What causes SYSTEM_SERVICE_EXCEPTION specifically with ntfs.sys on the blue screen?

When ntfs.sys appears on the BSOD, it indicates a fault in the Windows NTFS filesystem driver — usually caused by disk corruption, bad sectors, a failing hard drive or SSD, or corrupted filesystem metadata. Run 'chkdsk C: /f /r /x' from an elevated command prompt (schedule it for reboot when prompted), then also run 'sfc /scannow' and DISM RestoreHealth. If errors persist after chkdsk, back up data immediately and test the drive with manufacturer tools (e.g., CrystalDiskInfo, SeaTools, Samsung Magician) to check for physical drive failure.

Why do I get SYSTEM_SERVICE_EXCEPTION when playing games, and how do I fix it?

Gaming-related SYSTEM_SERVICE_EXCEPTION BSODs most commonly stem from GPU driver faults (nvlddmkm.sys for NVIDIA, amdkmdag.sys for AMD, dxgkrnl.sys for DirectX). The GPU is under heavy load during gaming, exposing driver bugs or instability from overclocking. Fix steps: (1) Perform a clean GPU driver reinstall using DDU in Safe Mode, then install the latest driver from NVIDIA/AMD. (2) If your GPU or VRAM is overclocked, reset to stock clocks. (3) Update DirectX and Visual C++ Redistributables. (4) Check GPU temperatures with MSI Afterburner — thermal throttling or overheating can trigger driver crashes.

What is the difference between stop code 0x0000003B and IRQL_NOT_LESS_OR_EQUAL when it comes to SYSTEM_SERVICE_EXCEPTION?

Both are kernel-mode BSOD errors related to driver or memory access violations, but they differ in mechanism. SYSTEM_SERVICE_EXCEPTION (0x0000003B) specifically occurs when a system service or driver makes an illegal call while transitioning between user mode and kernel mode — it's a mode-switch violation. IRQL_NOT_LESS_OR_EQUAL (0x0000000A) occurs when a driver attempts to access memory at an IRQL that is too high for the memory address being accessed. They can share the same root causes (bad drivers, bad RAM), but the stop code 0x0000003B more often points to driver logic errors rather than pure memory timing issues.

How do I fix SYSTEM_SERVICE_EXCEPTION in Windows 11 when the error shows win32kfull.sys or win32kbase.sys?

win32kfull.sys and win32kbase.sys are core Windows Win32 subsystem kernel modules. A fault here is usually caused by corrupted Windows system files, a problematic Windows update, or a conflict with a display driver or accessibility tool. Fix steps: (1) Run 'sfc /scannow' followed by DISM RestoreHealth commands in an elevated PowerShell. (2) Roll back any recent Windows Updates via Settings → Windows Update → Update History → Uninstall Updates. (3) Update your GPU driver using a clean install via DDU. (4) Disable or uninstall third-party screen overlays, accessibility software, or tools that hook into the Win32 subsystem (e.g., certain screen readers, remote desktop tools, or OBS hooks). (5) If the issue persists, perform an in-place upgrade using Windows Media Creation Tool.

Can SYSTEM_SERVICE_EXCEPTION be caused by antivirus or security software, and how do I check?

Yes. Security software that uses filesystem filter drivers (fltmgr.sys), network inspection drivers, or kernel-mode hooks can trigger this BSOD — especially fltmgr.sys, ndis.sys, and netio.sys variants. To check: (1) Boot into Safe Mode — security software is not loaded. If the BSOD does not occur in Safe Mode, the security software is likely the cause. (2) Perform a Clean Boot via msconfig to systematically disable third-party services. (3) Temporarily uninstall the antivirus completely (use the vendor's official removal tool, e.g., ESET Uninstaller, Avast Clear) and observe. (4) If confirmed, update to the latest version of the security software or switch to a different product.

