What is the exact stop code for CRITICAL_PROCESS_DIED and where can I look it up on Microsoft's site?

The Windows stop code for CRITICAL_PROCESS_DIED is 0x000000EF. Microsoft documents all BSOD bug check codes at https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference. You can also navigate directly to microsoft.com/stopcode while on Windows to be redirected to the relevant troubleshooting page for the error displayed on your blue screen.

Why does CRITICAL_PROCESS_DIED keep happening after a fresh Windows install?

If the error persists after a clean install, the cause is almost certainly hardware-related rather than software. The most common culprits are: (1) defective RAM — run MemTest86 for multiple passes; (2) a failing storage drive — check SMART data with CrystalDiskInfo; (3) overheating CPU or GPU — check temperatures with HWiNFO64 under load; (4) a faulty power supply providing unstable voltages; or (5) incompatible hardware, such as XMP/EXPO RAM profiles that are too aggressive for the motherboard. Start with memory and storage tests before replacing components.

Can a virus or malware cause the CRITICAL_PROCESS_DIED blue screen?

Yes. Rootkits and kernel-level malware can corrupt or terminate critical Windows processes. If you suspect malware, boot from a Windows Defender Offline scan (Settings → Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan) or use a bootable antivirus rescue disk such as Kaspersky Rescue Disk or Bitdefender Rescue Environment. Run the scan before attempting system file repairs so you remove the infection first.

How do I fix CRITICAL_PROCESS_DIED when Windows won't boot at all?

Boot from a Windows 10/11 installation USB. At the setup screen, choose 'Repair your computer' → Troubleshoot → Advanced Options. From there you have several options: (1) Startup Repair — attempts automatic fixes; (2) Command Prompt — lets you run SFC /scannow offline, DISM, chkdsk, and bootrec /fixbrs; (3) System Restore — reverts to a previous restore point; (4) Uninstall Updates — removes the most recent cumulative update. If nothing works, use the same USB to perform a clean install or in-place upgrade repair.

Does CRITICAL_PROCESS_DIED always mean I need to reinstall Windows?

No. The majority of CRITICAL_PROCESS_DIED cases are resolved without reinstalling Windows. In most cases, running SFC /scannow and DISM /RestoreHealth, rolling back a faulty driver, replacing bad RAM, or uninstalling a problematic Windows Update is sufficient. A full reinstall or reset should only be considered after all software-based repairs and hardware diagnostics have been exhausted.

CRITICAL_PROCESS_DIED: How to Fix the Microsoft Stop Code Blue Screen Error

Fix the CRITICAL_PROCESS_DIED blue screen on Windows. Step-by-step guide covering SFC scans, driver rollbacks, DISM repair, and registry fixes.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,015 words

Key Takeaways

CRITICAL_PROCESS_DIED (Stop Code 0x000000EF) occurs when a critical Windows kernel process terminates unexpectedly due to corruption, driver conflicts, or hardware faults.
Faulty third-party drivers, corrupted system files, bad RAM, failing storage devices, and recent Windows Updates are the most frequent root causes.
Run SFC /scannow and DISM /RestoreHealth in an elevated Command Prompt or WinPE environment to repair system files; roll back or uninstall the offending driver if a driver is implicated; test RAM with Windows Memory Diagnostic or MemTest86; and use System Restore or a clean boot to isolate software conflicts.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC /scannow + DISM /RestoreHealth	Corrupted or missing Windows system files suspected	15–30 min	Low
Driver Rollback / Uninstall	BSOD started after driver or hardware install	5–15 min	Low
Windows Memory Diagnostic / MemTest86	Random BSODs across multiple stop codes or after RAM change	30 min – 8 hr	None
Check Disk (chkdsk)	Failing SSD/HDD suspected, disk errors in Event Viewer	10–60 min	Low
System Restore	Error appeared after a specific Windows Update or software install	15–20 min	Low (reversible)
Clean Boot	Isolating third-party software conflicts	10–20 min	None
In-Place Upgrade Repair	Severe corruption that SFC/DISM cannot resolve	1–2 hr	Low (keeps files)
Reset / Fresh Install	All other methods have failed	2–4 hr	Medium (data loss risk)

Understanding the CRITICAL_PROCESS_DIED Error

When Windows displays the stop code CRITICAL_PROCESS_DIED (Bug Check 0x000000EF), it means the Windows kernel detected that a process marked as critical — such as smss.exe (Session Manager), csrss.exe (Client/Server Runtime), wininit.exe, or winlogon.exe — terminated when it should not have. Because these processes are fundamental to Windows operation, the kernel intentionally halts the system to prevent data corruption or security compromise.

