WerFault.exe is the Windows Error Reporting client process — it’s what pops up “Program has stopped working” dialogs and ships crash dumps to Microsoft. The original note (2009, Vista era) suggested disabling the whole service to make it go away; that still works, but there are better options now.
If WerFault.exe is misbehaving
- Press Win+R, run
services.msc. - Find Windows Error Reporting Service (SvcHost: WerSvc).
- Open its Properties dialog and set startup type to Disabled or Manual.
- Reboot. WerFault.exe should then stay inactive.
The saner alternative
Turning off error reporting also means no local crash diagnostics. If you only want the process to stop eating CPU or showing dialogs but keep dumps for your own apps:
- Open Control Panel > System > Advanced system settings > Startup and Recovery > Settings, or run
systempropertiesadvanced, to control system-failure behavior. - For application crash reporting specifically, Group Policy has Computer Configuration > Administrative Templates > Windows Components > Windows Error Reporting with a “Disable Windows Error Reporting” policy — cleaner than killing the service and survives upgrades.
- If a specific app crashes constantly and WerFault keeps launching, fix the app — check Event Viewer (Windows Logs > Application) for the faulting module. WerFault is the messenger, not the cause.
- A genuine WerFault.exe hang at 100% CPU on boot with no app crashing has historically pointed to a stuck WerSvc — check
Event Viewerand your disk health (a failing disk makes crash-dump writing hang forever).
Note: WerFault.exe legitimately lives in C:\Windows\System32 (and SysWOW64). A WerFault.exe running from anywhere else is malware masquerading as it — scan, don’t just disable the service.