CRITICAL_PROCESS_DIED on Windows 11: Causes and Fix Order

CRITICAL_PROCESS_DIED (bug check 0xEF) means one of the processes Windows can’t live without ended unexpectedly. Microsoft lists the built-in critical processes as csrss.exe, wininit.exe, logonui.exe, smss.exe, services.exe, conhost.exe and winlogon.exe. When one of them dies, Windows stops the machine because it can no longer trust its own state.

This stop code often traces back to damaged Windows files, a drive failing underneath those files, or security software interfering with a core process, though a newly added driver or service can also trigger it. That’s why system file repair and disk checks, generic advice for other codes, are the main event here.

Your first fork is simple. If Windows still reaches the desktop, repair it from inside Windows. If it crashes during startup, work from the Windows Recovery Environment, with your BitLocker recovery key in hand.

Which process died, and what that tells you

Start with Event Viewer > Windows Logs and check the minutes before the crash in two logs:

• System: critical errors in that window, especially from the source disk. Event ID 7 (a bad block), 51 (an error during a paging operation) or 153 (a retried I/O operation) suggest the drive is struggling to return the files these processes load. Back up before any repair.
• Application: an Application Error (Event ID 1000), if Windows had time to log one, names the faulting module inside the dying process, which can point at a third-party DLL.

For a definite answer, read the crash dump. Parameter 1 is the process object, and parameter 2 says whether a whole process (0) or a single thread (1) terminated. In WinDbg, !analyze -v normally names the process, and !process followed by parameter 1 shows its details; our blue screen of death guide covers opening the dump. Microsoft also notes that Windows often writes a user-mode dump of the process before the bug check, and when one exists it’s the better place to look.

Fix order when Windows still starts

1. Find what changed. Reliability Monitor shows the crash next to that day’s updates and installs.
2. Remove a suspect update. In Settings > Windows Update > Update history > Uninstall updates (on Windows 10, Settings > Update & Security > Windows Update > View update history > Uninstall updates), remove the most recent one if the crashes started right after it.
3. Repair system files. In an administrator terminal run DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow. DISM goes first because it repairs the component store that SFC copies good files from. SFC ends with one of four results: no integrity violations, corrupt files successfully repaired, corrupt files it was unable to fix (details in C:\Windows\Logs\CBS\CBS.log), or could not perform the requested operation, in which case run it again from Safe Mode.
4. Check the drive and firmware. chkdsk C: /scan checks the file system online without a restart. In PowerShell, Get-PhysicalDisk shows each drive’s health status; the drive maker’s tool shows SMART warnings and often installs SSD firmware updates. Also run the PC maker’s hardware diagnostics and check for a BIOS update; suspend BitLocker first, or the PC may ask for its recovery key on the next start.
5. Remove interference. Uninstall “PC optimizer” or debloat tools and retest. On a personal PC, also test without third-party antivirus and fingerprint or MFA sign-in add-ons, then confirm in Windows Security that Microsoft Defender Antivirus is back on. On a work PC, ask whoever manages your IT before removing security software; it can break company policy, and tamper protection often blocks it. A clean boot (msconfig > Services > Hide all Microsoft services > Disable all) isolates the rest; re-enable those services afterward.
6. Scan offline for malware. In Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan), then Scan now. It restarts the PC and scans from the recovery environment before Windows loads, so save your work first.

If DISM stops with The source files could not be found (0x800f081f), give it a local source. Mount a Windows 11 ISO matching your version, edition and language (say it gets E:), find your edition’s index with DISM /Get-WimInfo /WimFile:E:\sources\install.wim, then run DISM /Online /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:6 /LimitAccess with your index in place of 6 (for install.esd, use esd: and that file name). Media older than the PC’s updates may still fail. On office PCs updated through WSUS, the Group Policy setting Specify settings for optional component installation and component repair can let DISM use Windows Update instead.

Fix order when it crashes during startup

If critical process died has the PC in a boot loop, get to the Windows Recovery Environment: Windows opens it after repeated failed starts, or you can interrupt startup twice with the power button. Have your BitLocker recovery key ready (see where to find your BitLocker recovery key), then under Troubleshoot > Advanced options:

1. Uninstall Updates: remove the latest quality update first, then the latest feature update if needed.
2. System Restore: rolls system files and settings back to a restore point but keeps personal files.
3. Point-in-time restore, if your PC has it (Windows 11 version 24H2 and later, directly under Troubleshoot): fast, but it also rolls back personal files, so read the warning in the next section first.
4. Startup Settings, then 4 for Safe Mode. If Safe Mode is stable, a third-party service or driver is involved. Remove tweak tools there, and on a personal PC test without security software or sign-in add-ons (on a work PC, ask IT first). Windows Installer doesn’t run in Safe Mode, so if an uninstaller fails, use the vendor’s removal tool or its steps for enabling Windows Installer there.
5. Command Prompt for offline repair, below.

Offline repair from the command prompt

The recovery environment often assigns different drive letters, so find Windows first: bcdedit shows it as osdevice, or try dir D:\Windows. If the drive is BitLocker-locked, unlock it with manage-bde -unlock D: -RecoveryPassword followed by your 48-digit key. Then, with the right letter:

• If the crashes began during or right after an update, first run DISM /Image:D:\ /Cleanup-Image /RevertPendingActions to back out the half-installed update. Also try it if offline SFC reports There is a system repair pending which requires reboot to complete.
• Run SFC /scannow offline. sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows repairs system files on the offline installation.
• If SFC can’t fix some files, repair the store it copies from, with installation media as the source (say E:). The recovery environment can’t use Windows Update, so the source is required. Run mkdir D:\Scratch, then DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:wim:E:\sources\install.wim:6 /ScratchDir:D:\Scratch with your edition’s index, found as in the previous section, and run SFC again.
• chkdsk D: /f fixes file system errors. It writes to the drive, so if you suspect the drive is failing (clicking, SMART warnings or bad sectors reported earlier), copy your files off before running it.

