System Service Exception (0x3B): Fix It by the File That Failed

SYSTEM_SERVICE_EXCEPTION (bug check 0x3B) means something went wrong while Windows was running a system service routine: the kernel code that takes over when a program hands Windows a request, such as drawing a window, opening a file or sending network data. The program asked; kernel-mode code, usually a driver, mishandled the request, most often by touching a memory address it couldn’t use. The stop code system service exception looks the same on Windows 11 and Windows 10; on Windows 11 version 24H2 and later the stop screen may be black instead of blue.

Microsoft notes that an ordinary app can trigger a stop error but is rarely its root cause; the app is usually exposing a fault in a driver, the hardware or Windows. So don’t start by uninstalling the game or browser you had open.

Start with the file Windows blamed, shown under What failed on the stop screen or recorded in the crash dump. A graphics driver, a win32k file, ks.sys, a network file or a security product’s driver each lead somewhere different, and the table below maps them. If nothing useful is named, the dump section shows how to recover the real suspect.

Match the named file to the fix

To find who made an unfamiliar file, open C:\Windows\System32\drivers, right-click the file, select Properties and open the Details tab. Product name and Copyright usually identify the vendor. If it isn’t in that folder, search for it under C:\Windows\System32\DriverStore\FileRepository.

Graphics driver and win32k crashes

Graphics drivers are a common source of 0x3B, and Microsoft’s reference for this code notes it has been linked to user-mode graphics drivers passing bad data down to kernel code. The usual pattern: crashes while gaming, editing photos or video, driving several monitors, or in apps that use hardware acceleration. A system service exception nvlddmkm.sys crash points at the NVIDIA driver, and a system service exception win32kfull.sys crash usually means a graphics driver or a UI tool fed bad data into Windows’ drawing code.

1. Identify the GPU. Open Device Manager and expand Display adapters. Many laptops list two, an Intel or AMD integrated chip plus an NVIDIA one; the file name tells you which crashed.
2. Get the driver from the right source. On laptops and business desktops, start with the PC maker’s driver for your exact model, since it may be tuned for that hardware. On a desktop with an add-in card, the GPU maker’s current release is normal. If the crashes began right after a driver update, roll that update back instead: device Properties > Driver > Roll Back Driver.
3. Reinstall cleanly if updating doesn’t help. Installing over a damaged driver can keep the fault, so remove the old driver and its settings first. Our VIDEO_TDR_FAILURE guide covers the clean-install route for each GPU brand, including NVIDIA’s clean-installation option and AMD’s Cleanup Utility.
4. Remove UI modification tools. Start menu replacements, taskbar tweakers and theme patchers hook into the windowing code the win32k files run, so uninstall them for a week as a test.
5. Bring Windows up to date. The win32k files are part of Windows and change with cumulative updates, so install anything pending and restart.

VPN, security and webcam drivers: how to test each

These products load kernel drivers that sit in the path of everyday system calls, so their bugs tend to surface as 0x3B while some unrelated app is running.

• VPN clients. If crashes come only while the tunnel is connecting or connected, install a client version that lists your Windows build as supported. For a real test, uninstall the client instead of simply disconnecting, because its virtual adapter and filter drivers remain in place otherwise.
• Antivirus and endpoint agents. Update first. To test, remove the product with the vendor’s removal tool and let Microsoft Defender Antivirus take over, then confirm protection is on in Windows Security. On a company PC the agent is managed centrally and often tamper-protected, so ask your IT contact instead of removing it.
• Webcams and capture devices. If ks.sys or a camera driver is named, or crashes line up with video calls, unplug the external camera or disable the built-in one (Device Manager > Cameras > right-click > Disable device) for a few days. Then install the current driver from the camera or PC maker, and uninstall virtual camera, background-effect or capture utilities you no longer use.

Give each change several days of normal use, including whatever used to trigger the crash.

Crashes at startup or right after sign-in

If 0x3B hits before the desktop loads, or within a minute of every sign-in, find your BitLocker recovery key first, because Windows may ask for it on the way. Then open the Windows Recovery Environment (WinRE) as our blue screen of death guide describes, choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking.

If Safe Mode stays up, a third-party driver or service is the likely cause. Roll back or disable the device whose driver the stop screen named, or uninstall the VPN, security or camera software you added most recently; if its normal uninstaller won’t run in Safe Mode, use the vendor’s removal tool. If Safe Mode crashes too, our system thread exception guide covers Startup Repair, Uninstall Updates and System Restore in a safe order; the steps are the same for 0x3B.

What the crash data tells you

Every 0x3B records four values. The blue screen guide linked above shows where to read them, in Reliability Monitor or in WinDbg. For this code they mean:

In the !analyze -v output, PROCESS_NAME is the program whose request was being handled; MODULE_NAME and IMAGE_NAME are the code Windows holds responsible. Treat the process as the trigger and the module as the suspect. If every crash shows the same process, such as one game or the VPN client’s own program, that narrows the driver family even when the module is a Windows file.

No useful file named? Rebuild the stack from parameter 3

When the dump blames ntoskrnl.exe or nothing specific, the default stack can show Windows dealing with the exception rather than the code that raised it. Microsoft’s debugging steps for 0x3B fix that:

1. Open the dump in WinDbg and run !analyze -v; setup is covered in the blue screen guide linked above.
2. Run .cxr followed by the parameter 3 value (Arg3), for example .cxr ffff9c0a746c2330. This switches the debugger to the processor state at the moment of the exception.
3. Run kb. The stack now begins at the faulting code; read down it for the first module that isn’t part of Windows.

