Error Medic

IRQL_NOT_LESS_OR_EQUAL: How to Fix This Blue Screen of Death Error on Windows

Fix the IRQL_NOT_LESS_OR_EQUAL BSOD on Windows with step-by-step driver updates, memory checks, and registry repairs. Resolve stop code 0x0000000A fast.

Last updated:
Last verified:
2,179 words
Key Takeaways
  • Root Cause 1: A faulty, outdated, or incompatible kernel-mode driver is attempting to access pageable memory at an elevated IRQL (Interrupt Request Level), most often triggered after a Windows Update, new hardware installation, or driver upgrade.
  • Root Cause 2: Defective or incompatible RAM modules cause memory address conflicts that the kernel interprets as an illegal memory access at the wrong IRQL, producing stop code 0x0000000A.
  • Root Cause 3: Corrupt system files, misconfigured virtual memory settings, or third-party antivirus/VPN kernel drivers interfering with Windows memory management routines.
  • Quick Fix Summary: Boot into Safe Mode, identify the offending driver using WinDbg or WhoCrashed, update or roll back that driver, run Windows Memory Diagnostic and SFC/DISM to repair system files, and verify RAM seating if hardware is suspected.
Fix Approaches Compared
MethodWhen to UseTimeRisk
Roll Back / Update DriverDriver name visible in BSOD or minidump analysis5-15 minLow
Windows Memory DiagnosticRandom BSODs, new RAM installed, system under load30-60 minNone
SFC & DISM RepairCorrupt system files suspected, recent Windows Update15-30 minVery Low
Uninstall Conflicting SoftwareThird-party antivirus, VPN, or overclocking tools recently installed5-10 minLow
Adjust Virtual Memory / Page FileLow disk space, page file manually configured5 minLow
MemTest86 (Full RAM Scan)Memory Diagnostic shows errors or is inconclusive2-8 hoursNone
Clean Windows InstallAll other methods fail, persistent BSOD on every boot2-4 hoursHigh (data loss risk)

Understanding the IRQL_NOT_LESS_OR_EQUAL Error

The full stop code you see on the blue screen reads:

Your PC ran into a problem and needs to restart.
Stop Code: IRQL_NOT_LESS_OR_EQUAL

In older Windows versions (XP/7) the error appears as:

STOP: 0x0000000A (parameter1, parameter2, parameter3, parameter4)
IRQL_NOT_LESS_OR_EQUAL

This error means a kernel-mode process or driver attempted to access a memory address at an Interrupt Request Level (IRQL) that was too high. In Windows, different operations run at different IRQLs. Pageable memory can only be accessed at IRQL < 2 (DISPATCH_LEVEL). When a driver violates this rule — usually by using a pointer to pageable memory at an elevated IRQL — the kernel halts the system immediately to prevent data corruption.

The four parameters embedded in the stop code tell you exactly what happened:

  • Parameter 1: Memory address that was referenced
  • Parameter 2: IRQL at the time of the fault
  • Parameter 3: 0 = read operation, 1 = write operation
  • Parameter 4: Address of the instruction that caused the fault (maps to a driver)

Step 1: Collect Crash Dump Information

Before making any changes, gather evidence from the crash dump.

Enable full minidumps (if not already enabled):

  1. Press Win + R, type sysdm.cpl, press Enter.
  2. Go to Advanced > Startup and Recovery > Settings.
  3. Under Write debugging information, select Small memory dump (256 KB).
  4. Confirm the dump path is %SystemRoot%\Minidump.

After the next crash, navigate to C:\Windows\Minidump and note the .dmp files.

Analyze with WhoCrashed (free tool): Download WhoCrashed from resplendence.com, install it, and click Analyze. It reads the minidump and names the offending driver file (e.g., ntoskrnl.exe, nvlddmkm.sys, atikmpag.sys, afd.sys).

