The system must be configured to store all data in the error report archive.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-57465	WINER-000011	SV-71907r1_rule	ECSC-1	Medium

Description
The error reporting archive is stored locally on the system and is created after an error report has been sent to the local collector or DOD-wide collector (if defined). Storing all data, including memory contents, adds data that is very helpful in analyzing the errors.

STIG	Date
Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide	2015-06-16

Details

Check Text ( C-58337r1_chk )
If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\ Value Name: ConfigureArchive Type: REG_DWORD Value: 0x00000002 (2)

Fix Text (F-62705r1_fix)
Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Windows Error Reporting -> Advanced Error Reporting Settings -> "Configure Report Archive" to "Enabled" with "Store All" selected for "Archive behavior:".