Also check out http://blogs.msdn.com/wer/pages/faq.aspx#weronpc

Application Log

Whenever an application crashes (faulting application) you should get the message <application name> stopped working. Once that occurs the crash details get logged in the Application Log as an Error event. If the report is sent to Microsoft the Application Log will also have an Information event that contains a Bucket ID.

 

On Windows Vista, you can open Event Viewer by clicking the Start button Picture of the Start button, clicking Control Panel, clicking System and Maintenance, clicking Administrative Tools, and then double-clicking Event Viewer.? Administrator permission required If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Expand Windows Logs and select Application to select the Application log:

image

Look on the right, a crash in an Office application should be an Error under the Level column, Application Error under the Source column, and 1000 under the Event ID column.

Crash

image

Example: crash from Outlook

image

Fault Bucket (bucket ID)

If the report was sent to us (Microsoft) there should be an Information event with Windows Error Reporting under the Source column and event ID 1001, with all the data gathered in the details.

On support calls, the piece of data that's most important to me is the Fault bucket that's reported. I'll usually refer to it as the bucket ID.

image

Problem Reports and Solutions (new in Vista)

A new feature in Windows Vista is Problem Reports and Solutions in the Control Panel under the System and Maintenance category (if you don't have Classic View turned on). This will contain all the crash and hang events that occurred on a computer along with settings to configure reporting to Microsoft.

 

To open Problem Reports and Solution in Windows Vista (not in previous versions of Windows:

1. Open Problem Reports and Solutions by clicking the Start button Picture of the Start button, clicking Control Panel, clicking System and Maintenance, and then clicking Problem Reports and Solutions.

2. In the left pane, click View problem history.

3. To view problems by product, date, problem type, or solution status, click the column name.

image  image 

image

Bucket ID is the same as the Fault bucket in the application log event. I prefer using Problem Reports and Solutions versus Application Log to get crash details.

image 

 

image image

image

 

More info:

Where it's stored:

http://blogs.msdn.com/wer/pages/faq.aspx#weronpc

See problem reports for this computer

http://windowshelp.microsoft.com/Windows/en-US/Help/74274b33-52ea-40a4-bed5-9444c2a178a31033.mspx

Windows Error Reporting and the Problem Reports and Solutions Feature in Windows Vista

http://technet.microsoft.com/en-us/library/cc709644.aspx

Choose the information to send when a problem occurs

http://windowshelp.microsoft.com/Windows/en-US/Help/15d43eb3-45fd-4248-8bd5-2ed92ee298961033.mspx

Open Event Viewer (Windows Vista)

http://windowshelp.microsoft.com/Windows/en-US/Help/a99f69c1-935f-4116-ba5f-33d8800ef9da1033.mspx

How to create a user-mode process dump file in Windows Vista

http://support.microsoft.com/kb/931673

How to use ADPlus to troubleshoot "hangs" and "crashes"

http://support.microsoft.com/kb/286350