Do this for two or three dumps. The same third-party module in each is your driver. A different module every time, especially alongside other stop codes such as MEMORY_MANAGEMENT, points to memory instead; our memory management guide explains how to test RAM properly. If nothing repeats and the memory passes, Driver Verifier can force the faulty driver to name itself; follow the blue screen guide’s steps and warnings, and verify only third-party drivers.

When a Windows file is named: DISM and SFC

Microsoft’s stop-error guide recommends System File Checker for SYSTEM_SERVICE_EXCEPTION. It’s most worthwhile when the blamed file belongs to Windows and the crashes began after a failed or interrupted update, or the PC shows other signs of damaged system files.

1. Install pending Windows updates and restart.
2. Open Terminal (Admin) or Command Prompt as administrator and run DISM.exe /Online /Cleanup-image /Restorehealth. It repairs the component store that SFC copies from and can take several minutes.
3. When DISM reports that the operation completed successfully, run sfc /scannow and wait for Verification 100% complete.
4. Restart, whatever the result.

SFC replaces damaged Microsoft files, so it can’t help when a third-party driver is feeding bad data to a perfectly healthy win32kfull.sys. If the crashes continue after a clean result, return to the graphics and driver steps.

Several office PCs with 0x3B at once

When several PCs show 0x3B within days, look at what reached all of them: usually a VPN client or security agent update, a graphics driver from Windows Update or the PC maker’s tool, or a new conferencing or camera utility. Compare MODULE_NAME and PROCESS_NAME in dumps from two affected PCs; a match names the product.

Roll it back from the vendor’s console or its Intune app assignment, and send the vendor the dumps with the version number. Start with the small dumps in C:\Windows\Minidump. A full MEMORY.DMP can hold fragments of whatever was in memory, so check your data-handling obligations before sending one from a PC with client records.

For a driver Windows Update delivered, roll it back in Device Manager on the PCs that already crash; the blue screen guide’s office section shows how to keep it off the rest. The Intune route it describes needs Intune plus a Windows license that includes Windows Autopatch, such as Microsoft 365 Business Premium or Windows Enterprise E3/E5. If nobody has time to compare dumps across machines, our help desk service handles this kind of multi-PC triage remotely.

When it’s hardware, and when to stop

Lean toward hardware when:

• 0x3B stops once XMP or EXPO memory profiles and any CPU overclock are turned off in BIOS setup (have your BitLocker recovery key ready first, since some BIOS changes trigger a recovery prompt) and any GPU overclock is reset in its tuning app. The overclock, not a driver, was the problem, so leave them at default.
• A different module and a different stop code appear from crash to crash, or a memory test reports any error.
• Crashes happen only under graphics load and come with colored blocks, lines or flicker on screen, even after a clean driver install. The graphics card or its memory may be failing; check its temperatures as well.
• 0x3B still happens in Safe Mode, where most third-party drivers stay unloaded. The exception: disk encryption and some security drivers load in Safe Mode too, so check whether the dump still names one of them.

Stop and get help if a crash interrupts a BIOS or firmware update, if the suspect driver belongs to disk encryption software (a wrong removal can leave the drive unreadable), or if the PC won’t stay up long enough to back up your files. If Windows stays up long enough to connect, this is a typical $59 remote fix: with your approval, a technician reads the dumps, looks for the module behind the crashes and, if it’s a driver, updates or removes it while you watch. You can end the session at any time. Failing hardware still has to be replaced in person. See how remote support works.

Common questions

Can bad RAM cause SYSTEM_SERVICE_EXCEPTION?

It can, though a driver is the likelier cause. Bad memory corrupts data that kernel code later uses, so the crash lands in whichever driver happened to be running. Suspect RAM when the named module changes every time or other memory stop codes appear. Run Windows Memory Diagnostic, press F1 when it starts, choose the Extended test mix and press F10; any error points to a bad module or slot.

How is SYSTEM_SERVICE_EXCEPTION different from SYSTEM_THREAD_EXCEPTION_NOT_HANDLED?

Both are unhandled exceptions in kernel code, but the context differs. 0x3B happens while the kernel is carrying out a request from a program, so an app is usually running when it crashes. 0x7E happens in a system thread, kernel work that Windows or a driver runs in the background on its own, so it can strike with no app involved, even at startup or while the PC sits idle. The fix for both still starts with the file Windows names.

Why do I get a system service exception only when gaming?

Games make heavy, constant use of the graphics stack, so a weak spot in the GPU driver, an overlay or recording tool, or an overclock shows up there first. Many competitive games also load a kernel anti-cheat driver, such as Riot Vanguard’s vgk.sys; if the dump names one, update or reinstall the game. Otherwise reinstall the display driver, remove overlay and tuning utilities, and reset any GPU or memory overclock. If crashes continue at stock settings, check the card’s temperatures and power connections.

Can a Windows update cause SYSTEM_SERVICE_EXCEPTION?

It can, usually indirectly. Windows Update may install a new driver that misbehaves on your hardware, or a new Windows build may expose an older driver that was never updated for it. Microsoft’s own code accounts for only a small share of stop errors. Check Update history for drivers installed the day the crashes started, and roll back that driver before removing the Windows update itself.

Should I download a replacement win32kfull.sys or ks.sys file?

No. These are Windows system files, and copies from download sites can be the wrong version or carry malware. Let Windows repair them: install pending updates, then run DISM with RestoreHealth followed by sfc /scannow from an administrator prompt. In most cases the Windows file named on screen isn’t damaged at all; a driver passed it bad data.

Is it safe to keep using a PC that shows SYSTEM_SERVICE_EXCEPTION?

For a short while, with care. Each crash can lose unsaved work and can corrupt a file that was being written at that moment. Save often, avoid running updates or large file copies until the cause is found, and make sure your backups are current. If the crashes are frequent or the PC shows disk or memory errors, stop using it for important work.