A blue screen (Windows calls it a stop error or bug check) means Windows hit a condition it couldn’t safely continue from, so it stopped everything, saved crash data and restarted. Older builds say Your PC ran into a problem and needs to restart; current Windows 11 says Your device ran into a problem and needs to restart, and on version 24H2 and later the screen may be black instead of blue.
The useful part is the stop code, such as DPC_WATCHDOG_VIOLATION: any BSOD fix starts there, because each code has its own fix order. Microsoft’s crash analysis attributes about 70% of stop errors to third-party driver code and about 10% to hardware, so the job is usually finding one driver, not reinstalling Windows.
The fastest way to tell causes apart: if the same stop code and the same driver file appear in every crash, it’s that driver. If the codes and files change from crash to crash, suspect memory, power or heat.
Try these first
- Note the stop code and any “What failed” file on screen; if it restarted too fast, check Reliability Monitor.
- Undo the last change: unplug new hardware, roll back a just-updated driver or remove a new program.
- Install pending Windows updates and the latest drivers from your PC maker’s support app or website.
- Free up space if the system drive is nearly full; Microsoft recommends keeping 10-15% free.
- If it crashes before you can work, start in Safe Mode from the Windows Recovery Environment.
- Run Windows Memory Diagnostic if the stop code changes from crash to crash.
Stop code table: which guide to use
Find your stop code below; each guide covers that code’s causes and diagnosis order.
| Stop code | Code | Typical cause | Guide |
|---|---|---|---|
KERNEL_SECURITY_CHECK_FAILURE | 0x139 | A driver corrupted a kernel data structure; occasionally bad RAM | Kernel security check failure fix |
IRQL_NOT_LESS_OR_EQUAL | 0xA | A driver followed a bad memory pointer at high priority; often network, USB or security drivers, sometimes RAM | IRQL_NOT_LESS_OR_EQUAL fix |
DRIVER_IRQL_NOT_LESS_OR_EQUAL | 0xD1 | Same bad-pointer mistake as 0xA, in a driver’s own code; Windows often names the driver on screen | DRIVER_IRQL_NOT_LESS_OR_EQUAL fix |
DPC_WATCHDOG_VIOLATION | 0x133 | A driver held a processor too long; storage drivers, SSD firmware, Bluetooth audio and docks are common | DPC watchdog violation fix |
CRITICAL_PROCESS_DIED | 0xEF | A core Windows process ended; damaged system files, a failing drive or security software | Critical process died fix |
INACCESSIBLE_BOOT_DEVICE | 0x7B | Windows lost access to its own drive during startup; storage mode change, cloned SSD, unfinished update or dying drive | Inaccessible boot device fix |
MEMORY_MANAGEMENT | 0x1A | Windows’ memory manager hit a severe error, such as corrupted page tables; often RAM or memory overclocking, sometimes a driver | Memory management blue screen fix |
PAGE_FAULT_IN_NONPAGED_AREA | 0x50 | A driver or security filter used an invalid memory address; sometimes disk errors or faulty RAM | Page fault in nonpaged area fix |
SYSTEM_SERVICE_EXCEPTION | 0x3B | A driver mishandled a program’s request; often graphics, VPN, security or webcam drivers | System service exception fix |
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED | 0x7E | Unhandled error in a system thread; usually the driver named on screen, often at startup after an update | System thread exception not handled fix |
DRIVER_POWER_STATE_FAILURE | 0x9F | A driver stalled sleep, wake, shutdown or undocking; often network, USB, graphics or dock drivers | Driver power state failure fix |
VIDEO_TDR_FAILURE | 0x116 | The graphics driver hung and couldn’t be reset; driver, heat, power or overclock | Video TDR failure fix |
UNEXPECTED_KERNEL_MODE_TRAP | 0x7F | The processor raised a trap the kernel couldn’t handle; often RAM, overclocking, heat or stacked filter drivers | Unexpected kernel mode trap fix |
CLOCK_WATCHDOG_TIMEOUT | 0x101 | A processor core stopped responding; overclocking, outdated BIOS microcode, heat or a failing CPU | Clock watchdog timeout fix |
BAD_SYSTEM_CONFIG_INFO | 0x74 | A registry or boot-configuration error, usually at startup | Bad system config info fix |
Other common stop codes
No separate guide; use this page’s method plus the note.
