One of our enterprise customers recently asked me if there was a way to determine the cause of application crashes on client computers in an SCCM environment. With a CMPivot query, it is possible to find a list of applications that terminate abruptly, along with the names of those applications and the crash count.
Application crashes are common, but it’s difficult to figure out why they happen. Typically, applications can crash for a number of reasons, including network issues, memory leaks, and software issues.
When deploying applications through SCCM, it is imperative that these applications operate correctly on the endpoints. If users constantly complain that their work apps are crashing in SCCM, rather than manually investigating them, a CMPivot query can help you identify those applications in the admin console. You can also use CMPivot to find recently used applications by users in SCCM.
If you have never used the CMPivot or tried running any queries before, I recommend reading the CMPivot documentation to understand how it works and how to use it to access the state of your ConfigMgr devices.
Find Application Crashes with CMPivot Query
Here’s how you can run a CMPivot query to determine the app crashes on Windows devices in a Configuration Manager environment. First, launch the SCCM console and navigate to Assets and Compliance > Overview > Device Collections. Right-click a device collection and select Start CMPivot.
To see the applications that frequently crash on devices, switch to the Query tab of the CMPivot tool. Paste the query into the CMPivot query editor and click Run.
AppCrash | summarize dcount( Device ) by FileNameThe query output contains the file name and count that is related to the crashing application. For instance, in the below screenshot, the app that is crashing is Microsoft.Mom.Sdk.ServiceHost.exe. From what I know, it is a “System Center Data Access Service” that is installed by SCOM.
If you run the CMPivot query “AppCrash”, you get some extra details about the applications, which include file name, version, date and time, and report ID.
Running this query in a large setup may result in output with numerous apps that frequently crash. Not to worry, there is an export option in the CMPivot query window that allows you to export app crash details from client computers to an external file (CSV file). This should help you figure out which apps are frequently crashing and help you find a better solution.
