Event ID 1000 is Windows 11’s record that an application actually crashed. It is not, by itself, a diagnosis or proof that the DLL named in the event is broken. The reliable fix is to identify the crashing executable, faulting module, exception code and crash time, then choose a repair path that matches that evidence.
Microsoft describes it plainly: “The Event ID 1000 with the Error level is the actual application crashing event.” The guidance was updated February 12, 2026. Use the workflow below to determine whether an update, third-party component, application repair, permissions correction or developer-level dump analysis is appropriate.
As an Amazon Associate I earn from qualifying purchases.
What Event ID 1000 means
Windows records Event ID 1000 in the Application log when a process terminates because of an application crash. The event commonly includes:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Faulting application name and version
- Faulting module name and version
- Exception code
- Fault offset
- Process ID
- Application start time
- Application path
- Module path
Those fields are clues for selecting a fix. Event ID 1000 does not identify one universal fault, and it does not mean that the listed module should automatically be replaced. Repeated Event ID 1000 entries, often alongside Event ID 1001, indicate recurring application-crashing behavior. Event ID 1001 contains Windows Error Reporting information that can add useful context.
#1 Best Overall
First, capture the event details
- Press Windows key + R, enter
eventvwr.msc, and press Enter. - In Event Viewer, open Windows Logs > Application.
- Find the Event ID 1000 entry whose time matches the visible crash. Open it and select the General or Details view.
- Write down the faulting application, application version, faulting module, exception code, fault offset, process ID, application path and module path.
- At the same timestamp, look for Event ID 1001 and any Windows Error Reporting entry. For Windows shell components, also check
C:ProgramDataMicrosoftWindowsWERReportArchiveandC:ProgramDataMicrosoftWindowsWERReportQueue.
Do not begin by replacing a DLL, changing registry permissions or running a registry cleaner. The executable named as the faulting application determines which product or Windows component actually stopped.
Use the evidence to choose a repair path
| What the event shows | Best next check | Why |
|---|---|---|
| A third-party executable, driver, overlay, shell extension or startup component | Update it, then reproduce in Safe Mode or a clean boot | Removing third-party code from the test isolates conflicts without altering Windows files |
| A Microsoft executable such as a Windows shell process | Install Windows updates, inspect Event ID 1001 and WER reports, then test for third-party interference | System modules can be victims of corruption caused by another component |
0xc0000022 or another access-denied indication, especially for a Store app |
Check permissions only on the documented application, registry and file-system locations | Permission repair is justified by access-denied evidence, not by Event ID 1000 alone |
0xc0000005 access violation or 0xc0000374 heap corruption that reproduces |
Collect a dump and escalate to the software vendor or Microsoft Support | These failures often require call-stack and memory analysis rather than a generic reinstall |
| The same application crashes after updates and isolation | Repair or reinstall that named application | The event identifies a repeatable product-level failure, making a product repair a targeted step |
Install Windows and application updates
Updates are the safest first repair because they can correct known defects without deleting user data or changing security settings.
Update Windows 11
- Open Settings > Windows Update.
- Select Check for updates.
- Install available quality, security and driver updates, then restart when Windows requests it.
- Reproduce the original action and check whether a new Event ID 1000 appears.
If the crash began immediately after a particular update, record the update name and date before considering rollback. Do not remove updates solely because an event names a Microsoft DLL; first confirm that the crash started with that update and remains reproducible.
Update the affected application
Use the application’s own update function or its official distribution channel. Verify that the update applies to the same executable shown in the event. Updating a different edition or similarly named program will not address the recorded process.
Check antivirus status
Make sure your installed antivirus is current and that any required application exclusions are present according to the application publisher’s instructions. Antivirus software can block files or integrations, but Event ID 1000 alone does not establish that security software caused the crash. Do not disable protection broadly as a first test.
Isolate third-party conflicts
Overlays, shell extensions, startup utilities, third-party drivers and background services can inject code into an otherwise stable process. Isolation tells you whether the crash depends on one of those components.
Test in Safe Mode
- Open Settings > System > Recovery.
- Under Advanced startup, select Restart now.
- Choose Troubleshoot > Advanced options > Startup Settings > Restart.
- After the restart, press the key for Safe Mode (or Safe Mode with Networking only when network access is necessary).
- Perform the action that normally crashes the application.
If the crash disappears in Safe Mode, a normal-startup service, driver, shell extension or overlay becomes more likely. Safe Mode does not prove which item is responsible; it narrows the search.
Free tools Windows power users keep installed
One-click scans. No signup required.
Perform a clean startup with System Configuration
- Press Windows key + R, enter
msconfig, and press Enter. - On the Services tab, select Hide all Microsoft services. This protects core Microsoft services from being disabled accidentally.
- Select Disable all, then open the Startup tab and choose Open Task Manager.
- Disable enabled third-party startup items in Task Manager, close it, select OK in System Configuration and restart.
- Reproduce the crash. If it stops, re-enable items in groups and restart between tests until the responsible service or startup item is identified.
- Return System Configuration to Normal startup after testing, unless the vendor gives a specific reason to keep a service disabled.
For a suspected driver or shell extension, install the current version from its hardware or software vendor after identifying it. Avoid downloading replacement DLLs from unrelated file sites.
Repair or reinstall the named application
Only repair the program identified as the faulting application. A faulting module by itself is not enough to select an application.
Use Windows’ repair option when available
- Open Settings > Apps > Installed apps.
- Locate the affected application, select its three-dot menu and choose Advanced options when offered.