Analyze with WinDbg: Install WinDbg from the Microsoft Store or Windows SDK, then run:

windbg -y srv*C:\Symbols*https://msdl.microsoft.com/download/symbols -z C:\Windows\Minidump\<filename>.dmp

In WinDbg, type !analyze -v to get a verbose analysis including the faulting module name.


Step 2: Boot Into Safe Mode (If System Won't Start)

If the BSOD occurs on every boot, you must enter Safe Mode first:

  1. Interrupt startup three times in a row to trigger Windows Recovery Environment (WinRE).
  2. Navigate to Troubleshoot > Advanced Options > Startup Settings > Restart.
  3. Press 4 or F4 to boot in Safe Mode, or 5/F5 for Safe Mode with Networking.

In Safe Mode, Windows loads only essential drivers, so the offending driver is bypassed.


Step 3: Update or Roll Back the Offending Driver

Once you have the driver filename from the minidump analysis:

Option A — Roll back a recently updated driver:

  1. Press Win + X > Device Manager.
  2. Right-click the device associated with the driver > Properties > Driver tab.
  3. Click Roll Back Driver if the option is available.

Option B — Update the driver:

  1. Right-click the device > Update driver > Search automatically.
  2. If Windows doesn't find a newer version, visit the manufacturer's website directly (NVIDIA, AMD, Intel, Realtek, etc.).

Option C — Uninstall a problematic driver completely: For GPU drivers, use Display Driver Uninstaller (DDU) in Safe Mode:

  1. Boot Safe Mode.
  2. Run DDU > select your GPU brand > Clean and restart.
  3. Reinstall the latest stable driver from the manufacturer.

Common driver files and their associated devices:

  • nvlddmkm.sys → NVIDIA GPU driver
  • atikmpag.sys / atikmdag.sys → AMD GPU driver
  • igdkmd64.sys → Intel integrated graphics
  • afd.sys → Windows Ancillary Function Driver (networking)
  • ntfs.sys → NTFS file system driver
  • tcpip.sys → TCP/IP protocol driver

Step 4: Run Windows Memory Diagnostic

Press Win + R, type mdsched.exe, and press Enter. Choose Restart now and check for problems. Windows will reboot and perform two passes of memory testing. Check Event Viewer afterward:

  1. Press Win + R, type eventvwr.msc.
  2. Navigate to Windows Logs > System.
  3. Look for an event from source MemoryDiagnostics-Results.

If errors are found, run MemTest86 (bootable USB tool) for a comprehensive 8-pass test to confirm faulty RAM sticks. Remove and reseat RAM modules, and test one stick at a time.


Step 5: Repair System Files with SFC and DISM

Open Command Prompt as Administrator (Win + X > **Windows Terminal (Admin)`) and run:

sfc /scannow

This scans protected system files and replaces corrupted ones. Wait for it to complete (may take 15-20 minutes). Then run DISM to repair the Windows image:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Reboot after both operations complete.


Step 6: Verify and Reset Virtual Memory Settings

Incorrect page file settings can trigger this error:

  1. Press Win + R, type sysdm.cpl.
  2. Advanced > Performance > Settings > Advanced > Change.
  3. Uncheck Automatically manage paging file size for all drives if it was manually configured incorrectly.
  4. Select System managed size and click Set > OK.
  5. Restart the system.

Step 7: Check for Software Conflicts

Third-party antivirus products, VPN clients, and overclocking utilities install kernel-mode drivers that can cause this BSOD:

  • Antivirus: Temporarily uninstall (not just disable) third-party AV using the vendor's dedicated removal tool.
  • VPN clients: Uninstall VPN software and check if the BSOD stops.
  • Overclocking tools: Remove MSI Afterburner, EVGA Precision, or XTU and reset CPU/GPU to stock clocks.
  • Recent Windows Update: If the BSOD started after a cumulative update, use Settings > Windows Update > Update History > Uninstall updates to remove the latest patch.

