Windows Blue Screen of Death (BSOD): Complete Troubleshooting Guide for All Stop Codes
Fix Windows blue screen errors including MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION, VIDEO_TDR_FAILURE & more. Step-by-step repair guide with real commands.
- Most BSODs are caused by faulty drivers, bad RAM, corrupted system files, or failing storage devices — the stop code displayed (e.g., 0xc00021a, MEMORY_MANAGEMENT, KERNEL_SECURITY_CHECK_FAILURE) points directly to the root cause.
- Hardware issues such as overheating, failing NVMe/SSD drives (UNMOUNTABLE_BOOT_VOLUME, NTFS.SYS), and incompatible GPU drivers (nvlddmkm.sys, VIDEO_TDR_FAILURE) are among the top triggers for recurring blue screen loops.
- Quick fix path: Boot into Safe Mode → run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' → check Event Viewer for the faulting module → update or roll back the offending driver → run Windows Memory Diagnostic or MemTest86 for RAM issues → use Startup Repair if the system won't boot.
| Method | When to Use | Time | Risk |
|---|---|---|---|
| SFC + DISM Scan | Corrupted system files, random BSODs, post-update failures | 15–30 min | Low |
| Driver Rollback / Update | BSOD after driver/Windows update; nvlddmkm.sys, wdf_violation, video_tdr_failure | 10–20 min | Low |
| Windows Memory Diagnostic / MemTest86 | MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, BAD_POOL_HEADER | 30 min – 8 hrs | None |
| CHKDSK /f /r | UNMOUNTABLE_BOOT_VOLUME, NTFS.SYS, disk I/O errors | 30 min – 2 hrs | Low |
| Startup Repair (WinRE) | BSOD loop at startup, 0xc00021a, system won't boot | 10–30 min | Low |
| System Restore | BSOD started after a specific install/update | 20–40 min | Low–Medium |
| Clean Driver Reinstall (DDU) | Persistent GPU BSODs after driver update | 20–30 min | Low |
| Reinstall Windows | Severe system corruption, recurring unfixable BSODs | 1–3 hrs | High (data loss risk) |
Understanding the Windows Blue Screen of Death (BSOD)
A Blue Screen of Death (BSOD) — officially called a Stop Error — occurs when Windows encounters a critical system error it cannot recover from safely. The system halts to prevent data corruption, writes a memory dump file to disk, and displays a stop code. Since Windows 8, a QR code also appears on the blue screen linking to Microsoft's support site.
Every BSOD has three key identifiers:
- Stop code (e.g.,
MEMORY_MANAGEMENT,SYSTEM_SERVICE_EXCEPTION) - Faulting module (e.g.,
ntfs.sys,nvlddmkm.sys,wdf01000.sys) - Bug check code in hex (e.g.,
0x0000001A,0x0000003B,0xC0000021A)
Step 1: Capture and Read the Stop Code
If the system reboots too fast to read the screen:
- Open System Properties → Advanced → Startup and Recovery → Settings
- Uncheck Automatically restart under System Failure
- On the next crash, the screen stays visible
Alternatively, read past crashes from the memory dump:
windir\Minidump\ (small memory dumps, default location)
C:\Windows\MEMORY.DMP (full/kernel dump)
Open dumps with WinDbg (Windows Debugger from the Windows SDK) or upload to an online BSOD analyzer.
Step 2: Check Event Viewer for the Faulting Module
- Press
Win + X→ Event Viewer - Navigate to Windows Logs → System
- Filter by Error and look for events near the crash time
- Also check Windows Logs → Application for critical errors
- For BSOD-specific logs: Applications and Services Logs → Microsoft → Windows → WER-Diagnostics
The faulting module (e.g., nvlddmkm.sys for NVIDIA GPU driver crashes, ntfs.sys for filesystem corruption) is almost always listed here.
Step 3: Run System File Checker and DISM
Corrupted Windows system files cause a large percentage of BSODs. Run these commands in an elevated Command Prompt:
sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
Restart after completion and test for stability.
Step 4: Diagnose RAM (MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, UNEXPECTED_KERNEL_MODE_TRAP)
Stop codes 0x0000001A (MEMORY_MANAGEMENT), 0x0000004E (PFN_LIST_CORRUPT), and 0x0000007F (UNEXPECTED_KERNEL_MODE_TRAP) almost always indicate RAM hardware failure or misconfiguration.
Windows Memory Diagnostic (built-in):
mdsched.exe
Choose Restart now and check for problems. Results appear after reboot in Event Viewer under Memory Diagnostic-Results.
MemTest86 (more thorough): Download from memtest86.com, write to USB, boot from it, and let it run at least 2 full passes (overnight preferred). Any errors = replace the RAM stick.
