WerfAult.exe: What It Is, Why It Runs, and How to Fix Common Problems

If you’ve opened Task Manager and spotted werfault.exe consuming your CPU or memory, you’re probably wondering if it’s safe or if your computer has a virus. Here’s the direct answer: werfault.exe is a legitimate Windows process called Windows Error Reporting that sends crash data to Microsoft when programs fail. It’s not malware, but it can sometimes cause high CPU usage or errors itself.

This guide explains everything you need to know about werfault.exe, including when it’s normal, when it’s a problem, and exactly how to fix it.

What Is WerFault.exe?

WerFault.exe stands for Windows Error Reporting Fault. It’s a built-in Windows component that has one main job: collect information when programs crash or stop working.

When any application freezes or closes unexpectedly, werfault.exe springs into action. It gathers diagnostic data about what went wrong, like error codes, memory dumps, and system information. Microsoft uses this data to identify bugs and improve Windows updates.

Where Is WerFault.exe Located?

The legitimate file sits in two locations on your system:

• C:\Windows\System32\WerFault.exe
• C:\Windows\SysWOW64\WerFault.exe (on 64-bit systems)

Any werfault.exe file in a different folder could be malware pretending to be the real process.

Why Does WerFault.exe Run?

This process activates automatically when:

• A program crashes or becomes unresponsive
• A Windows component fails
• A system service encounters an error
• You manually send error reports to Microsoft

You’ll often see it appear briefly after a crash, then disappear once the error report is sent or canceled.

Is WerFault.exe Safe or a Virus?

The real werfault.exe is completely safe. It’s digitally signed by Microsoft and is part of Windows since Windows Vista.

However, malware sometimes disguises itself with this name. Here’s how to check if yours is legitimate:

Step 1: Open Task Manager (press Ctrl + Shift + Esc)

Step 2: Find werfault.exe in the Processes tab

Step 3: Right-click it and select “Open file location”

Step 4: Check if the folder is System32 or SysWOW64

If the file opens anywhere else, like your Downloads folder or AppData, you likely have malware.

Step 5: Right-click the file and select Properties

Step 6: Go to the Digital Signatures tab

Step 7: Verify the signer is Microsoft Windows

No digital signature or a different publisher name means it’s fake.

Signs of Malware Disguised as WerFault.exe

Watch for these red flags:

• Multiple werfault.exe processes running simultaneously
• Constant high CPU or memory usage (above 50% for extended periods)
• The process runs even when no programs have crashed
• Your antivirus flags it
• It restarts immediately after you end the task

Why Is WerFault.exe Using High CPU or Memory?

While werfault.exe normally uses minimal resources, it can sometimes spike to high usage. This happens for specific reasons.

Common Causes of High Resource Usage

Repeated program crashes: If the same application keeps crashing, werfault.exe runs repeatedly to log each failure.

Corrupted error reports: Sometimes the error reporting queue gets stuck, causing werfault.exe to loop endlessly.

System file corruption: Damaged Windows files can trigger false crashes, making werfault.exe work overtime.

Too many crash dumps: Windows stores crash data temporarily. If this folder fills up, processing slows down.

Background Windows updates: Update processes sometimes trigger error checks that activate werfault.exe.

How to Fix WerFault.exe Problems

Here are proven solutions for the most common werfault.exe issues, arranged from simplest to most advanced.

Method 1: Restart Your Computer

This sounds basic, but restarting clears temporary error queues and stops stuck processes.

Hold the Windows key, press R, type shutdown /r /t 0, and press Enter.

This forces an immediate restart. Check if werfault.exe behaves normally afterward.

Method 2: Disable Windows Error Reporting

If you don’t need to send crash reports to Microsoft, disabling this service stops werfault.exe from running.

Step 1: Press Windows + R

Step 2: Type services.msc and press Enter

Step 3: Scroll down to “Windows Error Reporting Service”

Step 4: Double-click it

Step 5: Change Startup type to “Disabled”

Step 6: Click Stop if the service is running

Step 7: Click OK

This completely prevents werfault.exe from launching. You won’t send crash data to Microsoft, but the process won’t consume resources.

Method 3: Clear Error Report Queue

Old crash reports can clog the system. Deleting them often fixes persistent issues.