| Stop code | Code | What it usually means |
|---|---|---|
KMODE_EXCEPTION_NOT_HANDLED | 0x1E | An unhandled exception in kernel code. Update or remove the driver named on screen or in the dump. |
WHEA_UNCORRECTABLE_ERROR | 0x124 | The hardware reported a fatal error. Remove overclocks, update the BIOS, check cooling. |
KERNEL_DATA_INPAGE_ERROR | 0x7A | Data couldn’t be read back from disk. Check the drive and its connection. |
Find the stop code after the PC has already restarted
Reliability Monitor (easiest)
Type reliability in Start and open View reliability history, or run perfmon /rel. In Reliability Monitor, a blue screen shows as a red X: a Windows entry that shut down unexpectedly. View technical details shows Problem Event Name: BlueScreen, the stop code in hex as Code (133 means 0x133) and its four parameters as Parameter 1 to Parameter 4; older guides call these BCCode and BCP1 to BCP4. The same timeline lists that day’s driver updates, Windows updates and installs, which usually answers “what changed?”
Event Viewer
In Event Viewer > Windows Logs > System, Event ID 1001 from BugCheck states the code and where the dump was saved. Event ID 41 from Kernel-Power is normally logged after an unclean restart; when a bug check caused it, the BugcheckCode field holds the code in decimal. Calculator’s Programmer view converts it: 159 is 0x9F.
If Event 41 shows a BugcheckCode of 0 and no dump exists, look for Event ID 46 from volmgr (Crash dump initialization failed!). If it’s there, a page file problem stopped Windows from recording a real crash, so check that the system drive has a page file. If not, it probably wasn’t a blue screen: think power loss, a held power button or a hard freeze, covered in our guide to a computer that keeps freezing.
Keep the screen up next time
Search Advanced system settings, select Settings under Startup and Recovery, and clear Automatically restart. The stop screen then stays until you restart the PC yourself. In the same dialog, leave Write debugging information set to Automatic memory dump so dumps keep being saved.
The general fix order
Work from least to most disruptive, and give each change a day or two of normal use before calling it fixed.
- Undo the last change. Roll back a driver (Device Manager, device Properties > Driver > Roll Back Driver), remove a recent update in Settings > Windows Update > Update history > Uninstall updates, or uninstall a new program.
- Remove recently added hardware, including docks, hubs and new RAM.
- Update from the source. Windows updates first, then drivers and BIOS from the PC maker’s tool (Dell SupportAssist, HP Support Assistant, Lenovo Vantage). Before a BIOS update, suspend BitLocker, know where your BitLocker recovery key is and plug a laptop into AC power. Never turn the PC off mid-update; an interrupted flash can leave it unable to start. Afterward, check that BitLocker protection is back on.
- Check Device Manager for yellow exclamation marks.
- Repair system files with
DISM /Online /Cleanup-Image /RestoreHealththensfc /scannow(administrator terminal). This matters most for CRITICAL_PROCESS_DIED; it rarely fixes a driver bug. - Scan for malware with Microsoft Defender or Microsoft Safety Scanner.
- Test the hardware: Windows Memory Diagnostic (
mdsched.exe), the PC maker’s diagnostics and temperatures (see why a computer overheats).
| What you see | Likely cause | First move |
|---|---|---|
| Same stop code and the same driver file every time (on screen or in the dumps) | That driver | Update, roll back or uninstall it |
| Different codes and modules each time | RAM, memory overclock, power or heat | Memory test, XMP/EXPO off, check temperatures |
| Only with a dock, USB device or Bluetooth headset connected | That device’s driver or firmware | Update it; test without the device |
| Only in games, video calls or 3D work | Graphics driver or GPU heat | Reinstall the GPU driver; check temperatures |
| During startup, every time | Storage driver, boot files or unfinished update | Recovery Environment (below) |
If you’d rather not do this yourself, this is a typical $59 remote fix when the cause is a driver, update or Windows setting, as long as Windows stays up long enough to connect. A failing part still has to be replaced in person. Every session needs your approval, and you can end it at any time; here’s how our remote support works.
