SYSTEM_SERVICE_EXCEPTION (0x0000003B): Complete Blue Screen Fix Guide for Windows 10 & 11
Fix the SYSTEM_SERVICE_EXCEPTION BSOD (stop code 0x0000003B) on Windows 10/11. Step-by-step diagnosis for ntfs.sys, nvlddmkm.sys, win32kfull.sys & more.
- SYSTEM_SERVICE_EXCEPTION (stop code 0x0000003B) is triggered when a Windows kernel routine or driver attempts an illegal operation — most often a faulty or outdated device driver (GPU, NIC, file-system filter) is to blame.
- The offending file listed in the crash dump (e.g., nvlddmkm.sys = NVIDIA GPU driver, ntfs.sys = file system, win32kfull.sys = graphics subsystem, amdkmdag.sys = AMD GPU driver) pinpoints the exact component to fix.
- The fastest reliable fix path is: (1) capture a minidump, (2) identify the faulting module, (3) update or roll back that specific driver, and (4) run SFC + DISM to rule out corrupted system files — most users are back online within 30 minutes.
| Method | When to Use | Time | Risk |
|---|---|---|---|
| Update/Roll Back Driver | Faulting .sys file points to a specific driver (nvlddmkm.sys, amdkmdag.sys, ndis.sys) | 5–15 min | Low |
| SFC + DISM Scan | Crash implicates system files (ntfs.sys, ntoskrnl.exe, win32kfull.sys, cdd.dll) | 15–30 min | Low |
| Windows Update | Multiple BSODs after recent Windows build upgrade | 10–30 min | Low |
| RAM Test (MemTest86) | BSOD occurs during memory-intensive tasks or mentions memory management | 60–240 min | None |
| Check Disk (chkdsk) | ntfs.sys errors or BSODs after unexpected shutdown/power loss | 20–60 min | Low |
| Clean Boot / Safe Mode | Cannot isolate the faulting driver; BSOD on desktop or during games | 10–20 min | None |
| Reinstall Windows | All driver and file fixes fail; hardware is confirmed healthy | 60–120 min | High (data loss if not backed up) |
Understanding the SYSTEM_SERVICE_EXCEPTION Error
The full stop code you see on the blue screen is SYSTEM_SERVICE_EXCEPTION with the bug check value 0x0000003B. Windows displays this when a kernel-mode routine — typically a device driver — raises an exception that the kernel cannot handle. Unlike a user-mode crash (which only kills an application), a kernel exception forces an immediate system halt to prevent data corruption.
The four parameters shown after the stop code on the crash screen are:
- Parameter 1: Exception code (e.g.,
0xC0000005= access violation,0xC000001D= illegal instruction) - Parameter 2: Address of the instruction that caused the exception
- Parameter 3: Address of the trap frame
- Parameter 4: Reserved (always 0)
The most important information is the faulting module name shown in parentheses on the blue screen or inside the minidump file — for example: SYSTEM_SERVICE_EXCEPTION (nvlddmkm.sys).
Step 0: Collect the Crash Dump Before Doing Anything Else
If Windows reboots automatically after the BSOD, the minidump file is your best clue.
- Open File Explorer and navigate to
C:\Windows\Minidump. - Look for
.dmpfiles named with today's date (e.g.,Mini062024-01.dmp). - Download the free tool WinDbg Preview from the Microsoft Store, or use WhoCrashed (free, at resplendence.com) to read minidumps without WinDbg expertise.
- In WhoCrashed, click Analyze — it will list the faulting driver and a human-readable crash summary.
Alternatively, run this PowerShell one-liner to read the last crash event from the System log:
Get-WinEvent -LogName System | Where-Object { $_.Id -eq 1001 } | Select-Object -First 5 | Format-List TimeCreated, Message
Step 1: Identify the Faulting Module and Map It to a Fix
Use the table below to map the .sys or .dll file to an action:
| Faulting File | Component | Recommended Fix |
|---|---|---|
nvlddmkm.sys |
NVIDIA GPU driver | Update/DDU-clean reinstall GPU driver |
amdkmdag.sys |
AMD GPU driver | Update/DDU-clean reinstall GPU driver |
igdkmd64.sys |
Intel integrated GPU driver | Update via Intel Driver & Support Assistant |
ntfs.sys |
NTFS file system driver | Run chkdsk + SFC/DISM |
win32kfull.sys / win32kbase.sys |
Windows graphics kernel | Windows Update + SFC/DISM |
ndis.sys / netio.sys |
Network stack | Update NIC driver; disable network offload features |
fltmgr.sys |
File system filter manager | Uninstall third-party antivirus or backup agents |
cldflt.sys |
OneDrive cloud file filter | Pause OneDrive sync; update or disable OneDrive |
cng.sys |
Cryptography Next Generation | Windows Update (patch KB) |
dxgkrnl.sys / dxgmms1.sys |
DirectX graphics kernel | Update GPU driver + Windows Update |
ntoskrnl.exe |
Windows kernel | SFC/DISM; RAM test |
cdd.dll |
Canonical Display Driver | Windows Update; GPU driver update |
wdf01000.sys |
Windows Driver Framework | Windows Update; roll back recent driver |
ndu.sys |
Network Diagnostic Usage | Disable NDU via registry (see code block) |
Step 2: Update or Roll Back the Offending Driver
To update a driver:
- Press
Win + X→ Device Manager. - Expand the relevant category (Display Adapters, Network Adapters, etc.).
