IT Support Playbooks / IT Support Guides
Collect application crash evidence before reinstalling
An application that closes unexpectedly may fail because of a plugin, corrupt user data or a shared runtime. Capture a focused event window before replacing the installation.
Environment and inputs: Everyday IT support · Windows PowerShell examples unless specified
Try the diagnostic command
Use the stated shell and platform. Replace sample domains, addresses, services and paths with values from the system you are authorized to support.
Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=(Get-Date).AddHours(-1)} -MaxEvents 50 | Select-Object TimeCreated, Id, ProviderName, LevelDisplayName, MessageHow to read the result
In Windows PowerShell, the query returns a recent sample of accessible Application events. Not every program writes its crash details to this log, so an empty or unrelated result needs further context.
What to do next
Match the user action and exact time with the provider and application version. Compare a clean profile or approved plugin-free mode, and preserve application-specific logs before repair.
Before you make a change
Crash dumps and event messages can contain personal data or document paths. Do not upload a full dump to an unapproved external service.