What is the stop code 0x000000EF 'Critical Process Died' and what causes it?

Stop code 0x000000EF (CRITICAL_PROCESS_DIED) means the Windows kernel detected that a process marked as critical — such as ntoskrnl.exe, csrss.exe, smss.exe, wininit.exe, or lsass.exe — has terminated unexpectedly. Common causes include corrupted system files, faulty or incompatible device drivers, bad Windows updates, failing hardware (RAM or HDD/SSD), malware damage, and overheating. The kernel cannot safely continue when any of these processes die, so it forces a blue screen to prevent data corruption.

How do I fix 'Critical Process Died' if my PC won't boot and I can't enter Safe Mode?

If neither normal boot nor Safe Mode works, interrupt the boot process three times by holding the power button during startup to trigger the Windows Recovery Environment (WinRE). From WinRE, open Command Prompt and run 'sfc /scannow' and DISM repair commands. Also try Startup Repair from Advanced Options. If WinRE is inaccessible, boot from a Windows installation USB (created with the Media Creation Tool), choose 'Repair your computer,' and use the same tools. If all software fixes fail, test RAM with MemTest86 from a bootable USB and check disk health, as hardware failure may be the root cause.

Why do I get 'Critical Process Died' after a Windows Update?

Windows updates sometimes install driver packages or system file patches that conflict with existing hardware or software configurations. After the update, a critical system binary may be replaced with a version incompatible with your specific setup. To fix this, go to Settings > Windows Update > Update History > Uninstall Updates and remove the most recent update. From the command line you can run 'wusa /uninstall /kb:XXXXXXX' with the specific KB number. After uninstalling, run SFC and DISM to ensure system file integrity is restored.

Why does 'Critical Process Died' appear only when playing games like Valorant?

Game-related BSOD occurrences of this error are most commonly caused by: (1) GPU driver instability under load — update to the latest stable WHQL-certified driver or roll back to a previously working version using DDU in Safe Mode; (2) kernel-level anti-cheat software (e.g., Riot Vanguard) conflicting with recent Windows patches — keep anti-cheat updated or reinstall it; (3) overheating causing the CPU or GPU to throttle or fail — monitor temperatures with HWMonitor and clean the cooling system; (4) unstable RAM overclocks or XMP/EXPO profiles — try disabling XMP in BIOS and test with default memory speeds.

How is 'Critical Process Died' different on Windows Server 2016 or Server 2012 R2?

On Windows Server platforms, this BSOD carries the same root causes but occurs in environments with stricter uptime requirements. On Server 2016 and Server 2012 R2, focus first on running 'sfc /scannow' and DISM RestoreHealth in an elevated PowerShell or Command Prompt session. Check the System and Application event logs in Event Viewer for the exact failing process name. Also review recently installed Windows Server patches via 'wusa /uninstall /kb:XXXXXXX' and inspect storage controllers and NIC drivers, which are common culprits in server environments. If the server is a VM, also check hypervisor integration services (VMware Tools or Hyper-V Integration Services) for version mismatches.

Critical Process Died (BSOD Stop Code 0x000000EF): Complete Fix Guide

Fix the 'Critical Process Died' BSOD (stop code 0x000000EF) on Windows 10/11. Step-by-step guide with SFC, DISM, safe mode, and driver rollback solutions.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,369 words

Key Takeaways

Root Cause 1: Corrupted or incompatible system files — Windows kernel processes (ntoskrnl.exe, csrss.exe, etc.) crash when a critical system file is damaged by a bad update, malware, or disk error.
Root Cause 2: Faulty drivers or hardware — GPU, NIC, or storage drivers that conflict with the kernel trigger the 0x000000EF stop code, especially after driver updates or Windows upgrades.
Root Cause 3: Failing hardware components — Bad RAM, a dying hard drive, or overheating CPU can cause a critical process to terminate unexpectedly, producing this BSOD on startup or during heavy workloads.
Quick Fix Summary: Boot into Safe Mode, run 'sfc /scannow' followed by DISM repair commands, roll back recent drivers or updates, then scan RAM and disk health. If the system won't boot at all, use Windows Recovery Environment (WinRE) to apply the same tools.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC /scannow (System File Checker)	Corrupted Windows system files after update or malware	5–15 min	Low
DISM RestoreHealth	SFC finds errors but cannot fix them; component store corruption	15–30 min (needs internet)	Low
Driver Rollback / Uninstall	BSOD started after a driver or Windows update	5–10 min	Low
Windows Update Uninstall	Error appeared immediately after a cumulative update	10–20 min	Low–Medium
Startup Repair (WinRE)	PC won't boot into Windows at all	10–30 min	Low
Check Disk (chkdsk)	Suspected bad sectors or file-system corruption on HDD/SSD	30–120 min	Low
Memory Diagnostic (mdsched)	RAM errors suspected; crashes during gaming or heavy workloads	15–60 min	Low
System Restore	Error is new and a restore point exists before the issue	20–40 min	Low–Medium
Reset / Reinstall Windows	All other methods fail; frequent unrecoverable BSODs	1–3 hours	High (data risk if not backed up)

