Windows Event ID 27 – Application Error: Application Hang Detection

Start by examining the specific Event ID 27 entries to identify patterns and affected applications:

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Application
3. Filter the log by clicking Filter Current Log in the Actions pane
4. Enter 27 in the Event IDs field and click OK
5. Review recent Event ID 27 entries, noting the application names, process IDs, and timestamps
6. Double-click individual events to view detailed information including thread IDs and hang duration
7. Look for patterns such as specific applications hanging repeatedly or hangs occurring at particular times

Use PowerShell to query Event ID 27 entries programmatically:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=27} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Export hang events for further analysis:

Get-WinEvent -FilterHashtable @{LogName='Application'; Id=27} | Export-Csv -Path "C:\temp\hang_events.csv" -NoTypeInformation

Investigate system resource constraints that may contribute to application hangs:

1. Open Task Manager by pressing Ctrl + Shift + Esc
2. Click the Performance tab to monitor CPU, Memory, Disk, and Network usage
3. Switch to the Processes tab and sort by CPU or Memory usage to identify resource-intensive applications
4. Enable Resource Monitor by clicking Open Resource Monitor at the bottom of the Performance tab
5. In Resource Monitor, examine the CPU, Memory, Disk, and Network tabs for bottlenecks
6. Look for processes with high handle counts, excessive page faults, or blocked I/O operations

Use PowerShell to collect performance data during hang events:

# Monitor top CPU consuming processes
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 Name, CPU, WorkingSet, Handles

# Check memory usage
Get-WmiObject -Class Win32_OperatingSystem | Select-Object TotalVisibleMemorySize, FreePhysicalMemory, @{Name="MemoryUsage%";Expression={[math]::Round((($_.TotalVisibleMemorySize - $_.FreePhysicalMemory) / $_.TotalVisibleMemorySize) * 100, 2)}}

Set up performance counters to track application responsiveness:

# Create a performance counter data collector set
logman create counter "AppHangMonitor" -f csv -o "C:\temp\apphang.csv" -c "\Process(*)\% Processor Time" "\Process(*)\Working Set" "\Process(*)\Handle Count" -si 5

Adjust Windows hang detection settings and enable detailed reporting:

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to HKEY_CURRENT_USER\Control Panel\Desktop
3. Locate or create the following DWORD values to configure hang detection:
• HungAppTimeout - Set to 5000 (5 seconds) or adjust as needed
• WaitToKillAppTimeout - Set to 20000 (20 seconds) for graceful termination
• AutoEndTasks - Set to 1 to automatically end hung applications
4. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
5. Create or modify DontShowUI DWORD and set to 0 to show error reporting dialogs
6. Enable Windows Error Reporting for detailed hang analysis by setting Disabled DWORD to 0

Configure hang reporting via PowerShell:

# Set hang detection timeouts
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "HungAppTimeout" -Value 5000 -Type DWord
Set-ItemProperty -Path "HKCU:\Control Panel\Desktop" -Name "WaitToKillAppTimeout" -Value 20000 -Type DWord

# Enable Windows Error Reporting
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting" -Name "Disabled" -Value 0 -Type DWord

Investigate application-specific factors that may cause hang conditions:

1. Identify the specific applications generating Event ID 27 from your Event Viewer analysis
2. Check for available updates by visiting the software vendor's website or using built-in update mechanisms
3. Review application compatibility with your Windows version using the Program Compatibility Troubleshooter
4. Right-click the problematic application executable and select Properties → Compatibility
5. Try running the application in compatibility mode for an earlier Windows version
6. Disable visual themes, desktop composition, or high DPI settings if applicable
7. Check for conflicting software, particularly antivirus programs, that may interfere with application execution

Use PowerShell to analyze application dependencies:

# Get detailed information about a specific process
$processName = "notepad"  # Replace with your application
Get-Process $processName | Select-Object Name, Id, StartTime, CPU, WorkingSet, Modules

# Check loaded modules for a process
$process = Get-Process $processName
$process.Modules | Select-Object ModuleName, FileName, FileVersionInfo | Format-Table -AutoSize

Analyze application event logs for additional context:

# Search for application-specific events
$appName = "YourApplication"  # Replace with actual application name
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName="*$appName*"} -MaxEvents 20 | Select-Object TimeCreated, Id, LevelDisplayName, Message

Capture detailed diagnostic information when applications hang for root cause analysis:

1. Download and install ProcDump from Microsoft Sysinternals
2. Open an elevated Command Prompt and navigate to the ProcDump installation directory
3. Configure ProcDump to automatically capture dumps when applications hang:

procdump -h -ma -w notepad.exe C:\dumps\

The -h flag captures dumps on hang, -ma creates full memory dumps, and -w waits for the process to start.

4. For running processes that are currently hung, capture a manual dump:

procdump -ma [ProcessID] C:\dumps\

Use PowerShell to automate dump collection based on Event ID 27:

# Monitor for Event ID 27 and trigger dump collection
$action = {
    $event = $Event.SourceEventArgs.NewEvent
    $processName = ($event.Message -split ' ')[0]  # Extract process name from message
    $dumpPath = "C:\dumps\$processName-$(Get-Date -Format 'yyyyMMdd-HHmmss').dmp"
    Start-Process -FilePath "procdump.exe" -ArgumentList "-ma", $processName, $dumpPath -Wait
}

Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 27" -Action $action

Analyze dump files using Windows Debugging Tools:

# Install Windows SDK for debugging tools
# Open WinDbg and load the dump file
# Use commands like !analyze -v, ~*kb, and !locks to investigate hang causes