If Windows crashes before you can sign in
After two failed starts in a row, Windows opens the Windows Recovery Environment (WinRE) by itself. To force it, interrupt startup twice with the power button; if you reach the sign-in screen, hold Shift and select Power > Restart instead. Have your BitLocker recovery key ready.
For a blue screen at startup, go to Troubleshoot > Advanced options > Startup Settings > Restart, then:
- Press 9 to turn off automatic restart after a failure. On that start, a crash stays on screen, so you can note the stop code and any file shown under What failed.
- Press 4 for Safe Mode, or 5 for Safe Mode with Networking. If Safe Mode is stable, a third-party driver or service is the likely cause: uninstall recently added security, VPN or hardware utility software, or roll back the driver the stop screen named.
If that fails, our automatic repair loop guide covers Startup Repair, Uninstall Updates and System Restore in a data-safe order, before Reset this PC. If the startup stop code is INACCESSIBLE_BOOT_DEVICE, go straight to our inaccessible boot device fix.
Rather have a technician sort it out?
If Windows still starts, a technician can connect with your approval, pull your crash dumps and look for the driver or part behind the stop code while you watch. A GoProIT technician can connect remotely, with your permission, and fix it while you watch. $59 per fix, Mon–Fri 8am–8pm ET.
Read the minidump with WinDbg
A dump file is a snapshot of memory at the moment of the crash, and it usually names the driver involved. Small dumps (about 256 KB each) are saved in C:\Windows\Minidump, one per crash; the larger kernel dump is C:\Windows\MEMORY.DMP. The folder needs administrator rights, so copy the files to your Desktop first; the steps below show how to read a minidump from there.
Open it
- Install WinDbg from the Microsoft Store or with
winget install Microsoft.WinDbg. - Open the dump file from the File menu (classic WinDbg calls it Open Crash Dump, Ctrl+D).
- If it complains about symbols, run
.symfixand then.reloadto use Microsoft’s public symbol server. - In the WinDbg command box, run
!analyze -v.
What to read in the output
- The bug check name and Arg1 to Arg4: the code and its four parameters. Most of the stop-code guides above explain what the parameters mean for that code.
- MODULE_NAME and IMAGE_NAME: the module Windows blames. A third-party
.sysfile here is your prime suspect. - STACK_TEXT: the chain of calls that led to the crash. Look for non-Microsoft module names in it.
Then lmvm plus the module name (for example lmvm nvlddmkm) shows the file’s path, version and date. A driver dated years before your Windows build is a strong lead.
If the blamed module is ntoskrnl.exe, hal.dll or another core Windows file, that’s where the crash was detected, not necessarily its cause. One dump can also mislead, so compare several before acting on it.
Driver Verifier: for a driver you can’t identify
When dumps blame Windows itself and hardware tests pass, Driver Verifier watches the drivers you choose and crashes the PC on purpose when one misbehaves, so the next dump names it, usually as bug check 0xC4 DRIVER_VERIFIER_DETECTED_VIOLATION.
Warning: Microsoft says Driver Verifier can crash the computer and belongs on machines used for testing and debugging. Expect slowdowns and more blue screens while it runs. Back up first, have your BitLocker recovery key, and know how to reach Safe Mode.
Run it with a way back
- Open Command Prompt as administrator and type
verifier. - Choose Create standard settings, then Select driver names from a list.
- Select only non-Microsoft drivers you suspect, recently updated ones first. With no suspects, Microsoft’s stop-error guide suggests groups of 10 to 20. Standard settings include Special Pool, though, and Microsoft advises against verifying several drivers at once with it, so once a group triggers a crash, narrow it down to one or two drivers. Never select every driver.
- Run
verifier /bootmode resetonbootfailso verification turns itself off if Windows fails to start. - Restart and use the PC normally until it crashes, then read the new minidump.
- Turn it off with
verifier /resetand restart. If you can’t reach the desktop, start in Safe Mode, where Driver Verifier doesn’t run, and reset it from there.