Understanding the 'Critical Process Died' Error

When Windows displays the blue screen message 'Your device ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you. Stop code: CRITICAL_PROCESS_DIED' (bug check code 0x000000EF), it means the Windows kernel detected that a process flagged as critical has terminated unexpectedly. Critical processes include core components like ntoskrnl.exe, csrss.exe, wininit.exe, smss.exe, and lsass.exe. When any of these die, Windows cannot continue safely and forces a BSOD.

This error appears across all modern Windows versions: Windows 8.1, Windows 10, and Windows 11. It also affects Windows Server 2012 R2 and Server 2016. You may see it at startup, during gaming (Valorant, for example, has well-documented cases), after a system restore, or immediately after a Windows Update.

Phase 1: Initial Triage — Can You Boot?

Scenario A — Windows boots normally or into Safe Mode: If you can reach the desktop (even in Safe Mode), you have the most options available. Safe Mode loads a minimal set of drivers and services, which is why the BSOD often disappears in Safe Mode — pointing to a driver or third-party software conflict.

To enter Safe Mode:

Hold Shift and click Restart from the Start menu.
Navigate to Troubleshoot > Advanced Options > Startup Settings > Restart.
Press 4 or F4 for Safe Mode, or 5/F5 for Safe Mode with Networking.

Scenario B — System loops on BSOD and won't boot: Windows should automatically enter the Windows Recovery Environment (WinRE) after two or three failed boot attempts. If it doesn't, interrupt booting manually by pressing the power button during POST three times. From WinRE, go to Troubleshoot > Advanced Options > Command Prompt to run repair tools.

Phase 2: Run System File Checker (SFC)

SFC scans all protected Windows system files and replaces corrupted versions with a cached copy from %WinDir%\System32\dllcache.

Open an elevated Command Prompt (Run as Administrator) and execute:

sfc /scannow

Wait for the scan to complete (do not close the window). After completion, check the log at:

%windir%\Logs\CBS\CBS.log

If SFC reports it cannot repair some files, proceed to DISM.

Phase 3: Run DISM to Repair the Component Store

Deployment Image Servicing and Management (DISM) repairs the Windows component store that SFC relies on. Run the following commands in sequence (requires internet for the online repair):

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

After DISM completes, run sfc /scannow again. Restart the PC when done.

Offline DISM (WinRE or when online repair fails): Mount your Windows ISO and point DISM to the install.wim:

DISM /Online /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess

Replace D: with your DVD/ISO mount letter.

Phase 4: Roll Back Drivers

If the BSOD started after installing or updating a driver (GPU, NIC, chipset, storage), rolling back is the fastest fix.

Boot into Safe Mode with Networking.
Open Device Manager (right-click Start > Device Manager).
Expand the relevant category (Display adapters, Network adapters, etc.).
Right-click the device > Properties > Driver tab > Roll Back Driver.

For NVIDIA/AMD GPU drivers that frequently cause this BSOD during gaming, use DDU (Display Driver Uninstaller) in Safe Mode for a clean removal before reinstalling a stable driver version.

Phase 5: Uninstall Problematic Windows Updates

If the error appeared after a Windows Update:

Go to Settings > Windows Update > Update History > Uninstall Updates.
Sort by date, right-click the most recent update, and select Uninstall.

From Command Prompt (including WinRE):

wusa /uninstall /kb:XXXXXXX

Replace XXXXXXX with the KB number from Update History.

Phase 6: Check Disk Health (chkdsk)

A failing hard drive or SSD with bad sectors can corrupt process memory and trigger this BSOD. Run:

chkdsk C: /f /r /x

You'll be prompted to schedule the scan on next reboot. Type Y, then restart. The scan runs before Windows loads and can take 30–120 minutes depending on drive size.

For NVMe/SSD health, also check using manufacturer tools (Samsung Magician, CrystalDiskInfo) or:

wmic diskdrive get status

Phase 7: Memory Diagnostic

Faulty RAM causes random process crashes. Use the built-in Windows Memory Diagnostic:

Press Win + R, type mdsched.exe, press Enter.
Choose Restart now and check for problems.
Results appear in Event Viewer after reboot: Event Viewer > Windows Logs > System, filter by source MemoryDiagnostics-Results.

For more thorough testing, run MemTest86 (bootable USB) for at least two full passes.