If every start lands on Automatic Repair, our automatic repair loop guide covers the data-safe order for that screen.

Repairs that keep your files and apps

When system file repair can’t finish the job, reinstall Windows over itself before you consider a reset. Back up first anyway: these options are designed to keep your files, but a failed install or a failing drive can still lose data.

• Reinstall from Settings. On Windows 11 version 22H2 or later with the February 2024 optional update or later, go to Settings > System > Recovery and select Reinstall now next to Fix problems using Windows Update. It keeps your files, apps and settings. It may be missing on PCs whose updates are managed by work or school, such as through Windows Autopatch; use the in-place upgrade instead.
• In-place upgrade from media. With Windows running, start setup.exe from Windows installation media, choose Change what to keep, then Keep personal files and apps. The edition must match your license, Home for Home and Pro for Pro.

Both need Windows to start. Reset this PC with Keep my files works from the recovery environment but removes installed apps and settings, so it comes last, after a backup. Choose Cloud download, which fetches a fresh copy of Windows, over Local reinstall, which rebuilds from the files already on the PC, possibly the damaged ones. Cloud download is a multi-gigabyte download, so a wired connection is safest.

If the crashes began within 10 days of a feature update, going back to the previous version of Windows keeps personal files, though apps and settings changed since the upgrade are removed.

Point-in-time restore (Windows 11 version 24H2 and later) does not keep your files. It reverts the whole PC, personal files included, to a snapshot from roughly the last 72 hours; anything saved since is lost, except files in OneDrive, so copy recent work off first. Start it from Troubleshoot in the recovery environment (Settings > System > Recovery only holds its settings). It’s on by default only on Home PCs and unmanaged Pro PCs with a Windows drive of 200 GB or more, so many office PCs won’t have it.

On Windows 10

The stop code and the DISM, SFC and chkdsk commands are the same, but the Settings reinstall and Point-in-time restore don’t exist, so the repair that keeps files and apps is an in-place upgrade from Windows 10 media of the same edition. Windows 10 also stopped getting security updates in October 2025 for PCs not enrolled in Extended Security Updates.

Match the symptom to the cause

Several office PCs at once

One PC with 0xEF is usually its own drive or its own damaged files. Several PCs failing the same day almost never are. Look for what they share: a security agent or sign-in add-on that updated overnight, a Windows update deployed to all of them, or a script pushed from your management console. Stop that rollout first: in Intune, Pause the update ring (its Uninstall action rolls the update back but restarts devices without an option to delay), or remove the affected groups from an app or script assignment; security agents usually pause from the vendor’s console. Fix one machine, confirm with the vendor before the fix goes to everyone, and collect a minidump plus the System and Application logs from two affected PCs for them.

When it’s hardware, and when to stop

CRITICAL_PROCESS_DIED becomes a hardware problem when the files Windows depends on keep getting damaged. The signs are SMART warnings, chkdsk reporting bad sectors, SFC finding new corruption after successful repairs, or memory test errors (our memory management guide covers RAM testing).

At that point every repair writes to a drive that may be failing. Copy your files off first, ideally as a full image, then repair or replace. Our guide to business file backup and restore covers setting that up properly for next time.

Stop and get help if the PC won’t start and you don’t have the BitLocker key, or if the drive is making noise. If Windows still starts, the drive checks out healthy and you’d rather not do this yourself, this is a typical $59 remote fix; replacing a failing drive is hands-on hardware work and isn’t part of it. See how remote support works.

Common questions

What causes critical process died in Windows 11?

One of the processes Windows can’t run without, such as csrss.exe, wininit.exe or services.exe, ended unexpectedly. Common reasons include damaged system files after an interrupted update, a drive developing bad sectors under those files, security or tweak software interfering with core processes, or a faulty update. A newly installed driver or service can also cause it, so remove anything added just before the crashes started.

Can I fix critical process died without losing my files?

Usually, yes. Uninstall Updates, System Restore, DISM and SFC, offline SFC from the recovery environment, and an in-place reinstall all keep personal files. Reset this PC with Remove everything erases them, Keep my files still removes your apps, and Point-in-time restore loses any file changes made after its restore point. If the drive may be failing, copy your files off before running any repairs, including chkdsk.

Is critical process died a hardware problem?

Sometimes. A failing SSD or hard drive can damage the system files these processes load, and bad RAM can corrupt them in memory. Suspect hardware when SFC keeps finding new corruption after successful repairs, chkdsk reports bad sectors, the drive shows health warnings, or a memory test reports errors.

Why does critical process died happen after a Windows update?

An update replaces many system files. If it’s interrupted, conflicts with security software or lands on a drive with errors, a core process can fail on the next start. Uninstall the latest update from Settings or from Uninstall Updates in the recovery environment, then run DISM and SFC before letting it reinstall.

Does sfc /scannow fix critical process died?

It can, when the cause is damaged system files, which is why it sits near the top of the fix order for this stop code. Run DISM /Online /Cleanup-Image /RestoreHealth first so SFC has good copies to restore from. If Windows won’t start, run SFC offline from the recovery environment using the /offbootdir and /offwindir options.

Can a virus cause critical process died?

It can. Malware that tampers with core processes such as csrss.exe, or that damages system files, can make one of them crash, and Microsoft’s own advice for this stop code includes a virus scan. If the crashes began after installing an unfamiliar program, remove it first. Then run the Microsoft Defender Antivirus offline scan from Windows Security, which checks the PC before Windows loads, and repair system files with DISM and SFC.