You will see a blue screen with text similar to:

Your PC ran into a problem and needs to restart.
We're just collecting some error info, and then we'll restart for you.

Stop code: CRITICAL_PROCESS_DIED

On older Windows 10 builds and Windows 8/8.1, the stop code may also appear on Microsoft's support site at microsoft.com/stopcode as error 0x000000EF.

Step 1: Identify the Failing Process with Event Viewer and Minidumps

Before applying any fix, determine what actually crashed. Windows writes a minidump file (typically to C:\Windows\Minidump\) each time a BSOD occurs.

a) Read the minidump with WinDbg:

Install WinDbg from the Microsoft Store or from the Windows SDK.
Open WinDbg → File → Open Crash Dump → select the latest .dmp file.
In the command window type: !analyze -v
Look for the IMAGE_NAME field — this identifies the driver or executable responsible.

b) Check Event Viewer:

Press Win + R, type eventvwr.msc, press Enter.
Navigate to Windows Logs → System.
Filter for Critical and Error events around the time of the crash.
Look for sources like BugCheck, Kernel-Power, disk, or volmgr.

Step 2: Run SFC and DISM to Repair System Files

Corrupted Windows system files are one of the top causes of CRITICAL_PROCESS_DIED. Use the built-in repair tools:

If Windows boots normally:

Right-click the Start button → Windows Terminal (Admin) or Command Prompt (Admin).
Run SFC first:
```
sfc /scannow
```

After SFC completes, run DISM to repair the Windows component store:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Restart and check if the BSOD recurs.

If Windows does not boot (WinPE / Recovery Environment):

Boot from a Windows installation USB.
Select Repair your computer → Troubleshoot → Command Prompt.
Identify the Windows drive letter (usually D: or C:) by running diskpart then list vol.

Run SFC against the offline Windows installation:

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Run DISM against the offline image:

DISM /Image:C:\ /Cleanup-Image /RestoreHealth

Step 3: Roll Back or Remove the Offending Driver

If the minidump or Event Viewer points to a specific driver (e.g., nvlddmkm.sys for NVIDIA, atikmpag.sys for AMD, a NIC driver, or antivirus kernel filter), roll it back or uninstall it.

Boot into Safe Mode: Hold Shift while clicking Restart → Troubleshoot → Advanced Options → Startup Settings → Restart → press 4 for Safe Mode.
Open Device Manager (devmgmt.msc).
Locate the device associated with the flagged driver.
Right-click → Properties → Driver tab → Roll Back Driver (if available).
If Roll Back is greyed out, right-click the device → Uninstall device → check Delete the driver software → Uninstall.
Restart normally and let Windows install the default driver, or manually install a stable older version from the manufacturer's site.

Tip: Use Display Driver Uninstaller (DDU) for GPU driver removal in Safe Mode to ensure no remnants remain.

Step 4: Run Check Disk to Scan for Storage Errors

A failing hard drive or SSD can corrupt process executables mid-read, triggering CRITICAL_PROCESS_DIED.

chkdsk C: /f /r /x

If the drive is in use, Windows will prompt you to schedule the scan on the next reboot — type Y and restart. For SSDs, also check manufacturer diagnostic tools (Samsung Magician, Crucial Storage Executive, CrystalDiskInfo) for reallocated sector counts and health status.

Step 5: Test RAM

Defective memory causes non-deterministic BSODs across various stop codes including CRITICAL_PROCESS_DIED.

Windows Memory Diagnostic (quick):

Press Win + R, type mdsched.exe, press Enter.
Choose Restart now and check for problems.
Review results in Event Viewer → Windows Logs → System (source: MemoryDiagnostics-Results) after reboot.

MemTest86 (thorough): Download MemTest86 from memtest86.com, write to a USB drive, boot from it, and let it run for at least two full passes (or overnight). Any errors indicate faulty RAM — reseat or replace the affected DIMM.

Step 6: Uninstall Recent Windows Updates

If CRITICAL_PROCESS_DIED began after a specific Patch Tuesday update:

Open Settings → Windows Update → Update history → Uninstall updates.
Sort by Installed On and remove the most recent Cumulative Update.

