Error Medic

SYSTEM_SERVICE_EXCEPTION (0x0000003B): Complete Blue Screen Fix Guide for Windows 10 & 11

Fix the SYSTEM_SERVICE_EXCEPTION BSOD (stop code 0x0000003B) on Windows 10/11. Step-by-step diagnosis for ntfs.sys, nvlddmkm.sys, win32kfull.sys & more.

Last updated:
Last verified:
2,244 words
Key Takeaways
  • SYSTEM_SERVICE_EXCEPTION (stop code 0x0000003B) is triggered when a Windows kernel routine or driver attempts an illegal operation — most often a faulty or outdated device driver (GPU, NIC, file-system filter) is to blame.
  • The offending file listed in the crash dump (e.g., nvlddmkm.sys = NVIDIA GPU driver, ntfs.sys = file system, win32kfull.sys = graphics subsystem, amdkmdag.sys = AMD GPU driver) pinpoints the exact component to fix.
  • The fastest reliable fix path is: (1) capture a minidump, (2) identify the faulting module, (3) update or roll back that specific driver, and (4) run SFC + DISM to rule out corrupted system files — most users are back online within 30 minutes.
Fix Approaches Compared
MethodWhen to UseTimeRisk
Update/Roll Back DriverFaulting .sys file points to a specific driver (nvlddmkm.sys, amdkmdag.sys, ndis.sys)5–15 minLow
SFC + DISM ScanCrash implicates system files (ntfs.sys, ntoskrnl.exe, win32kfull.sys, cdd.dll)15–30 minLow
Windows UpdateMultiple BSODs after recent Windows build upgrade10–30 minLow
RAM Test (MemTest86)BSOD occurs during memory-intensive tasks or mentions memory management60–240 minNone
Check Disk (chkdsk)ntfs.sys errors or BSODs after unexpected shutdown/power loss20–60 minLow
Clean Boot / Safe ModeCannot isolate the faulting driver; BSOD on desktop or during games10–20 minNone
Reinstall WindowsAll driver and file fixes fail; hardware is confirmed healthy60–120 minHigh (data loss if not backed up)

Understanding the SYSTEM_SERVICE_EXCEPTION Error

The full stop code you see on the blue screen is SYSTEM_SERVICE_EXCEPTION with the bug check value 0x0000003B. Windows displays this when a kernel-mode routine — typically a device driver — raises an exception that the kernel cannot handle. Unlike a user-mode crash (which only kills an application), a kernel exception forces an immediate system halt to prevent data corruption.

The four parameters shown after the stop code on the crash screen are:

  • Parameter 1: Exception code (e.g., 0xC0000005 = access violation, 0xC000001D = illegal instruction)
  • Parameter 2: Address of the instruction that caused the exception
  • Parameter 3: Address of the trap frame
  • Parameter 4: Reserved (always 0)

The most important information is the faulting module name shown in parentheses on the blue screen or inside the minidump file — for example: SYSTEM_SERVICE_EXCEPTION (nvlddmkm.sys).


Step 0: Collect the Crash Dump Before Doing Anything Else

If Windows reboots automatically after the BSOD, the minidump file is your best clue.

  1. Open File Explorer and navigate to C:\Windows\Minidump.
  2. Look for .dmp files named with today's date (e.g., Mini062024-01.dmp).
  3. Download the free tool WinDbg Preview from the Microsoft Store, or use WhoCrashed (free, at resplendence.com) to read minidumps without WinDbg expertise.
  4. In WhoCrashed, click Analyze — it will list the faulting driver and a human-readable crash summary.

Alternatively, run this PowerShell one-liner to read the last crash event from the System log:

Get-WinEvent -LogName System | Where-Object { $_.Id -eq 1001 } | Select-Object -First 5 | Format-List TimeCreated, Message

Step 1: Identify the Faulting Module and Map It to a Fix

Use the table below to map the .sys or .dll file to an action:

