Message -Wrap

Implement comprehensive monitoring and debugging for persistent application crash issues.

1. Enable Application Experience service for enhanced crash reporting:

Set-Service -Name "AeLookupSvc" -StartupType Automatic
Start-Service -Name "AeLookupSvc"

2. Configure Windows Error Reporting for detailed crash dumps:

New-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name "DontShowUI" -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Name "DumpType" -Value 2 -PropertyType DWORD -Force

3. Set up Process Monitor (ProcMon) filtering for the failing application
4. Configure Application Verifier for detailed debugging:

appverif.exe -enable Heaps Handles Locks -for YourApplication.exe

Create a PowerShell monitoring script for automated Event ID 1004 tracking:

$Action = {
    $Event = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1004} -MaxEvents 1
    $AppName = ($Event.Message -split '\n')[0] -replace 'Faulting application name: ', ''
    Send-MailMessage -To "admin@company.com" -Subject "Application Crash: $AppName" -Body $Event.Message -SmtpServer "mail.company.com"
}
Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Application' AND EventCode=1004" -Action $Action