SYSTEM_SERVICE_EXCEPTION (0x0000003B): Complete Blue Screen Fix Guide for Windows 10 & 11

Fix SYSTEM_SERVICE_EXCEPTION BSOD on Windows 10/11. Step-by-step guide covering ntfs.sys, win32kfull.sys, nvlddmkm.sys, amdkmdag.sys & more. Resolve now.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,487 words

Key Takeaways

SYSTEM_SERVICE_EXCEPTION (stop code 0x0000003B) occurs when a system service or driver attempts to access protected kernel memory from user mode, violating Windows security boundaries.
The most common culprits are faulty or outdated drivers — especially GPU drivers (nvlddmkm.sys, amdkmdag.sys), filesystem filters (ntfs.sys, fltmgr.sys), and graphics subsystem files (win32kfull.sys, win32kbase.sys, dxgkrnl.sys).
Corrupted Windows system files, bad RAM, overclocking instability, and conflicting third-party software (antivirus, virtualization tools like VMware) are other frequent root causes.
Quick fix priority: (1) Update or roll back the offending driver, (2) Run SFC and DISM to repair system files, (3) Run Windows Memory Diagnostic for RAM issues, (4) Boot into Safe Mode if the system won't start normally.
Always note the .sys or .dll file name displayed on the blue screen — it pinpoints the exact driver or module responsible and cuts diagnostic time significantly.

Fix Approaches Compared
Method	When to Use	Time	Risk
Update/Roll Back GPU Driver	BSOD names nvlddmkm.sys, amdkmdag.sys, dxgkrnl.sys, igdkmd64.sys	10-20 min	Low
SFC + DISM System File Repair	BSOD names ntfs.sys, ntoskrnl.exe, win32kfull.sys, cdd.dll, cldflt.sys	15-30 min	Low
Windows Memory Diagnostic / MemTest86	Random BSODs with no consistent .sys file, errors after hardware changes	30 min – 8 hrs	None
Uninstall Conflicting Software	BSOD after installing new app, antivirus, VMware, audio software (rtkvhd64.sys, asio.sys)	5-15 min	Low
Clean Boot / Safe Mode Isolation	Cannot identify the offending driver, BSOD on startup	20-40 min	Low
Windows Update	Multiple BSODs across different .sys files, known OS bug	15-45 min	Low
Check Disk (CHKDSK)	BSOD specifically mentions ntfs.sys or file system corruption suspected	30-60 min	Very Low
Overclocking Reset to Default	BSOD during gaming or heavy load, system is overclocked	5 min	None
In-Place Upgrade / Reset Windows	All other fixes failed, BSOD persists across multiple drivers	1-3 hrs	Medium
Hardware Replacement	MemTest86 confirms RAM errors, or disk shows physical bad sectors	Varies	Low (with backup)

Understanding the SYSTEM_SERVICE_EXCEPTION Error

The SYSTEM_SERVICE_EXCEPTION blue screen (stop code 0x0000003B) is one of the most common Windows kernel-mode failures. It occurs when code executing at a higher IRQL (Interrupt Request Level) — typically a device driver or kernel module — attempts an invalid memory operation, such as reading from or writing to a user-mode address while running in kernel context. Windows immediately halts execution to prevent data corruption, producing the BSOD.

The exact error string you will see on screen is:

Your PC ran into a problem and needs to restart.
STOP CODE: SYSTEM_SERVICE_EXCEPTION
Failed: <filename>.sys or <filename>.dll

The filename after 'Failed:' is your most important diagnostic clue. Common filenames and their associated subsystems include:

nvlddmkm.sys — NVIDIA display driver kernel module
amdkmdag.sys — AMD/ATI display driver
igdkmd64.sys — Intel integrated graphics driver
dxgkrnl.sys / dxgmms1.sys — DirectX Graphics Kernel (GPU scheduling)
ntfs.sys — Windows NTFS filesystem driver
win32kfull.sys / win32kbase.sys / win32k.sys — Windows Win32 kernel subsystem
fltmgr.sys — Windows Filter Manager (used by antivirus and filesystem filters)
ndis.sys / netio.sys / afd.sys — Network driver interface and stack
ntoskrnl.exe — Windows NT OS Kernel itself
cdd.dll / cl.dll — Canonical Display Driver components
cldflt.sys — OneDrive cloud file filter driver
wdf01000.sys — Windows Driver Framework
ndu.sys — Windows Network Data Usage
ks.sys — Kernel Streaming (audio/video devices)
rtkvhd64.sys — Realtek HD Audio driver
spuvcbv64.sys — SoundBlaster/Creative USB audio driver
gdrv3.sys — GIGABYTE utility driver
asio.sys — ASIO audio driver
cng.sys — Cryptography Next Generation kernel module

Step 1: Capture the Crash Information

Before attempting any fix, gather the crash data. Windows writes a minidump file every time a BSOD occurs.

