CRITICAL_PROCESS_DIED (0x000000EF): Complete Fix Guide for Windows 10, 11 & Server

Understanding the CRITICAL_PROCESS_DIED Error

When Windows displays a blue screen with the message "Your PC ran into a problem and needs to restart. We're just collecting some error info... CRITICAL_PROCESS_DIED" (stop code 0x000000EF), it means the Windows kernel detected that a process deemed essential for system operation has ended abnormally. Unlike a regular application crash, these processes are flagged by the OS as non-negotiable for stability. When one dies without a controlled shutdown, a kernel bug check is the result.

Common critical processes include:

• ntoskrnl.exe — the Windows kernel itself
• smss.exe — Session Manager Subsystem
• csrss.exe — Client Server Runtime Subsystem
• wininit.exe — Windows Initialization
• services.exe — Service Control Manager

Step 1: Get Into Safe Mode or WinRE

If Windows boots normally, skip to Step 2. If the machine loops on the BSOD:

1. Force-power-off your PC three times in a row during the boot animation. Windows will automatically enter Automatic Repair mode.
2. Choose Advanced Options → Troubleshoot → Advanced Options → Startup Settings → Restart.
3. Press F4 for Safe Mode or F6 for Safe Mode with Networking.

Alternatively, boot from a Windows 10/11 USB installer, choose Repair your computer, and open Troubleshoot → Advanced Options → Command Prompt to run repairs without loading the OS.

Step 2: Run System File Checker (SFC)

Open an elevated Command Prompt (Run as Administrator) and execute:

sfc /scannow

Wait for the scan to complete. If it reports "Windows Resource Protection found corrupt files but was unable to fix some of them", proceed to DISM before running SFC again.

Step 3: Run DISM to Repair the Component Store

In the same elevated Command Prompt:

Dism /Online /Cleanup-Image /CheckHealth
Dism /Online /Cleanup-Image /ScanHealth
Dism /Online /Cleanup-Image /RestoreHealth

After DISM completes, rerun sfc /scannow. Restart your PC and check if the BSOD is resolved.

If Windows will not boot, run DISM against an offline image. Mount the Windows installation USB and note the drive letter (e.g., D:):

Dism /Image:C:\ /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess

Step 4: Identify the Faulty Driver Using Event Viewer

1. Press Win + X → Event Viewer.
2. Navigate to Windows Logs → System.
3. Filter for Critical and Error events around the time of the crash.
4. Look for entries referencing .sys files — these are drivers.

Alternatively, check the minidump file. Open PowerShell and run:

Get-Content "$env:SystemRoot\MEMORY.DMP" | Select-String -Pattern ".sys"

For a detailed analysis, use WinDbg (Windows Debugger) from the Microsoft Store:

!analyze -v

This command in WinDbg will output the exact driver or module responsible for the crash.

Step 5: Roll Back or Uninstall Problematic Drivers

If the error began after a Windows Update or driver install:

1. Open Device Manager (Win + X → Device Manager).
2. Right-click the suspect device (commonly GPU, NIC, audio, or chipset drivers) → Properties → Driver → Roll Back Driver.
3. If rollback is greyed out, right-click → Uninstall Device → check Delete the driver software for this device.
4. Reboot. Windows will install a generic driver. Then download the correct driver version from the manufacturer's website.

For Alienware or Dell systems, pay particular attention to Killer Network drivers and BIOS updates from Dell Support Assist, which are frequent culprits.

Step 6: Check for RAM Errors

1. Press Win + R, type mdsched.exe, and press Enter.
2. Choose Restart now and check for problems.
3. Windows will run the Memory Diagnostic on reboot. Results appear after logging back in under Event Viewer → Windows Logs → System, source: MemoryDiagnostics-Results.

For a more thorough test, use MemTest86 (bootable USB). If errors are found, reseat or replace the faulty RAM stick.

Step 7: Run Check Disk for Storage Errors

In an elevated Command Prompt:

chkdsk C: /f /r /x

You will be prompted to schedule the scan on next reboot. Type Y, then restart. This process can take 30 minutes to 2 hours on large drives. For NVMe/SSD drives, also check the manufacturer's health tool (Samsung Magician, CrystalDiskInfo, etc.).

Step 8: Uninstall Recent Windows Updates

If the BSOD started after Windows Update:

1. Settings → Update & Security → Windows Update → View update history → Uninstall updates.
2. Sort by Installed On (descending).
3. Uninstall the most recent Cumulative Update, then reboot.

From Command Prompt (if GUI is inaccessible):

wusa /uninstall /kb:XXXXXXX

Replace XXXXXXX with the KB number visible in update history.

Step 9: Perform a System Restore

If a restore point exists before the issue started:

1. Press Win + R, type rstrui.exe, press Enter.
2. Follow the wizard, selecting a restore point dated before the BSOD began.

From WinRE (if Windows won't boot): Troubleshoot → Advanced Options → System Restore.

Note: After System Restore, the CRITICAL_PROCESS_DIED error may reappear if the underlying cause (hardware failure, corruption) was not addressed.

Step 10: Scan for Malware

Malware — particularly rootkits — can corrupt or replace critical system processes. Boot into Safe Mode with Networking and run:

"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2

Or use Malwarebytes (free tier) or the Microsoft Safety Scanner (msert.exe) for a second opinion.

Step 11: When Nothing Works — Reset or Reinstall Windows

If all steps above have failed and the PC remains unbootable:

1. From WinRE: Troubleshoot → Reset this PC → Keep my files (or Remove everything for a clean install).
2. Alternatively, perform a clean install from a Windows USB installer created with the Media Creation Tool.

After reinstalling, install drivers one at a time, verify stability, and avoid installing the same update that triggered the issue until a fix is available from Microsoft.

Special Scenarios

Valorant / Anti-Cheat Software

Valorant's Vanguard anti-cheat operates at kernel level and can trigger CRITICAL_PROCESS_DIED if it conflicts with another kernel driver. Uninstall Vanguard via Add/Remove Programs, update your GPU and chipset drivers, then reinstall Vanguard.

Windows Server 2012 R2 / 2016

On Server editions, this BSOD frequently relates to third-party security software or storage controller drivers. Check the Microsoft Update Catalog for specific hotfixes and review C:\Windows\Minidump files for the offending module.

Gaming PCs (Alienware, custom builds)

Overclocking settings in BIOS/UEFI can destabilize critical processes under load. Reset BIOS to default settings (Load Optimized Defaults) and retest.

Windows 8.1

For Windows 8.1, the DISM syntax differs slightly: use /Source:wim:D:\sources\install.wim:1 and ensure KB2919355 is installed before running repairs.