- Select Repair and test the application.
- If the crash continues and the option exists, select Reset. Read the warning first because reset can remove the application’s local data or settings.
Reinstall from the official source
Back up application-specific saves, profiles, templates or license information first. Uninstall the program, restart Windows, install the current release from the publisher or Microsoft Store, and reproduce the original operation. If only one document, plug-in or profile triggers the crash, test with a new profile before deleting the original data.
Understand the faulting module and exception code
Why a Microsoft DLL may be a victim
ntdll.dll, kernel32.dll and kernelbase.dll are used by many processes. Microsoft cautions that they may be “victims of other types of corruption previously performed by misbehaving modules.” Their appearance identifies where Windows detected the failure, not necessarily where the original defect began. Do not replace these files manually or download copies from the web.
Common exception codes
0xc0000022—STATUS_ACCESS_DENIED. For a Store app, investigate documented permissions and access failures before attempting broader changes.0xc0000005—STATUS_ACCESS_VIOLATION. This can require isolation, an application update or dump analysis to identify the invalid access.0xc0000374—STATUS_HEAP_CORRUPTION. Repeated cases are strong candidates for a full dump and developer-level analysis.
The exception code is one part of the diagnosis. Match it with the executable, module path, timing and reproduction conditions instead of treating the code as a complete explanation.
Fix Store-app and Start-menu cases carefully
Start-menu components
When the Start menu fails, check Application-log Event IDs 1000 and 1001 for StartMenuExperienceHost.exe. Microsoft’s Start-menu troubleshooting guidance also uses Windows Error Reporting, ProcDump and Procmon to collect evidence. First install Windows updates and perform third-party isolation; those steps distinguish a shell conflict from a Windows component failure.
Store apps with access-denied evidence
If a Store app will not start and the event or related logs show access denied, Microsoft documents checking the All Application Packages permissions on the relevant registry and file-system locations. Make only the documented, narrowly scoped correction for the affected location. Broad permission changes can cause serious security and stability problems and should never be made speculatively from an Event ID 1000 entry.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Collect a crash dump for a repeatable failure
Escalate to dump collection when the same process crashes reliably after updates, application repair and third-party isolation, or when the exception indicates access violation or heap corruption. A dump gives a vendor or support engineer the process state needed to inspect the failing thread and call stack.
Recommended Free Tools
Configure Windows Error Reporting LocalDumps
- Create a dedicated local folder with enough free space for full dumps, and restrict access to trusted administrators.
- Open Registry Editor as an administrator and navigate to
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsWindows Error ReportingLocalDumps. - Create a subkey named for the exact executable from Event ID 1000, including the
.exeextension. Microsoft’s example usesnetsh.exe; substitute the process that actually crashes on your computer. - Set
DumpFolderto the dedicated folder and create aREG_DWORDvalue namedDumpTypewith data2for a full dump. - Reproduce the crash once, then confirm that a dump file appears. Full dumps can be large, so stop reproducing after you have the evidence needed.
Registry edits affect system-wide error reporting. Export the key before changing it, use the exact executable name, and do not create a catch-all configuration for every process.
Best Value
Use GFlags page heap when heap corruption is suspected
With the Windows debugging tools installed, run an elevated command prompt and enable page heap for the exact process:
gflags.exe /i <process>.exe +hpa
Replace <process>.exe with the executable shown in Event ID 1000. Page heap changes memory allocation behavior and can expose the operation that corrupts the heap, but it can also increase memory use and alter timing. Reproduce only as needed.
Analyze with WinDbg and escalate
Open the dump in WinDbg, allow symbols to load, inspect the exception and failing thread, and preserve the output for the application vendor. A third-party process should be escalated to that vendor. A first-party Microsoft process should be escalated to Microsoft Support when the dump requires interpretation beyond routine troubleshooting.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Clean up debugging settings
- After collecting and analyzing the required dumps, delete the process-specific LocalDumps registry key.
- Turn off page heap for the process:
gflags.exe /i <process>.exe -hpa
Leaving either setting enabled can consume disk space or change process behavior during later testing.
When Event ID 1000 keeps returning
- Confirm that each new event names the same executable; different applications can generate the same event ID for unrelated reasons.
- Compare timestamps with application updates, Windows updates, driver installations and newly enabled overlays or shell extensions.
- Record whether the crash occurs only for one user account, one file, one game or one Start-menu action.
- Keep the Event ID 1000 and 1001 details, WER report folder, application version and dump files together for support.
- Do not use a generic DLL replacement, registry-permission reset or registry cleaner as a substitute for identifying the process.
Bottom line
Event ID 1000 tells you that an application crashed; it does not tell you the cause. Capture the executable, module, exception and paths, update Windows and the affected application, isolate third-party components, and repair or reinstall the confirmed crashing program. Treat Microsoft DLLs as evidence rather than automatic culprits. For a repeatable failure that survives those checks, collect a process-specific WER dump, use page heap only when appropriate, and send the evidence to the responsible vendor or Microsoft Support.
Quick Recap
As an optional shortcut after the manual checks, Outbyte PC Repair can address more than 100 common Windows issues where possible, tune settings that affect CPU, RAM and disk load, clean temporary and cache files, check selected Windows vulnerabilities and provide crash-log and recovery features. It complements antivirus software rather than replacing it; results vary, and no tool repairs every crash. It runs on Windows 11, 10, 8 and 7 with a free trial by category of at least two days, followed by a subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors
