.detach (Detach from Process)

The .detach command ends the debugging session, but leaves any user-mode target application running.

.detach [ /h | /n ]


Any outstanding debug event will be continued and marked as handled. This is the default.

Any outstanding debug event will be continued without being marked as handled.


For live user-mode debugging, this command is only supported in Windows XP and later versions of Windows.


user mode, kernel mode


live, crash dump




This command will end the debugging session in any of the following scenarios:

  • When you are debugging a user-mode or kernel-mode dump file.

  • When you are debugging a live user-mode target.

  • When you are noninvasively debugging a user-mode target.

If you are only debugging a single target, the debugger will return to dormant mode after it detaches.

If you are debugging multiple targets, the debugging session will continue with the remaining targets.