Locate minidump files:

C:\Windows\Minidump\

If the system is bootable, open Event Viewer (eventvwr.msc) → Windows Logs → System → filter for Critical events near the crash time.

Use WinDbg (Windows Debugger) from the Microsoft Store or Windows SDK to analyze the dump:

windbg -z C:\Windows\Minidump\<dumpfile>.dmp

Once loaded in WinDbg, run:

!analyze -v

This outputs the faulting module, exception address, and stack trace — giving you the exact driver to investigate.

Step 2: Identify and Fix the Offending Driver

GPU Drivers (nvlddmkm.sys, amdkmdag.sys, igdkmd64.sys, dxgkrnl.sys)

GPU driver faults are the #1 cause of this BSOD, especially during gaming or GPU-intensive tasks.

Option A — Update the GPU driver:

Press Win+X → Device Manager
Expand Display Adapters → right-click your GPU → Update driver
Alternatively, download directly from NVIDIA (https://www.nvidia.com/drivers) or AMD (https://www.amd.com/support)

Option B — Perform a clean driver install using DDU (Display Driver Uninstaller):

Boot into Safe Mode (hold Shift, click Restart → Troubleshoot → Advanced → Startup Settings → Safe Mode)
Run DDU, select your GPU brand, click 'Clean and restart'
After restart, install the latest driver from the manufacturer's website

Option C — Roll back to a previous driver:

Device Manager → Display Adapters → right-click GPU → Properties → Driver tab → Roll Back Driver

System File Corruption (ntfs.sys, ntoskrnl.exe, win32kfull.sys, cdd.dll, cldflt.sys)

Corrupted Windows system files cause the kernel or filesystem layer to fault. Run these commands in an elevated Command Prompt or PowerShell:

# Step 1: Run System File Checker
sfc /scannow

# Step 2: If SFC finds unfixable errors, run DISM to restore the Windows image
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

# Step 3: Run SFC again after DISM completes
sfc /scannow

NTFS Filesystem Issues (ntfs.sys, cldflt.sys)

# Schedule a disk check on next reboot (C: drive)
chkdsk C: /f /r /x

Type Y when prompted to schedule for next reboot, then restart.

Network Driver Issues (ndis.sys, netio.sys, afd.sys)

Device Manager → Network Adapters → right-click each adapter → Update driver
If a VPN or network filter software was recently installed, try uninstalling it
Reset the TCP/IP stack:

netsh int ip reset
netsh winsock reset
ipconfig /flushdns

Restart after running these commands.

Audio Driver Issues (rtkvhd64.sys, asio.sys, ks.sys, spuvcbv64.sys)

Device Manager → Sound, video and game controllers → right-click → Update driver
For Realtek audio: download the latest driver from your motherboard manufacturer's support page
For ASIO drivers: update or reinstall the audio interface software (e.g., ASIO4ALL, Focusrite Control)

VMware Workstation Issues

If the BSOD occurs when running VMware:

Update VMware Workstation to the latest version
Check for Windows updates — VMware kernel modules must be compatible with the current Windows build
Temporarily disable Hyper-V if it conflicts: bcdedit /set hypervisorlaunchtype off (restart required)

Step 3: Check for RAM Problems

Defective RAM can trigger any BSOD including SYSTEM_SERVICE_EXCEPTION, especially with error code 0x0000003B.

Windows Memory Diagnostic (quick test):

Win+R → mdsched.exe → Restart now and check for problems

MemTest86 (thorough, bootable test):

Download MemTest86 from https://www.memtest86.com
Flash to a USB drive using the provided tool
Boot from the USB and run at least 2 full passes
Any errors indicate faulty RAM — test sticks one at a time to isolate the bad module

If RAM is overclocked via XMP/EXPO profile, try disabling XMP in BIOS and running at stock speeds to check stability.