Step 1: Open File Explorer

Step 2: Navigate to C:\ProgramData\Microsoft\Windows\WER

Step 3: Delete all folders inside ReportQueue and ReportArchive

Step 4: Empty your Recycle Bin

You might need administrator permissions. Right-click each folder and choose Delete.

Method 4: Run System File Checker

Corrupted system files trigger false errors that activate werfault.exe unnecessarily.

Step 1: Right-click the Start button

Step 2: Select “Terminal (Admin)” or “Command Prompt (Admin)”

Step 3: Type sfc /scannow and press Enter

Step 4: Wait for the scan to complete (this takes 10-30 minutes)

Step 5: Restart your computer

The System File Checker repairs damaged Windows files automatically. If it finds issues, it displays a confirmation message.

Method 5: Use DISM to Repair Windows Image

If SFC doesn’t fix the problem, DISM goes deeper to repair the Windows installation.

Step 1: Open Terminal or Command Prompt as administrator

Step 2: Type DISM /Online /Cleanup-Image /RestoreHealth and press Enter

Step 3: Wait for completion (this can take 20-40 minutes)

Step 4: Run sfc /scannow again

Step 5: Restart

DISM pulls fresh files from Windows Update to replace corrupted components.

Method 6: Check for Windows Updates

Microsoft regularly patches bugs that cause error reporting issues.

Step 1: Open Settings (Windows + I)

Step 2: Click Windows Update

Step 3: Click Check for updates

Step 4: Install any available updates

Step 5: Restart when prompted

Updates often include fixes specifically for werfault.exe problems reported by other users through the Microsoft Update Catalog.

Method 7: Identify the Crashing Program

If one specific application keeps triggering werfault.exe, fixing or removing that program solves the issue.

Step 1: Open Event Viewer (press Windows + X, select Event Viewer)

Step 2: Expand Windows Logs

Step 3: Click Application

Step 4: Look for Error entries with “Application Error” or “WerFault”

Step 5: Double-click to see which program name appears

Once you identify the culprit, try these fixes:

• Update the program to the latest version
• Reinstall it completely
• Check if others report the same crashes online
• Contact the software developer
• Use an alternative program if crashes persist

Method 8: Perform a Clean Boot

Sometimes third-party services conflict with Windows error reporting.

Step 1: Press Windows + R

Step 2: Type msconfig and press Enter

Step 3: Click the Services tab

Step 4: Check “Hide all Microsoft services”

Step 5: Click Disable all

Step 6: Click the Startup tab

Step 7: Click “Open Task Manager”

Step 8: Disable all startup items

Step 9: Close Task Manager

Step 10: Click OK in System Configuration

Step 11: Restart

If werfault.exe stops causing problems in clean boot, one of your third-party programs is the source. Enable services and startups one by one to find the conflict.

Should You Disable or Remove WerFault.exe?

You can disable the Windows Error Reporting service, but you cannot and should not delete werfault.exe itself.

Pros of Disabling

• Stops resource usage from error reporting
• Prevents crash report pop-ups
• Slightly improves privacy (no data sent to Microsoft)

Cons of Disabling

• Microsoft can’t collect crash data to fix bugs
• You lose automatic problem reporting for Windows issues
• Some troubleshooting tools rely on error logs

For most users, keeping it enabled makes sense. Only disable if you’re experiencing persistent problems that other fixes don’t resolve.

Never Delete WerFault.exe

Deleting the actual file breaks Windows error handling. Programs might crash without any notification, and Windows Update could fail.

If you’re certain the file is malware, remove it with antivirus software rather than manual deletion.

WerFault.exe Application Error Messages

Sometimes werfault.exe itself crashes, creating ironic error messages like “WerFault.exe has stopped working.”

Common Error Messages

Error Message	Meaning
“WerFault.exe has stopped working”	The error reporter crashed while reporting another crash
“WerFault.exe Application Error”	Memory corruption or system file damage
“The application was unable to start correctly (0xc0000005)”	Access violation, often from malware or permissions issues
“WerFault.exe Bad Image”	Corrupted DLL files that werfault.exe needs

Fixing WerFault.exe Crashes

Run SFC and DISM as described in Methods 4 and 5. These commands fix the underlying corruption causing werfault.exe itself to fail.