- Right-click the device → Update driver → Search automatically.
- If Windows finds nothing new, visit the manufacturer's website directly:
To perform a clean GPU driver install (DDU method — recommended for nvlddmkm.sys and amdkmdag.sys):
- Boot into Safe Mode (
Settings → Recovery → Advanced Startup → Troubleshoot → Advanced Options → Startup Settings → Restart → F4). - Download Display Driver Uninstaller (DDU) from guru3d.com.
- Run DDU, select your GPU vendor, click Clean and restart.
- After reboot (still in normal mode), install the latest driver from the manufacturer's site.
To roll back a driver:
- Device Manager → right-click device → Properties → Driver tab → Roll Back Driver.
Step 3: Repair System Files (SFC and DISM)
Corrupted Windows system files — especially when the crash implicates ntfs.sys, win32kfull.sys, ntoskrnl.exe, or cdd.dll — can cause persistent BSODs. Run these commands in an elevated Command Prompt (Win + S → type cmd → Run as administrator):
:: Step 1: DISM repairs the Windows component store first
DISM /Online /Cleanup-Image /RestoreHealth
:: Step 2: SFC uses the repaired store to fix system files
sfc /scannow
:: Step 3: Review SFC results
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log | more
Restart after completion and monitor for further BSODs.
Step 4: Check the Disk for File System Errors
When ntfs.sys is implicated, always check disk health:
:: Schedule chkdsk on the system drive (will run at next reboot)
chkdsk C: /f /r /x
:: Accept the prompt to schedule on next restart, then reboot
shutdown /r /t 0
For NVMe/SSD health, also check with:
wmic diskdrive get status
Step 5: Test RAM
Memory corruption can trigger SYSTEM_SERVICE_EXCEPTION, especially when ntoskrnl.exe is listed and the system service exception memory management variant appears.
Quick built-in test (Windows Memory Diagnostic):
mdsched.exe
Choose "Restart now and check for problems."
Thorough test: Boot from a MemTest86 USB drive (https://www.memtest86.com) and run at least 2 full passes. If errors appear, reseat or replace RAM sticks.
Step 6: Scenario-Specific Fixes
BSOD when playing games (nvlddmkm.sys, dxgkrnl.sys):
- Reduce GPU overclock settings in MSI Afterburner or EVGA Precision.
- Increase GPU power limit slightly if undervolted.
- Check case temperatures — thermal throttling can destabilize GPU drivers.
- Reinstall DirectX:
dxdiag→ confirm DirectX 12 is present; run Windows Update.
BSOD with fltmgr.sys (filter manager) or cldflt.sys:
- These almost always point to a third-party security product or cloud backup agent.
- Boot into Safe Mode (no third-party drivers load) to confirm the BSOD stops.
- Uninstall antivirus/endpoint protection tools one at a time.
- For
cldflt.sysspecifically: Settings → Apps → OneDrive → Uninstall, then reinstall the latest version.
BSOD in VMware Workstation:
- The virtual machine's memory balloon driver or VMCI driver can conflict with the host kernel.
- Update VMware Workstation to the latest version.
- In VM settings, disable Memory page trimming and Virtualize Intel VT-x/EPT.
BSOD on Windows 8.1:
- Ensure all Windows 8.1 updates are installed via Windows Update.
- Roll back to driver versions known to be stable on 8.1 (NVIDIA provides legacy driver archives).