Phase 8: Use Startup Repair (WinRE)

From WinRE: Troubleshoot > Advanced Options > Startup Repair. This automatically detects and fixes common boot and BCD issues that can cause the critical process to fail before Windows fully initializes.

Phase 9: System Restore

If a restore point exists before the problem started:

From WinRE: Troubleshoot > Advanced Options > System Restore. Choose a restore point predating the BSOD. This does not affect personal files but will remove apps and drivers installed after that date.

Note: Some users report 'Critical Process Died after System Restore' — this can occur if the restore itself is interrupted or if the restore point is also corrupted. If this happens, boot into WinRE and run SFC/DISM from Command Prompt.

Phase 10: Reset or Reinstall Windows (Last Resort)

If all the above methods fail:

Go to Settings > System > Recovery > Reset this PC.
Choose Keep my files to preserve personal data, or Remove everything for a clean slate.

For a completely clean installation, create a bootable USB with the Windows Media Creation Tool and perform a fresh install. Back up all data to an external drive first.

Special Cases

Alienware / Gaming laptops: Thermal throttling and aggressive overclocking tools (Alienware Command Center, MSI Afterburner) can destabilize critical kernel processes. Uninstall overclocking software in Safe Mode.

Windows Server 2012 R2 / 2016: Run DISM and SFC in an elevated PowerShell session. Also check for corrupted roles via:

Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Broken'}

Valorant / Anti-cheat software: Riot Vanguard's kernel-level driver can conflict with certain kernel patches. Ensure Vanguard is up to date, or temporarily uninstall it and test.

Critical Process Died with no Safe Mode access: If Safe Mode itself BSODs, the issue is almost certainly hardware (failing RAM or storage). Boot from a Linux live USB to test hardware independently, then replace the faulty component before reinstalling Windows.

Frequently Asked Questions

bash

# ============================================================
# CRITICAL PROCESS DIED — Diagnostic & Fix Commands
# Run all commands in an elevated Command Prompt (Run as Admin)
# or from WinRE Command Prompt
# ============================================================

# --- Step 1: System File Checker ---
sfc /scannow

# View SFC log for details
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log | more

# --- Step 2: DISM Component Store Repair ---
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

# DISM offline repair using mounted ISO or USB (replace D: with your source)
# DISM /Online /Cleanup-Image /RestoreHealth /Source:D:\sources\install.wim /LimitAccess

# After DISM completes, run SFC again
sfc /scannow

# --- Step 3: Check Disk for Bad Sectors ---
# Schedule chkdsk on next reboot (type Y when prompted)
chkdsk C: /f /r /x

# Quick disk status check
wmic diskdrive get model,status,size

# --- Step 4: Memory Diagnostic (schedule on reboot) ---
mdsched.exe

# --- Step 5: Check Recent Event Logs for Crashing Process ---
# Find critical errors in System log from the last 24 hours
wevtutil qe System /q:"*[System[(Level=1 or Level=2) and TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text /rd:true /c:20

# --- Step 6: List Recent Windows Updates (find suspect KB) ---
wmic qfe list brief /format:table | more

# Uninstall a specific update by KB number (replace XXXXXXX)
# wusa /uninstall /kb:XXXXXXX /quiet /norestart

# --- Step 7: Boot Configuration Data — Repair BCD ---
# (Run from WinRE Command Prompt if Windows won't boot)
bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd

# --- Step 8: Check Driver Verifier (identify faulty drivers) ---
# Enable verifier for all drivers (reboot required — may cause more BSODs temporarily)
# Analyze minidumps after crash to identify driver
verifier /standard /all

# To disable verifier after identifying the driver
# verifier /reset

# --- Step 9: Read Minidump for Root-Cause Analysis ---
# Minidumps are stored at: C:\Windows\Minidump
# Use WinDbg (Windows Debugging Tools) or upload to https://www.osronline.com
# Quick PowerShell one-liner to list recent minidumps:
powershell -Command "Get-ChildItem -Path 'C:\Windows\Minidump' -Filter '*.dmp' | Sort-Object LastWriteTime -Descending | Select-Object -First 5 | Format-Table Name, LastWriteTime, Length"

# --- Step 10: Windows Server — Check Broken Features ---
# (Windows Server only — run in elevated PowerShell)
# Get-WindowsFeature | Where-Object {$_.InstallState -eq 'Broken'}

# ============================================================
# After all repairs, restart and monitor stability.
# If crashes persist, replace RAM or storage hardware.
# ============================================================

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows system administrators with over a decade of experience diagnosing BSOD errors, kernel panics, and OS-level failures across enterprise and consumer environments. We specialize in translating complex low-level Windows internals into actionable, step-by-step troubleshooting guides. Our procedures are tested on real hardware running Windows 10, Windows 11, and Windows Server 2016/2022 before publication.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.