Faulting File Component Recommended Fix
nvlddmkm.sys NVIDIA GPU driver Update/DDU-clean reinstall GPU driver
amdkmdag.sys AMD GPU driver Update/DDU-clean reinstall GPU driver
igdkmd64.sys Intel integrated GPU driver Update via Intel Driver & Support Assistant
ntfs.sys NTFS file system driver Run chkdsk + SFC/DISM
win32kfull.sys / win32kbase.sys Windows graphics kernel Windows Update + SFC/DISM
ndis.sys / netio.sys Network stack Update NIC driver; disable network offload features
fltmgr.sys File system filter manager Uninstall third-party antivirus or backup agents
cldflt.sys OneDrive cloud file filter Pause OneDrive sync; update or disable OneDrive
cng.sys Cryptography Next Generation Windows Update (patch KB)
dxgkrnl.sys / dxgmms1.sys DirectX graphics kernel Update GPU driver + Windows Update
ntoskrnl.exe Windows kernel SFC/DISM; RAM test
cdd.dll Canonical Display Driver Windows Update; GPU driver update
wdf01000.sys Windows Driver Framework Windows Update; roll back recent driver
ndu.sys Network Diagnostic Usage Disable NDU via registry (see code block)

Step 2: Update or Roll Back the Offending Driver

To update a driver:

  1. Press Win + XDevice Manager.
  2. Expand the relevant category (Display Adapters, Network Adapters, etc.).
  3. Right-click the device → Update driverSearch automatically.
  4. If Windows finds nothing new, visit the manufacturer's website directly:

To perform a clean GPU driver install (DDU method — recommended for nvlddmkm.sys and amdkmdag.sys):

  1. Boot into Safe Mode (Settings → Recovery → Advanced Startup → Troubleshoot → Advanced Options → Startup Settings → Restart → F4).
  2. Download Display Driver Uninstaller (DDU) from guru3d.com.
  3. Run DDU, select your GPU vendor, click Clean and restart.
  4. After reboot (still in normal mode), install the latest driver from the manufacturer's site.

To roll back a driver:

  1. Device Manager → right-click device → PropertiesDriver tab → Roll Back Driver.

Step 3: Repair System Files (SFC and DISM)

Corrupted Windows system files — especially when the crash implicates ntfs.sys, win32kfull.sys, ntoskrnl.exe, or cdd.dll — can cause persistent BSODs. Run these commands in an elevated Command Prompt (Win + S → type cmd → Run as administrator):

:: Step 1: DISM repairs the Windows component store first
DISM /Online /Cleanup-Image /RestoreHealth

:: Step 2: SFC uses the repaired store to fix system files
sfc /scannow

:: Step 3: Review SFC results
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log | more

Restart after completion and monitor for further BSODs.


Step 4: Check the Disk for File System Errors

When ntfs.sys is implicated, always check disk health:

:: Schedule chkdsk on the system drive (will run at next reboot)
chkdsk C: /f /r /x

:: Accept the prompt to schedule on next restart, then reboot
shutdown /r /t 0

For NVMe/SSD health, also check with:

wmic diskdrive get status

Step 5: Test RAM

Memory corruption can trigger SYSTEM_SERVICE_EXCEPTION, especially when ntoskrnl.exe is listed and the system service exception memory management variant appears.

Quick built-in test (Windows Memory Diagnostic):

mdsched.exe

Choose "Restart now and check for problems."

Thorough test: Boot from a MemTest86 USB drive (https://www.memtest86.com) and run at least 2 full passes. If errors appear, reseat or replace RAM sticks.


Step 6: Scenario-Specific Fixes

BSOD when playing games (nvlddmkm.sys, dxgkrnl.sys):

  • Reduce GPU overclock settings in MSI Afterburner or EVGA Precision.
  • Increase GPU power limit slightly if undervolted.
  • Check case temperatures — thermal throttling can destabilize GPU drivers.
  • Reinstall DirectX: dxdiag → confirm DirectX 12 is present; run Windows Update.

BSOD with fltmgr.sys (filter manager) or cldflt.sys:

  • These almost always point to a third-party security product or cloud backup agent.
  • Boot into Safe Mode (no third-party drivers load) to confirm the BSOD stops.
  • Uninstall antivirus/endpoint protection tools one at a time.
  • For cldflt.sys specifically: Settings → Apps → OneDrive → Uninstall, then reinstall the latest version.

BSOD in VMware Workstation:

  • The virtual machine's memory balloon driver or VMCI driver can conflict with the host kernel.
  • Update VMware Workstation to the latest version.
  • In VM settings, disable Memory page trimming and Virtualize Intel VT-x/EPT.

BSOD on Windows 8.1:

  • Ensure all Windows 8.1 updates are installed via Windows Update.
  • Roll back to driver versions known to be stable on 8.1 (NVIDIA provides legacy driver archives).

