PAGE_FAULT_IN_NONPAGED_AREA (bug check 0x50) means kernel-mode code tried to use a memory address that isn’t valid, typically memory that had already been freed or a pointer that was wrong from the start. Windows can’t safely carry on from that inside the kernel, so it stops. Despite the wording, it is not a page file error: the address simply led nowhere.
Microsoft names four kinds of culprit: a faulty driver or system service, antivirus software, a corrupted NTFS volume, and failing hardware, most often memory (system RAM, cache or the graphics card’s video memory).
The quick split: the same third-party driver in every crash, often a security product’s, means that driver. Disk warnings in Event Viewer point at the drive. A different module each time, or a mix of memory-related stop codes, points at RAM.
Try these first
- Note the file under What failed and match it to a cause in the tables below.
- Undo the last change: remove newly added RAM or other hardware, and roll back a driver that just updated.
- Update the antivirus, backup or cloud-sync software whose driver is named, or remove it with the vendor’s tool to test (check that Microsoft Defender turns back on, and on a work PC ask IT first).
- Back up your files, then run chkdsk C: /scan from an administrator terminal.
- If the named module changes from crash to crash, run Windows Memory Diagnostic.
- Set the page file back to system-managed if you or a tuning tool changed it.
0x50 vs MEMORY_MANAGEMENT vs IRQL: which memory problem is this?
Three common stop codes involve memory, and they send you in different directions:
| Stop code | What went wrong | Where it usually points |
|---|---|---|
PAGE_FAULT_IN_NONPAGED_AREA (0x50) | Code referenced an address with nothing valid behind it, usually a wrong pointer or memory that had already been freed. | A driver, service or security filter first; then the disk and RAM |
MEMORY_MANAGEMENT (0x1A) | Windows’ memory manager found its own structures, such as page tables, inconsistent. | RAM and memory settings first, plus some driver and page file variants |
IRQL_NOT_LESS_OR_EQUAL (0xA) | Code touched pageable or invalid memory while running at raised priority. | Drivers, often network, USB or security |
If your PC alternates between stop code 0x50 and 0x1A, do the RAM checks in our memory management guide first, because Microsoft marks several 0x1A variants as probably hardware. Mixed 0x50 and 0xA crashes in network or USB drivers are covered in our IRQL_NOT_LESS_OR_EQUAL guide.
Decision table: what your crashes point to
| What you see | Likely cause | First move |
|---|---|---|
| The same security, backup, encryption or sync product’s driver named each time | That product’s file system filter driver | Update it, then test without it (filter driver section below); if it’s disk encryption software, get help before removing anything |
| The same hardware driver each time: Wi-Fi, mobile broadband, dock or USB adapter | That device’s driver | Update it or disconnect the device. |
| Began right after installing or updating an app or background service | That service, or settings it reads at startup | Update or reinstall it; Microsoft notes a reinstall can repair its corrupted registry settings |
| Began after adding RAM or another internal part | The new part | Remove it and run a few days without it |
| Disk warnings in Event Viewer, slow file opening, or chkdsk errors | The drive or its NTFS file system | Back up, then the disk steps below |
| A different module every crash, other memory stop codes | RAM or memory settings | Memory test at default memory settings |
A graphics driver named, such as nvlddmkm.sys (NVIDIA) or amdkmdag.sys (AMD), or crashes only in games or graphics work | The graphics driver, or the card’s video memory | Reinstall the GPU driver; if glitches persist, suspect the card |
| Many PCs at once, at startup, after a security update | A faulty security product update | The vendor’s and Microsoft’s remediation (below) |
If the screen or dump names a Windows file
| File named | What it is | Where to go |
|---|---|---|
ntfs.sys | Windows’ NTFS file system driver, rarely damaged itself | Back up, then the drive checks below; if the drive is clean, check the filters loaded above it, then test the RAM |
fltmgr.sys | Windows’ Filter Manager, which hosts antivirus, backup, encryption and sync filters | A third-party filter: the filter driver section below |
tcpip.sys, netio.sys, ndis.sys | Windows’ network stack | The Wi-Fi, Ethernet or VPN driver attached to it; update it, or test with that adapter disabled |
win32kfull.sys, win32kbase.sys | Windows’ windowing and drawing code | Usually the graphics driver (table above) |
Only ntoskrnl.exe or other Windows files, every time | Where the bad address was used, not who supplied it | Look further down the dump’s STACK_TEXT for a third-party module and compare several dumps; if none appears, try a clean boot (the IRQL guide linked above has the steps), then the RAM test |
Don’t download replacement .sys files. If a Windows file really is damaged, DISM and sfc /scannow restore it from Microsoft’s own copies.
If it crashes during startup
Have your BitLocker recovery key ready first. After two failed starts in a row, Windows opens the Windows Recovery Environment (WinRE); our blue screen of death guide covers the other ways in. Choose Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode.