Step 4: Clean Boot to Isolate Third-Party Software

If the BSOD filename points to a non-Microsoft driver or you can't identify the cause:

Press Win+R → type msconfig → OK
Services tab → check 'Hide all Microsoft services' → click 'Disable all'
Startup tab → click 'Open Task Manager' → disable all startup items
Restart and test — if BSOD stops, re-enable services in groups to isolate the culprit

Step 5: Update Windows and Check Windows Update History

Some SYSTEM_SERVICE_EXCEPTION errors are caused by known Windows bugs fixed in later updates. Check:

Settings → Windows Update → Check for updates

If a recent update caused the BSOD, uninstall it:

Settings → Windows Update → Update history → Uninstall updates

Or via command line:

wusa /uninstall /kb:XXXXXXX

Step 6: Reset Overclocking Settings

If your CPU, GPU, or RAM is overclocked, any instability can manifest as kernel exceptions:

Enter BIOS/UEFI (typically Del or F2 at boot)
Reset all settings to default / Load Optimized Defaults
Disable XMP/EXPO if enabled for RAM
Save and exit

Step 7: Last Resort — In-Place Upgrade or Reset

If all above steps fail:

In-place upgrade (preserves files and apps):

Download the Windows 11/10 Media Creation Tool from Microsoft
Run setup.exe from the ISO/tool
Choose 'Upgrade this PC now' → keep personal files and apps

Reset Windows:

Settings → System → Recovery → Reset this PC

Choose 'Keep my files' for a less destructive reset.

Frequently Asked Questions

powershell

# ============================================================
# SYSTEM_SERVICE_EXCEPTION Diagnostic & Fix Script
# Run as Administrator in PowerShell
# ============================================================

Write-Host "=== Step 1: Check Windows Event Log for recent BSODs ==" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1} -MaxEvents 20 |
    Select-Object TimeCreated, Id, Message |
    Format-List

Write-Host ""
Write-Host "=== Step 2: List recent minidump files ==" -ForegroundColor Cyan
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem -Path $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 10 | Format-Table Name, LastWriteTime, Length
} else {
    Write-Host "No minidump folder found. Enable kernel memory dumps: Control Panel > System > Advanced > Startup and Recovery." -ForegroundColor Yellow
}

Write-Host ""
Write-Host "=== Step 3: Run System File Checker ==" -ForegroundColor Cyan
sfc /scannow

Write-Host ""
Write-Host "=== Step 4: Run DISM to restore Windows image health ==" -ForegroundColor Cyan
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Write-Host ""
Write-Host "=== Step 5: SFC scan again after DISM ==" -ForegroundColor Cyan
sfc /scannow

Write-Host ""
Write-Host "=== Step 6: Check disk health for C: drive ==" -ForegroundColor Cyan
# Note: This schedules chkdsk for next reboot. Uncomment to run.
# echo Y | chkdsk C: /f /r /x
Write-Host "CHKDSK is commented out. To schedule, run: chkdsk C: /f /r /x" -ForegroundColor Yellow

Write-Host ""
Write-Host "=== Step 7: Check for driver verifier faults ==" -ForegroundColor Cyan
verifier /query

Write-Host ""
Write-Host "=== Step 8: List all third-party (non-Microsoft) kernel drivers ==" -ForegroundColor Cyan
Get-WmiObject Win32_SystemDriver |
    Where-Object { $_.PathName -notlike "*\system32\*" -and $_.PathName -notlike "*\syswow64\*" } |
    Select-Object Name, State, PathName |
    Format-Table -AutoSize

Write-Host ""
Write-Host "=== Step 9: Reset TCP/IP stack (for ndis.sys / netio.sys BSODs) ==" -ForegroundColor Cyan
# Uncomment if network driver is suspected:
# netsh int ip reset
# netsh winsock reset
# ipconfig /flushdns
Write-Host "TCP/IP reset commands are commented out. Uncomment if needed." -ForegroundColor Yellow

Write-Host ""
Write-Host "=== Step 10: Run Windows Memory Diagnostic ==" -ForegroundColor Cyan
Write-Host "Launching Windows Memory Diagnostic. Choose 'Restart now and check for problems'." -ForegroundColor Green
# Uncomment to launch:
# Start-Process mdsched.exe
Write-Host "Command: Start-Process mdsched.exe (uncomment to run)" -ForegroundColor Yellow

Write-Host ""
Write-Host "=== Diagnostics complete. Review output above for errors. ==" -ForegroundColor Green
Write-Host "Next step: Open WinDbg, load the most recent .dmp file, and run: !analyze -v" -ForegroundColor Cyan

Error Medic Editorial

The Error Medic Editorial team consists of senior DevOps engineers, Windows system administrators, and SRE professionals with over 15 years of combined experience diagnosing kernel-mode failures, BSOD errors, and system instability issues across enterprise and consumer Windows environments. Our guides are built from real-world incident response, crash dump analysis, and hands-on hardware debugging — not generic advice.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.