Alternatively, from the Recovery Environment Command Prompt:

dism /image:C:\ /get-packages
dism /image:C:\ /remove-package /packagename:<PackageName>

Step 7: Perform a Clean Boot to Isolate Software Conflicts

Press Win + R, type msconfig, press Enter.
On the Services tab, check Hide all Microsoft services, then click Disable all.
On the Startup tab, click Open Task Manager and disable all startup items.
Click OK and restart.
If the BSOD stops, re-enable services and startup items in batches to identify the culprit.

Step 8: In-Place Upgrade Repair (Last Resort Before Reset)

If all above steps fail, an in-place upgrade reinstalls Windows while preserving your personal files and most applications:

Download the Media Creation Tool from microsoft.com and create a bootable USB or mount the ISO.
Run setup.exe from within Windows.
Select Upgrade this PC now → accept the license → choose Keep personal files and apps.
Complete the installation.

This replaces all Windows system binaries without touching your data.

Frequently Asked Questions

powershell

# ============================================================
# CRITICAL_PROCESS_DIED Diagnostic & Repair Script
# Run in an elevated PowerShell (Admin) session
# ============================================================

# --- 1. Collect basic system info ---
Write-Host "=== System Information ==" -ForegroundColor Cyan
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsHardwareAbstractionLayer, TotalPhysicalMemory

# --- 2. List minidump files (most recent first) ---
Write-Host "`n=== Recent Minidump Files ==" -ForegroundColor Cyan
$dumpPath = "$env:SystemRoot\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length
} else {
    Write-Host "No minidump folder found. Enable small memory dumps via: System Properties > Advanced > Startup and Recovery."
}

# --- 3. Query Event Viewer for BugCheck events (last 10) ---
Write-Host "`n=== Last 10 BugCheck Events (Event ID 1001) ==" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 10 -ErrorAction SilentlyContinue |
    Select-Object TimeCreated, Message | Format-List

# --- 4. Run System File Checker ---
Write-Host "`n=== Running SFC /scannow ==" -ForegroundColor Cyan
sfc /scannow

# --- 5. Run DISM to repair Windows component store ---
Write-Host "`n=== Running DISM RestoreHealth ==" -ForegroundColor Cyan
Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth

# --- 6. Check disk for errors (schedule on next reboot) ---
Write-Host "`n=== Scheduling chkdsk on C: ==" -ForegroundColor Cyan
echo Y | chkdsk C: /f /r /x

# --- 7. List recently installed drivers ---
Write-Host "`n=== Drivers Installed in Last 30 Days ==" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
Get-WmiObject Win32_PnPSignedDriver |
    Where-Object { $_.DriverDate -and [datetime]::ParseExact($_.DriverDate.Substring(0,8),'yyyyMMdd',$null) -gt $cutoff } |
    Select-Object DeviceName, DriverVersion, DriverDate, Manufacturer |
    Sort-Object DriverDate -Descending

# --- 8. Check for critical services that may be stopped ---
Write-Host "`n=== Status of Critical Windows Services ==" -ForegroundColor Cyan
$services = @('wininit','csrss','smss','lsass','services','winlogon')
foreach ($svc in $services) {
    $proc = Get-Process -Name $svc -ErrorAction SilentlyContinue
    if ($proc) {
        Write-Host "[RUNNING] $svc (PID: $($proc.Id))" -ForegroundColor Green
    } else {
        Write-Host "[NOT FOUND] $svc" -ForegroundColor Red
    }
}

# --- 9. Run Windows Memory Diagnostic (interactive) ---
Write-Host "`n=== Launching Windows Memory Diagnostic ==" -ForegroundColor Cyan
Write-Host "Choose 'Restart now and check for problems' to test RAM."
Start-Process mdsched.exe

# --- 10. Export results to desktop ---
$report = "$env:USERPROFILE\Desktop\BSOD_Diagnostic_Report.txt"
"CRITICAL_PROCESS_DIED Diagnostic Report - $(Get-Date)" | Out-File $report
"Run the script output manually and save it here for further analysis." | Out-File $report -Append
Write-Host "`nDiagnostic complete. Review minidumps with WinDbg ('!analyze -v') for definitive root cause." -ForegroundColor Yellow

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows system administrators with decades of combined experience diagnosing kernel panics, blue screens, and system-level failures across enterprise and consumer Windows environments. Our guides are built on real-world incident postmortems, Microsoft documentation, and community-verified fixes.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.