Windows Event ID 24 – Application Error: Application Hang Detection

Start by examining the specific details of Event ID 24 to identify the problematic application and gather initial diagnostic information.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter for Event ID 24 using the filter option in the Actions pane
4. Double-click the most recent Event ID 24 to view details
5. Note the application name, process ID, and hang duration from the event description
6. Use PowerShell to gather additional events for the same application:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=24} -MaxEvents 50 | Where-Object {$_.Message -like "*YourAppName*"} | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Review the pattern of hang events to determine if this is a recurring issue or isolated incident. Check if the hangs correlate with specific times, user actions, or system events.

Investigate the application's resource consumption and performance characteristics to identify potential causes of the hang condition.

1. Open Task Manager and switch to the Details tab
2. Locate the problematic application process and monitor its CPU, memory, and disk usage
3. Use Performance Monitor to create a custom data collector set:

# Create performance counter collection for the application
$appName = "YourApplication.exe"
logman create counter AppHangMonitor -f csv -o "C:\Logs\AppPerf.csv" -c "\Process($appName)\% Processor Time" "\Process($appName)\Working Set" "\Process($appName)\Handle Count" "\Process($appName)\Thread Count" -si 5

4. Start the data collection and reproduce the hang condition if possible:

logman start AppHangMonitor

5. Use Process Monitor (ProcMon) to capture file and registry access patterns during application startup and operation
6. Check for excessive file I/O, registry access, or network activity that might cause responsiveness issues
7. Stop data collection after gathering sufficient information:

logman stop AppHangMonitor

Enable detailed hang reporting and configure debugging options to capture more information about application hang conditions.

1. Configure Windows Error Reporting to capture hang dumps by modifying the registry:

# Enable hang reporting for all applications
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs" -Name "DumpType" -Value 2 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs" -Name "DumpCount" -Value 3 -Type DWord

2. For specific applications, create a dedicated registry key:

# Replace YourApp.exe with the actual application name
$appPath = "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\YourApp.exe"
New-Item -Path $appPath -Force
Set-ItemProperty -Path $appPath -Name "DumpType" -Value 2 -Type DWord
Set-ItemProperty -Path $appPath -Name "DumpFolder" -Value "C:\HangDumps" -Type String

3. Create the dump folder and set appropriate permissions:

New-Item -Path "C:\HangDumps" -ItemType Directory -Force
# Grant full control to SYSTEM and Administrators
icacls "C:\HangDumps" /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F"

4. Install Windows SDK or Debugging Tools for Windows to analyze dump files
5. Configure application-specific debugging if the application supports it through configuration files or command-line parameters

Apply compatibility settings and environmental changes to resolve common causes of application hangs.

1. Check and apply Windows compatibility settings for the problematic application:

# Query current compatibility settings
Get-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" -ErrorAction SilentlyContinue

2. Apply compatibility mode if the application is older:
3. Right-click the application executable → Properties → Compatibility tab
4. Enable Run this program in compatibility mode and select appropriate Windows version
5. Check Disable fullscreen optimizations and Run as administrator if needed
6. Configure DEP (Data Execution Prevention) exceptions if required:

# Add DEP exception (requires admin privileges)
bcdedit /set nx OptIn
# Or for specific application
bcdedit /set nx AlwaysOff

6. Disable antivirus real-time scanning for the application folder temporarily to test if it resolves hangs
7. Update application to the latest version and check vendor knowledge base for known hang issues
8. Configure application-specific environment variables if documented by the vendor:

# Example: Set environment variables for Java applications
[Environment]::SetEnvironmentVariable("_JAVA_OPTIONS", "-Xmx2048m -XX:+UseG1GC", "User")

Perform deep system analysis to identify underlying causes of application hangs that may be related to system configuration or hardware issues.

1. Use Windows Performance Toolkit (WPT) to capture detailed system traces during hang conditions:

# Install WPT from Windows SDK, then capture trace
wpr -start GeneralProfile -start CPU -start DiskIO
# Reproduce the hang condition
wpr -stop C:\Traces\HangTrace.etl

2. Analyze system event logs for correlating events around hang times:

# Get system events around hang time (adjust time range as needed)
$hangTime = Get-Date "2026-03-18 14:30:00"
$startTime = $hangTime.AddMinutes(-5)
$endTime = $hangTime.AddMinutes(5)
Get-WinEvent -FilterHashtable @{LogName='System'; StartTime=$startTime; EndTime=$endTime} | Where-Object {$_.LevelDisplayName -eq "Error" -or $_.LevelDisplayName -eq "Warning"}

3. Check for driver issues and hardware problems:

# Check for driver verifier issues
verifier /query
# Review hardware events
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-General'} -MaxEvents 20

4. Analyze memory dumps using WinDbg if hang dumps were captured:
5. Load the dump file in WinDbg and use commands like !analyze -hang and ~*kb to examine thread states
6. Check for system resource exhaustion:

# Monitor system handles and memory
Get-Counter "\Process(_Total)\Handle Count", "\Memory\Available MBytes", "\Memory\Pool Nonpaged Bytes" -SampleInterval 5 -MaxSamples 12

7. Review Windows Update history and recent system changes that might correlate with hang occurrences:

# Get recent Windows updates
Get-HotFix | Where-Object {$_.InstalledOn -gt (Get-Date).AddDays(-30)} | Sort-Object InstalledOn -Descending