- If Safe Mode stays up: remove the security, backup or sync product, or roll back the driver, that the tables point to.
- If it crashes in Safe Mode as well: from WinRE, try Uninstall Updates (if it began right after Windows Update) or System Restore; if neither helps, suspect the drive or RAM.
Read the four parameters
If the pattern above hasn’t named a suspect, the four values recorded with each crash can help; the blue screen of death guide linked above shows how to get them. For 0x50 they mean:
| Parameter | Meaning | What it suggests |
|---|---|---|
| 1 | The memory address referenced | The same address with the same module in several crashes is one driver’s bug. Unrelated addresses with changing modules suggest corruption, often RAM. |
| 2 | The operation. On Intel and AMD PCs: 0x0 read, 0x2 write, 0x10 execute. On Arm PCs, such as Snapdragon laptops: 0x0 read, 0x1 write, 0x8 execute. WinDbg’s label beside Arg2 may still say “1 = write operation”, so go by these values. | Execute means the processor was sent to run code at an address with nothing there, a sign of a corrupted function pointer or code that was already unloaded. |
| 3 | The instruction that referenced the address, if known | In WinDbg, ln plus this value names the module and function. |
| 4 | On current Windows, the type of fault | 0x0: the address is on a page table entry marked as free, usually memory that had already been released. 0x2: no valid page table entry for the address. 0x4: an address that can’t exist on a 64-bit PC at all, meaning the pointer was garbage. 0xF: kernel code reached into an application’s memory where it wasn’t allowed, a driver coding error. Older builds and debuggers may label it reserved. |
Antivirus and other filter drivers
Security, backup, encryption and cloud-sync products commonly install file system minifilter drivers, which Windows’ Filter Manager (fltmgr.sys) calls on file operations, so a bug in one can surface as 0x50 in any program that opens or saves a file.
- See what’s loaded. In an administrator terminal, run
fltmc filters. Each line is a loaded minifilter. Several belong to Windows itself, includingWdFilter(Microsoft Defender),CldFlt(OneDrive and other cloud files),FileInfo,bindflt,wcifsandluafv; leave those alone. Third-party names don’t always match the product, but an Altitude between 320000 and 329998 marks an antivirus filter. - Update the product to a release that supports your Windows build.
- Test without it properly. Microsoft points out that a product’s filter driver stays loaded even after you stop its service. For a real test, uninstall it with the vendor’s removal tool and restart. Microsoft Defender Antivirus normally switches itself back on; confirm that in Windows Security. Don’t do this with disk or file encryption software: removing it before the data is decrypted can leave your files or the whole drive unreadable, so get help instead.
- On a company PC, leave security agents to whoever manages them; removal usually needs their management console.
The July 2024 example
In July 2024 a faulty CrowdStrike Falcon update affected 8.5 million Windows devices, by Microsoft’s estimate. Microsoft’s recovery article, KB5042421, describes PCs stuck in a restart loop showing 0x50 or 0x7E. The fix was to delete the faulty file from the agent’s driver folder in Safe Mode, entering the BitLocker recovery key when asked, or to use System Restore.
The lesson for an office: security agents run in the kernel and update often, so one bad update can reach every PC in a day. Use a pilot group where your vendor offers staged updates, and keep BitLocker keys retrievable. Our SYSTEM_THREAD_EXCEPTION_NOT_HANDLED guide covers Windows 11’s quick machine recovery, designed for mass boot failures like this. For managed EDR and antivirus on every PC, see our endpoint protection service.
Rather have a technician sort it out?
With your approval, a technician can connect, check which driver or filter the crash dumps blame, look over the drive and the page file settings, and tell you plainly whether the RAM or disk looks like it needs replacing. A GoProIT technician can connect remotely, with your permission, and fix it while you watch. $59 per fix, Mon–Fri 8am–8pm ET.
Check the drive, carefully
A corrupted NTFS volume is one of Microsoft’s listed causes, and its fix list includes chkdsk /f /r. So the common page fault in nonpaged area chkdsk advice is sound, as long as you work in this order: a full repair pass on a failing drive is the worst time to have your only copy of your files on it.
- Back up first. Copy anything you can’t afford to lose to an external drive or cloud storage.
- Look for warnings. In Event Viewer > Windows Logs > System, filter for errors and warnings around the crash times. Repeated Event ID 129 or 153 entries from the disk or storage drivers mean requests to the drive timed out or had to be retried, a reason to check the whole disk path: the drive, its cable or connection, the storage driver and the SSD firmware.