Step 7: If Nothing Else Works — Enable Verifier for Advanced Diagnosis
Driver Verifier puts extra stress on drivers to catch buggy ones faster:
:: Enable Driver Verifier for all non-Microsoft drivers
verifier /standard /all
:: After capturing the crash with Verifier enabled, disable it
verifier /reset
Warning: Driver Verifier will intentionally crash an unstable system more frequently. Only use it while actively debugging, not on production machines. The resulting minidump will name the exact faulting driver.
Step 8: Last Resort — In-Place Upgrade or Reset
If hardware checks out and all drivers are current but BSODs persist:
- In-place upgrade (keeps files and apps): Download the Windows 11 ISO from Microsoft, mount it, run
setup.exe→ choose Keep personal files and apps. - Reset (keeps files, removes apps): Settings → System → Recovery → Reset this PC → Keep my files.
- Clean install: Backup data first, boot from USB media, format and reinstall.
Frequently Asked Questions
# ============================================================
# SYSTEM_SERVICE_EXCEPTION Diagnostic & Fix Script
# Run in an ELEVATED PowerShell window (Run as Administrator)
# ============================================================
Write-Host "=== Step 1: Read last 5 BSOD events from System log ==="
Get-WinEvent -LogName System -ErrorAction SilentlyContinue |
Where-Object { $_.Id -eq 1001 -and $_.Message -match 'BugCheck' } |
Select-Object -First 5 |
Format-List TimeCreated, Message
Write-Host "`n=== Step 2: List recent minidump files ==="
Get-ChildItem -Path "$env:SystemRoot\Minidump" -Filter "*.dmp" -ErrorAction SilentlyContinue |
Sort-Object LastWriteTime -Descending |
Select-Object -First 10 |
Format-Table Name, LastWriteTime, Length
Write-Host "`n=== Step 3: Run DISM to repair Windows image ==="
Start-Process -FilePath "dism.exe" -ArgumentList "/Online /Cleanup-Image /RestoreHealth" -Wait -NoNewWindow
Write-Host "`n=== Step 4: Run SFC to fix system files ==="
Start-Process -FilePath "sfc.exe" -ArgumentList "/scannow" -Wait -NoNewWindow
Write-Host "`n=== Step 5: Check disk for errors (schedules chkdsk on next reboot) ==="
# Uncomment the line below to schedule chkdsk
# Start-Process -FilePath "chkdsk.exe" -ArgumentList "C: /f /r /x" -Wait -NoNewWindow
Write-Host "`n=== Step 6: Show installed GPU drivers ==="
Get-WmiObject Win32_VideoController | Select-Object Name, DriverVersion, DriverDate | Format-Table -AutoSize
Write-Host "`n=== Step 7: Check for outdated or unsigned drivers ==="
Get-WmiObject Win32_SystemDriver |
Where-Object { $_.State -eq 'Running' } |
Select-Object Name, PathName, Started |
Sort-Object Name |
Format-Table -AutoSize
Write-Host "`n=== Step 8: Disable NDU (Network Diagnostics Usage) if ndu.sys is faulting ==="
# NDU can cause BSODs on some systems. Uncomment to disable:
# Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Ndu' -Name 'Start' -Value 4
# Write-Host 'NDU disabled. Reboot required.'
Write-Host "`n=== Step 9: Check RAM via Windows Memory Diagnostic ==="
Write-Host "Launching Windows Memory Diagnostic (mdsched.exe)..."
# Uncomment to launch:
# Start-Process -FilePath "mdsched.exe"
Write-Host "`n=== Step 10: Verify SMART status of all drives ==="
Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus |
Select-Object InstanceName, PredictFailure, Reason |
Format-Table -AutoSize
Write-Host "`n=== Diagnostics complete. Review output above for anomalies. ==="
Write-Host "Next step: Open C:\Windows\Minidump files in WinDbg or WhoCrashed for module-level detail."Error Medic Editorial
The Error Medic Editorial team is composed of senior DevOps engineers, Windows kernel enthusiasts, and SRE practitioners with a combined 40+ years of experience diagnosing and resolving Windows system errors, driver conflicts, and enterprise infrastructure outages. Our guides are tested on real hardware and virtual environments running Windows 8.1 through Windows 11, ensuring every command and fix path is verified before publication.
Sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x3b--system-service-exception
- https://support.microsoft.com/en-us/windows/using-system-file-checker-in-windows-365e0031-36b1-6031-f804-8fd86e0ef4ca
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image
- https://stackoverflow.com/questions/tagged/bsod
- https://answers.microsoft.com/en-us/windows/forum/all/blue-screen-system-service-exception/
- https://www.memtest86.com/
- https://www.guru3d.com/files-details/display-driver-uninstaller-download.html