Step 8: Inspect Hardware (Advanced)

If software fixes don't resolve the issue:

  • Reseat RAM: Power off, remove RAM sticks, clean gold contacts with a pencil eraser, and firmly reseat.
  • Check storage: Run chkdsk C: /f /r /x to scan the system drive for bad sectors.
  • Check temperatures: Use HWMonitor or HWiNFO64 to verify CPU and GPU temps are within safe limits. Thermal throttling and crashes can overlap.
  • Inspect Event Viewer: eventvwr.msc > Windows Logs > System for hardware error events (WHEA errors indicate hardware faults).

Step 9: Last Resort — Windows Reset or Clean Install

If all else fails:

  1. Settings > System > Recovery > Reset this PC.
  2. Choose Keep my files for a non-destructive reset, or Remove everything for a clean install.
  3. For a full clean install, download the Windows 11/10 Media Creation Tool from Microsoft and create a bootable USB.

Frequently Asked Questions

powershell
# ============================================================
# IRQL_NOT_LESS_OR_EQUAL Diagnostic & Fix Script
# Run as Administrator in PowerShell
# ============================================================

# --- 1. List recent BSOD events from Event Log ---
Write-Host "=== Recent BSOD Events ==="
Get-WinEvent -LogName System -MaxEvents 100 | Where-Object {
    $_.Id -eq 41 -or $_.Id -eq 1001
} | Select-Object TimeCreated, Id, Message | Format-List

# --- 2. List minidump files for analysis ---
Write-Host "
=== Minidump Files ==="
$dumpPath = "$env:SystemRoot\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem -Path $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length
} else {
    Write-Host "No Minidump folder found. Ensure small memory dumps are configured."
}

# --- 3. Run System File Checker ---
Write-Host "
=== Running SFC /scannow ==="
sfc /scannow

# --- 4. Run DISM to repair Windows image ---
Write-Host "
=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth

# --- 5. Scan disk for errors (schedules on next reboot) ---
Write-Host "
=== Scheduling CHKDSK on C: ==="
echo Y | chkdsk C: /f /r /x

# --- 6. Check RAM with Windows Memory Diagnostic (launches GUI) ---
Write-Host "
=== Launching Windows Memory Diagnostic ==="
mdsched.exe

# --- 7. List all third-party kernel drivers (potential culprits) ---
Write-Host "
=== Third-Party Kernel Drivers ==="
Get-WmiObject Win32_SystemDriver | Where-Object {
    $_.PathName -notlike "*\system32\drivers\*" -and
    $_.PathName -notlike "*\SystemRoot\system32\*"
} | Select-Object Name, DisplayName, PathName, State | Format-List

# --- 8. List all kernel drivers and their state ---
Write-Host "
=== All Running Kernel Drivers ==="
driverquery /FO LIST /SI | Select-String -Pattern "Module Name|Display Name|Driver Type" | Out-String

# --- 9. Export driver list to text file for review ---
driverquery /FO CSV /SI | Out-File -FilePath "$env:USERPROFILE\Desktop\DriverList.csv" -Encoding UTF8
Write-Host "
Driver list exported to Desktop as DriverList.csv"

# --- 10. Check for recent Windows Updates (last 10) ---
Write-Host "
=== Recent Windows Updates ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, InstalledOn, Description

# --- 11. Verify and reset Virtual Memory to system-managed ---
Write-Host "
=== Resetting Virtual Memory to System Managed ==="
$cs = Get-WmiObject -Class Win32_ComputerSystem -EnableAllPrivileges
$cs.AutomaticManagedPagefile = $true
$cs.Put() | Out-Null
Write-Host "Virtual memory reset to system managed. Reboot required."

Write-Host "
=== Diagnostic Complete. Review output above and reboot to apply disk/memory checks. ==="
E

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems specialists with over 15 years of combined experience diagnosing kernel panics, blue screens, and OS-level failures across enterprise and consumer environments. Our guides are built on real crash dump analysis, Microsoft documentation, and hands-on lab testing.

Sources

Related Articles in Other Irql Not Less Or Equal

Explore More windows Guides