- Scan online. Run
chkdsk C: /scanin an administrator terminal. It checks the NTFS volume while Windows runs, without a restart. - Repair if errors are found. Run
chkdsk C: /f /r. The system drive is in use, so chkdsk offers to check it at the next restart; answer Y and restart. The/rpass reads every sector and can take hours on a large hard drive. Microsoft advises against interrupting it. - Test the hardware. Run the drive maker’s or PC maker’s diagnostics. If they report a failing drive, replace it rather than repeating repairs.
RAM and the page file: what to check, and what to skip
Suspect RAM when the module changes between crashes, other memory stop codes appear, or the crashes began after memory was added.
- Run Windows Memory Diagnostic (
mdsched.exe). After the restart, the result is logged in Event Viewer’s System log under MemoryDiagnostics-Results. - For a stronger check, run PassMark’s MemTest86 overnight from a USB drive.
- Turn off XMP or EXPO memory profiles and any overclock in BIOS setup while you test (have your BitLocker recovery key ready first, since some BIOS changes trigger a recovery prompt); if the crashes stop, leave them off.
The memory management guide linked above covers the extended test settings and testing one module at a time.
RAM passes and no driver repeats
Microsoft’s 0x50 reference recommends Driver Verifier here: its Special Pool check catches a verified driver touching memory it has already freed, so the next dump names it. Follow the steps and warnings in the blue screen of death guide linked above, and verify only a few suspect non-Microsoft drivers.
The page file
The stop code’s name sends many people into the virtual memory settings, but Microsoft doesn’t list the page file among the causes of 0x50. Turning it off can backfire: Windows can use the page file to back crash dumps, so you may lose the next crash’s evidence, and if committed memory runs out, Microsoft warns of freezing, crashing and other malfunctions.
If you or a tuning tool set a small fixed size, moved the page file to another drive or turned it off, go to System Properties > Advanced > Performance Settings > Advanced > Virtual memory Change, tick Automatically manage paging file size for all drives and restart.
When it’s hardware, and when to stop
- Any memory test error: replace the module, and avoid saving important work on that PC until you do, because bad RAM can corrupt files as they’re written.
- Drive diagnostics fail, chkdsk errors return after repair, or the drive clicks: copy your data off and replace the drive.
- Crashes continue in Safe Mode and no dump shows a third-party module.
- On-screen glitches plus 0x50 in the graphics driver, even after a clean driver install and with the card at default clocks: the card or its memory may be failing.
Stop and get help if disk errors appear and your files aren’t backed up, if you can’t reach the desktop and don’t have the BitLocker recovery key, or if the suspect driver belongs to disk encryption software. When the cause is a driver, a filter or a settings problem and Windows stays up long enough to connect, this is a typical $59 remote fix: with your approval, a technician connects, reads the dumps, checks the drive and works on the software side while you watch, and you can end the session at any time. Replacing RAM or a drive has to be done in person, and parts aren’t included. See how remote support works.
Common questions
Is PAGE_FAULT_IN_NONPAGED_AREA caused by bad RAM?
Sometimes, but not first. Microsoft lists faulty drivers, system services, antivirus software and a corrupted NTFS volume alongside hardware. RAM becomes the lead when the module named changes every crash, memory-related stop codes such as MEMORY_MANAGEMENT appear too, or the crashes started after memory was added or an XMP or EXPO profile was switched on. A memory test at default settings settles it.
What is the difference between paged and nonpaged memory?
Paged memory can be moved out to the page file on disk when RAM is busy and read back when needed. Nonpaged memory is kernel memory that must stay in RAM at all times, because the code using it can’t wait for the disk. The stop code’s name refers to where the bad address appeared to be; the real problem is that the address was invalid.
Can a failing SSD or hard drive cause PAGE_FAULT_IN_NONPAGED_AREA?
It can. Microsoft lists a corrupted NTFS volume among the causes, and a drive that is failing or losing its connection is one way to end up with one. Warning signs are disk errors in Event Viewer, chkdsk errors, or files that open slowly or come back damaged. Back up first, run chkdsk C: /scan and the drive maker’s diagnostics, and replace the drive if they report a fault rather than repeating repairs.
Why does PAGE_FAULT_IN_NONPAGED_AREA keep happening after I replaced the RAM?
Then the memory probably wasn’t the cause, or wasn’t the only one. Check that XMP or EXPO is off and that the new memory is on your PC or motherboard maker’s compatibility list, then look at the dumps again for a repeating driver or security filter, and check the drive. Bad RAM can also leave damaged system files behind, so once the new memory has run a day without crashing, run DISM /Online /Cleanup-Image /RestoreHealth and then sfc /scannow.
Is it safe to keep using the PC while it has this error?
With care. If the cause is a driver, each crash mainly costs unsaved work. If it’s failing RAM or a failing drive, files can be damaged as they’re saved, so back up right away, avoid large copies and updates, and stop doing important work on the PC until the RAM test and drive checks come back clean.