CRITICAL_PROCESS_DIED: How to Fix the Microsoft Stop Code on Windows 10 & 11

Understanding the CRITICAL_PROCESS_DIED Error

When Windows displays the blue screen of death (BSOD) with the stop code CRITICAL_PROCESS_DIED (bug check code 0x000000EF), it means a process that the Windows kernel deemed essential for system operation terminated abnormally. Unlike optional services that can crash and restart, critical processes such as smss.exe (Session Manager), csrss.exe (Client/Server Runtime), wininit.exe, or lsass.exe cannot die without bringing down the entire OS.

The full error string displayed on the blue screen reads:

Your PC ran into a problem and needs to restart.
Stop Code: CRITICAL_PROCESS_DIED

On older Windows 10 builds you may also see the legacy format referencing microsoft.com/stopcode critical process died, which points users to the Microsoft support page for bug check 0xEF.

Step 1: Capture Crash Dump Information from Event Viewer

Before applying any fix, identify exactly which process triggered the crash.

1. Press Win + R, type eventvwr.msc, and press Enter.
2. Navigate to Windows Logs > System.
3. Filter by Event ID 41 (Kernel-Power unexpected shutdown) and Event ID 1001 (BugCheck).
4. Open the most recent BugCheck event and note the parameters — the second parameter (P2) is the memory address of the offending process object.
5. Also check Windows Logs > Application for any crashes from smss.exe, csrss.exe, wininit.exe, or lsass.exe in the minutes before the BSOD.

Alternatively, use WinDbg or the built-in minidump files:

• Minidumps are stored at C:\Windows\Minidump\
• Open them in WinDbg and run !analyze -v for a full stack trace.

Step 2: Run SFC and DISM to Repair System Files

System File Checker and the Deployment Image Servicing and Management tool repair corrupted Windows OS files — the single most common cause of CRITICAL_PROCESS_DIED.

Open Command Prompt as Administrator and run:

sfc /scannow

Wait for the scan to complete (do not interrupt). If SFC reports Windows Resource Protection found corrupt files but was unable to fix some of them, run DISM next:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

After DISM completes, run sfc /scannow a second time, then restart.

Step 3: Identify and Fix Problematic Drivers

Driver-related BSODs are extremely common. Use Driver Verifier to stress-test drivers (only on a test machine or VM, as it can cause intentional BSODs to isolate the bad driver).

Check recently installed or updated drivers:

driverquery /v /fo csv > C:\drivers.csv

Open the CSV and sort by Driver Start Mode and Link Date to find recently changed drivers.

Roll back a driver via Device Manager:

1. Press Win + X > Device Manager.
2. Expand the relevant category (Display Adapters, Network Adapters, etc.).
3. Right-click the device > Properties > Driver tab > Roll Back Driver.

Update all drivers via Windows Update:

Get-WindowsUpdate -MicrosoftUpdate -AcceptAll -Install -AutoReboot

(Requires PSWindowsUpdate PowerShell module.)

Disable a specific driver temporarily:

sc config <ServiceName> start= disabled

Step 4: Run Windows Memory Diagnostic

Faulty RAM causes random kernel-mode crashes, including CRITICAL_PROCESS_DIED.

1. Press Win + R, type mdsched.exe, press Enter.
2. Choose Restart now and check for problems.
3. Windows boots into the diagnostic tool and runs two passes by default.
4. After reboot, check Event Viewer > Windows Logs > System for Event ID 1201 or 1101 from MemoryDiagnostics-Results.

For a more thorough test, use MemTest86 (bootable USB tool) and run at least two full passes overnight.

If errors are found: reseat RAM sticks, test each stick individually, and replace any failing modules.

Step 5: Check and Repair Disk Errors with CHKDSK

A failing drive or corrupted file system can cause critical system processes to crash when they cannot read essential data.

chkdsk C: /f /r /x

Windows will ask to schedule the check on next reboot. Type Y and restart. CHKDSK may take 1–2 hours on large drives. After completion, review results in Event Viewer > Windows Logs > Application > Source: Wininit (the full CHKDSK log is stored here).

For NVMe/SSD drives, also check health with manufacturer tools (Samsung Magician, CrystalDiskInfo, or smartctl):

smartctl -a /dev/sda

Step 6: Use System Restore or Startup Repair

System Restore (if a restore point exists):

1. Press Win + R, type rstrui.exe.
2. Choose a restore point dated before the BSODs began.
3. Follow the wizard and restart.

Startup Repair (if Windows cannot boot):

1. Boot from Windows installation media (USB/DVD).
2. Select Repair your computer > Troubleshoot > Advanced Options > Startup Repair.
3. Let Windows diagnose and auto-repair boot issues.

Command Prompt from WinRE for manual repair:

bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd

Step 7: Check for Malware

Rootkit or bootkit malware frequently targets lsass.exe and csrss.exe. Run an offline scan:

1. Boot from a Windows Defender Offline scan (Settings > Windows Security > Virus & Threat Protection > Scan Options > Microsoft Defender Antivirus Offline Scan).
2. Or use a third-party bootable scanner such as Malwarebytes Rescue Disk or ESET SysRescue.

Step 8: Last Resort — Reset or Clean Install Windows

If all previous steps fail:

1. Go to Settings > System > Recovery > Reset this PC.
2. Choose Keep my files for a soft reset, or Remove everything for a full clean install.
3. Alternatively, perform a clean install from bootable media and format the system partition.

Before this step, back up all user data to an external drive or cloud storage.