Windows Event ID 23 – Application Error: Application Hang Detection

Start by examining the specific details of Event ID 23 to identify the problematic application and gather initial diagnostic information.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter for Event ID 23 by right-clicking the Application log and selecting Filter Current Log
4. Enter 23 in the Event IDs field and click OK
5. Double-click on recent Event ID 23 entries to view detailed information
6. Record the application name, process ID, and hang duration from the event description
7. Note the timestamp to correlate with other system events or user reports

PowerShell provides powerful filtering and analysis capabilities for Event ID 23 occurrences across multiple time periods.

1. Open PowerShell as Administrator
2. Query recent Event ID 23 occurrences with detailed information:

   Get-WinEvent -FilterHashtable @{LogName='Application'; Id=23} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

3. Analyze patterns by grouping events by application:

   Get-WinEvent -FilterHashtable @{LogName='Application'; Id=23} -MaxEvents 100 | ForEach-Object { if ($_.Message -match 'Program: (.+?)\s') { $matches[1] } } | Group-Object | Sort-Object Count -Descending

4. Export detailed event data for further analysis:

   Get-WinEvent -FilterHashtable @{LogName='Application'; Id=23; StartTime=(Get-Date).AddDays(-7)} | Export-Csv -Path "C:\Temp\HangEvents.csv" -NoTypeInformation

5. Check for correlation with system performance:

   Get-Counter "\Process(*)\% Processor Time" -SampleInterval 5 -MaxSamples 12

Use built-in Windows tools to monitor the problematic application's resource consumption and identify the root cause of hangs.

1. Open Task Manager (Ctrl + Shift + Esc) and navigate to the Details tab
2. Locate the application mentioned in Event ID 23 and monitor its CPU, Memory, and Handle count
3. Launch Resource Monitor by clicking Open Resource Monitor in Task Manager
4. In Resource Monitor, switch to the CPU tab and monitor the application's thread activity
5. Check the Memory tab for memory leaks or excessive private bytes usage
6. Use Performance Monitor to create a custom data collector set:

   logman create counter "AppHangMonitor" -f csv -o "C:\Temp\AppPerf.csv" -c "\Process(YourApp)\*" -si 10

7. Start the data collection:

   logman start "AppHangMonitor"

8. Allow monitoring during typical application usage, then stop collection:

   logman stop "AppHangMonitor"

Implement advanced debugging techniques to capture detailed information about application hangs for root cause analysis.

1. Configure Windows Error Reporting to capture hang dumps by modifying the registry:

   New-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Name "DumpType" -Value 2 -PropertyType DWord -Force

2. Set the dump folder location:

   New-ItemProperty -Path "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps" -Name "DumpFolder" -Value "C:\CrashDumps" -PropertyType String -Force

3. Create the dump directory:

   New-Item -Path "C:\CrashDumps" -ItemType Directory -Force

4. Enable hang reporting for specific applications:

   New-Item -Path "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\YourApp.exe" -Force

5. Install Windows SDK and use Application Verifier:

   appverif.exe -enable Heaps Handles Locks -for YourApp.exe

6. Configure ProcDump to capture hangs automatically:

   procdump.exe -h YourApp.exe C:\CrashDumps\

7. Monitor hang detection sensitivity in the registry:HKLM\SYSTEM\CurrentControlSet\Control\Session Manager

Deploy comprehensive strategies to prevent application hangs and improve overall system stability.

1. Update all applications to their latest versions and install pending Windows updates:

   Get-WindowsUpdate -Install -AcceptAll -AutoReboot

2. Configure application compatibility settings for problematic programs:

   Set-ProcessMitigation -Name "YourApp.exe" -Enable DEP,SEHOP,ForceRelocateImages

3. Optimize system virtual memory settings:

   $cs = Get-WmiObject -Class Win32_ComputerSystem; $cs.AutomaticManagedPagefile = $false; $cs.Put()

4. Implement application restart policies using Task Scheduler or service recovery options
5. Configure system file checker to run regularly:

   sfc /scannow

6. Set up automated monitoring with PowerShell scripts:

   Register-WmiEvent -Query "SELECT * FROM Win32_NTLogEvent WHERE LogFile='Application' AND EventCode=23" -Action { Write-Host "Application hang detected at $(Get-Date)" }

7. Implement application pool recycling for web applications and configure service restart policies
8. Review and optimize antivirus exclusions for frequently hanging applications