If that doesn’t work, create a new user account:

Step 1: Open Settings

Step 2: Go to Accounts > Family & other users

Step 3: Click “Add account” under Other users

Step 4: Create a local account

Step 5: Sign in with the new account

If werfault.exe works properly in the new account, your original user profile is corrupted. Transfer your files and use the new account going forward.

Advanced Troubleshooting

For persistent issues that basic fixes don’t resolve, try these advanced approaches.

Reset Windows Error Reporting Settings

Step 1: Press Windows + R

Step 2: Type regedit and press Enter

Step 3: Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting

Step 4: Right-click the Windows Error Reporting folder

Step 5: Select Export to back it up

Step 6: Delete any custom values you find

Step 7: Restart

This resets error reporting to default settings without disabling it completely.

Check Memory and Hard Drive Health

Faulty hardware can cause random crashes that trigger werfault.exe constantly.

For memory: Download Windows Memory Diagnostic by searching for it in the Start menu. Run a full scan during restart.

For hard drive: Open Command Prompt as admin and type chkdsk /f /r C:. Schedule it to run on next restart.

Replace failing hardware if these scans detect errors.

Review Application Event Logs

Event Viewer contains detailed crash information.

Step 1: Open Event Viewer

Step 2: Go to Windows Logs > Application

Step 3: Filter current log for Error level events

Step 4: Look for patterns in timestamps or application names

This reveals which programs crash most often and when, helping you target specific problem software.

Windows Error Reporting and Privacy

Some users worry about what data werfault.exe sends to Microsoft.

What Data Gets Sent

When a crash occurs, Windows Error Reporting can send:

• Application name and version
• Memory dump files showing program state during crash
• Operating system version
• Hardware configuration details
• Error codes and stack traces

Microsoft states this data is used only for debugging and improving Windows. It doesn’t include personal files or documents.

How to Limit Data Collection

If you want error reporting without sending detailed dumps:

Step 1: Open Settings

Step 2: Go to Privacy & security > Diagnostics & feedback

Step 3: Select “Required diagnostic data” instead of Optional

Step 4: Turn off “Send optional diagnostic data”

This keeps basic error reporting active while limiting what Microsoft receives.

Frequently Asked Questions

Can I end WerFault.exe in Task Manager?

Yes, you can safely end the task. It will restart automatically the next time a program crashes. Ending it doesn’t fix underlying issues but gives you temporary relief from high resource usage.

Why does WerFault.exe run at startup?

WerFault.exe shouldn’t run at startup normally. If it does, a program is crashing during boot or you have a corrupted user profile. Check startup programs in Task Manager and disable unnecessary ones.

Does WerFault.exe slow down my computer?

Under normal circumstances, no. It uses minimal resources and runs only briefly after crashes. Constant slowdown means either repeated crashes are occurring or the error reporting service is malfunctioning.

Will disabling WerFault.exe stop programs from crashing?

No. Disabling werfault.exe only prevents crash reports from being created and sent. The actual crashes will still happen. You need to fix the crashing programs themselves.

How much disk space does WerFault.exe use?

The process itself is small (under 1 MB), but crash dumps stored in C:\ProgramData\Microsoft\Windows\WER can accumulate. Windows automatically deletes old reports, but manual cleanup helps if the folder exceeds several gigabytes.

Conclusion

WerFault.exe is a legitimate Windows component that manages error reporting when programs crash. While it’s safe and usually harmless, high CPU usage or constant errors indicate underlying problems with crashing software, corrupted system files, or occasionally malware.

Start with simple fixes like restarting your computer and clearing the error queue. If problems persist, run System File Checker and DISM to repair Windows. Identify which programs crash most often through Event Viewer and update or remove them.

You can disable Windows Error Reporting if needed, but never delete werfault.exe itself. For most users, keeping it enabled provides valuable crash data that helps Microsoft improve Windows stability.

If you’ve tried everything and werfault.exe still causes issues, consider resetting Windows while keeping your files or consulting with a professional technician. The problem often points to deeper system instability that requires comprehensive repair.