Several office PCs crashing? Treat it as one problem
Several PCs of one model with the same stop code in the same week usually means something was pushed to all of them: a driver from Windows Update, a BIOS update or a new security agent version. Compare a minidump from two machines; if the same module appears, fix it once for everyone and send the dumps to that driver’s vendor.
- Pause the bad driver. Intune’s Windows driver update policies let you approve or pause individual drivers for a group of PCs; they need Intune plus a Windows license that includes Windows Autopatch, such as Microsoft 365 Business Premium or Windows Enterprise E3/E5. Without Intune, the Group Policy setting Do not include drivers with Windows Updates leaves drivers to the PC maker’s tools.
- Push the fix with fleet tools such as Dell Command Update, HP Image Assistant or Lenovo System Update.
If you’d rather have one team handling crashes like this across the office, our Business Support Plan includes unlimited remote help desk tickets and automated Windows patching for each user on the plan; parts, on-site repairs and software licenses aren’t included.
When it’s hardware, and when to stop
Treat these as hardware until proven otherwise:
- Windows Memory Diagnostic or the PC maker’s diagnostics report any error.
WHEA_UNCORRECTABLE_ERROR, or different stop codes with different modules every time.- Crashes in Safe Mode, or while installing Windows from USB.
- A clicking hard drive, disk errors from
chkdsk, or a drive that disappears from the BIOS. - Restarts with no dump, a BugcheckCode of 0 and no Event ID 46 from volmgr, which points at power or heat.
Stop and get help if you can’t reach the desktop and don’t have the BitLocker recovery key, or if disk errors appear and your files aren’t backed up. Repeated repair attempts on a failing drive can make recovery harder, so copy the data off first.
Common questions
Is the blue screen of death caused by a virus?
Rarely. Microsoft’s crash analysis puts about 70% of stop errors on third-party driver code and about 10% on hardware. Malware can cause crashes by damaging system files or loading its own kernel drivers, so a full Microsoft Defender scan is still worthwhile, but a blue screen on its own is not a sign of infection. Start with the stop code and the driver named in the dump.
Can a blue screen damage my computer or delete my files?
The crash itself doesn’t damage hardware; Windows stops precisely to avoid writing bad data. You can lose unsaved work in open programs, and a crash in the middle of an update or a file save can corrupt that file. If the cause is a failing drive or bad RAM, those parts can damage data on their own, so back up before you start troubleshooting.
Why is my blue screen stuck at 0% or 100%?
The percentage tracks Windows saving crash data. If you turned off Automatically restart, the screen stops at 100% on purpose and waits for you. Otherwise, if the number hasn’t moved in 10 to 15 minutes, hold the power button until the PC turns off; the crash has already happened, so at worst you lose that crash’s dump. If it sticks at 0% every time, Windows may not be able to write to the system drive, so check the drive’s health and storage driver.
I had one blue screen and it hasn’t happened again. Should I worry?
One crash after a driver or Windows update, or after a power glitch, is often a one-off. Note the stop code in Reliability Monitor, install pending updates and carry on. If it happens again, especially with the same code, or with a different code each time, start the diagnosis on this page. Repeated crashes rarely go away on their own.
Where are blue screen log files stored in Windows 11?
Small crash dumps are in C:\Windows\Minidump, one per crash, and the larger kernel dump is C:\Windows\MEMORY.DMP. Event Viewer records each crash under Windows Logs > System as Event ID 1001 (BugCheck) and Event ID 41 (Kernel-Power). Reliability Monitor shows the same crashes on a timeline next to the updates and installs from that day.
Will reinstalling Windows fix a blue screen?
Only when the cause is software, and it costs hours of setup. If a driver is responsible, the same driver often returns through Windows Update or the PC maker’s tools after the reinstall. If it’s RAM or a failing drive, a reinstall changes nothing. Read the dumps first and reinstall only when system files are damaged beyond repair.
Does Windows 11 still show a blue screen?
Windows 11 version 24H2 and later, with recent updates, uses a simpler black screen that still shows the stop code, with a message that your device ran into a problem and needs to restart. Windows 10 and older Windows 11 builds show the familiar blue screen. The stop codes, the dump files and the troubleshooting are the same either way.