Step 7: If Nothing Else Works — Enable Verifier for Advanced Diagnosis

Driver Verifier puts extra stress on drivers to catch buggy ones faster:

:: Enable Driver Verifier for all non-Microsoft drivers
verifier /standard /all

:: After capturing the crash with Verifier enabled, disable it
verifier /reset

Warning: Driver Verifier will intentionally crash an unstable system more frequently. Only use it while actively debugging, not on production machines. The resulting minidump will name the exact faulting driver.


Step 8: Last Resort — In-Place Upgrade or Reset

If hardware checks out and all drivers are current but BSODs persist:

  1. In-place upgrade (keeps files and apps): Download the Windows 11 ISO from Microsoft, mount it, run setup.exe → choose Keep personal files and apps.
  2. Reset (keeps files, removes apps): Settings → System → Recovery → Reset this PC → Keep my files.
  3. Clean install: Backup data first, boot from USB media, format and reinstall.

Frequently Asked Questions

powershell
# ============================================================
# SYSTEM_SERVICE_EXCEPTION Diagnostic & Fix Script
# Run in an ELEVATED PowerShell window (Run as Administrator)
# ============================================================

Write-Host "=== Step 1: Read last 5 BSOD events from System log ==="
Get-WinEvent -LogName System -ErrorAction SilentlyContinue |
    Where-Object { $_.Id -eq 1001 -and $_.Message -match 'BugCheck' } |
    Select-Object -First 5 |
    Format-List TimeCreated, Message

Write-Host "`n=== Step 2: List recent minidump files ==="
Get-ChildItem -Path "$env:SystemRoot\Minidump" -Filter "*.dmp" -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending |
    Select-Object -First 10 |
    Format-Table Name, LastWriteTime, Length

Write-Host "`n=== Step 3: Run DISM to repair Windows image ==="
Start-Process -FilePath "dism.exe" -ArgumentList "/Online /Cleanup-Image /RestoreHealth" -Wait -NoNewWindow

Write-Host "`n=== Step 4: Run SFC to fix system files ==="
Start-Process -FilePath "sfc.exe" -ArgumentList "/scannow" -Wait -NoNewWindow

Write-Host "`n=== Step 5: Check disk for errors (schedules chkdsk on next reboot) ==="
# Uncomment the line below to schedule chkdsk
# Start-Process -FilePath "chkdsk.exe" -ArgumentList "C: /f /r /x" -Wait -NoNewWindow

Write-Host "`n=== Step 6: Show installed GPU drivers ==="
Get-WmiObject Win32_VideoController | Select-Object Name, DriverVersion, DriverDate | Format-Table -AutoSize

Write-Host "`n=== Step 7: Check for outdated or unsigned drivers ==="
Get-WmiObject Win32_SystemDriver |
    Where-Object { $_.State -eq 'Running' } |
    Select-Object Name, PathName, Started |
    Sort-Object Name |
    Format-Table -AutoSize

Write-Host "`n=== Step 8: Disable NDU (Network Diagnostics Usage) if ndu.sys is faulting ==="
# NDU can cause BSODs on some systems. Uncomment to disable:
# Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Ndu' -Name 'Start' -Value 4
# Write-Host 'NDU disabled. Reboot required.'

Write-Host "`n=== Step 9: Check RAM via Windows Memory Diagnostic ==="
Write-Host "Launching Windows Memory Diagnostic (mdsched.exe)..."
# Uncomment to launch:
# Start-Process -FilePath "mdsched.exe"

Write-Host "`n=== Step 10: Verify SMART status of all drives ==="
Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus |
    Select-Object InstanceName, PredictFailure, Reason |
    Format-Table -AutoSize

Write-Host "`n=== Diagnostics complete. Review output above for anomalies. ==="
Write-Host "Next step: Open C:\Windows\Minidump files in WinDbg or WhoCrashed for module-level detail."
E

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, Windows kernel enthusiasts, and SRE practitioners with a combined 40+ years of experience diagnosing and resolving Windows system errors, driver conflicts, and enterprise infrastructure outages. Our guides are tested on real hardware and virtual environments running Windows 8.1 through Windows 11, ensuring every command and fix path is verified before publication.

Sources

Related Articles in Other System Service Exception

Explore More windows Guides