Additional RAM checks:
- Reseat RAM sticks (remove, clean contacts, reinsert)
- Test one stick at a time to isolate a faulty module
- Check XMP/EXPO profile in BIOS — disable if overclocked
Step 5: Fix Disk/Filesystem Errors (NTFS.SYS, UNMOUNTABLE_BOOT_VOLUME)
Stop codes involving ntfs.sys or UNMOUNTABLE_BOOT_VOLUME (0x000000ED) point to filesystem corruption or a failing drive.
chkdsk C: /f /r /x
If the drive is in use, schedule it for next boot. Also check drive health:
wmic diskdrive get status
powershell Get-PhysicalDisk | Select FriendlyName, HealthStatus, OperationalStatus
For NVMe drives, use the manufacturer's tool (Samsung Magician, WD Dashboard, CrystalDiskInfo) to check reallocated sectors and SMART data.
Step 6: Fix Driver-Related BSODs
GPU Drivers (nvlddmkm.sys / VIDEO_TDR_FAILURE)
nvlddmkm.sys is the NVIDIA kernel-mode driver. VIDEO_TDR_FAILURE (0x00000116) means the GPU stopped responding.
Fix:
- Boot into Safe Mode (hold Shift → Restart → Troubleshoot → Advanced Options → Safe Mode with Networking)
- Use Display Driver Uninstaller (DDU) to completely remove GPU drivers
- Download the latest or a known-stable driver from nvidia.com or amd.com
- Perform a clean install
SYSTEM_SERVICE_EXCEPTION (0x0000003B)
Caused by a system service crashing — often antivirus, filter drivers, or third-party kernel-mode software.
- Check the faulting module in WinDbg or Event Viewer
- Update or uninstall the offending application
- Commonly:
win32kfull.sys,ntfs.sys,ataport.sys
WDF_VIOLATION (0x0000010D)
Windows Driver Framework violation — usually a peripheral driver (USB, audio, printer).
- Unplug all non-essential USB devices
- Update chipset, USB, and audio drivers from the motherboard manufacturer's site
KERNEL_SECURITY_CHECK_FAILURE (0x00000139)
Memory corruption or invalid kernel data structure, often from incompatible or outdated drivers.
- Run
verifier.exe(Driver Verifier) to stress-test drivers - Check for BIOS updates
Step 7: Fix Boot-Time BSODs (0xc00021a, Startup Loop)
0xC0000021A means a critical system process (Winlogon or CSRSS) terminated unexpectedly.
From Windows Recovery Environment (WinRE):
- Boot from Windows USB → Repair your computer
- Troubleshoot → Advanced Options → Startup Repair
- If Startup Repair fails, try System Restore
- As last resort before reinstall: Command Prompt in WinRE:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
Step 8: Check for Malware
Certain BSODs (especially on ntfs.sys, winlogon.exe, or random stop codes) can be caused by rootkits or kernel-level malware.
- Boot from a rescue USB (Kaspersky Rescue Disk, Malwarebytes bootable)
- Run Windows Defender Offline Scan:
Start → Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan - Check for suspicious services:
msconfig→ Services → Hide all Microsoft services
Step 9: Advanced — Use Driver Verifier
Driver Verifier stresses drivers to catch misbehaving ones that cause intermittent BSODs:
verifier.exe
Select Create standard settings → Automatically select all drivers installed on this computer. Reboot. The next BSOD will now name the exact faulty driver. Disable Verifier after finding the culprit:
verifier /reset
Step 10: Interpret the BSOD QR Code and Stop Code
Since Windows 10, each BSOD shows a QR code and a stop code like MEMORY_MANAGEMENT. Scan the QR code or visit:
https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2
Common stop codes quick-reference:
0x0000001A= MEMORY_MANAGEMENT → RAM failure0x0000003B= SYSTEM_SERVICE_EXCEPTION → driver/service crash0x0000007E= SYSTEM_THREAD_EXCEPTION_NOT_HANDLED → driver crash0x00000116= VIDEO_TDR_FAILURE → GPU driver hung0x000000ED= UNMOUNTABLE_BOOT_VOLUME → disk/filesystem error0x0000004E= PFN_LIST_CORRUPT → RAM or driver corruption0xC0000021A= STATUS_SYSTEM_PROCESS_TERMINATED → critical process crash0x0000010D= WDF_VIOLATION → driver framework error0x00000139= KERNEL_SECURITY_CHECK_FAILURE → memory/stack corruption
Frequently Asked Questions
# ============================================================
# Windows BSOD Comprehensive Diagnostic Script
# Run as Administrator in PowerShell
# ============================================================
# 1. Display recent BSOD events from Event Log
Write-Host "=== Recent BSOD Events ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1001,6008} -MaxEvents 10 |
Select-Object TimeCreated, Id, Message | Format-List
# 2. List minidump files with timestamps
Write-Host "`n=== Minidump Files ==="
Get-ChildItem 'C:\Windows\Minidump\' -ErrorAction SilentlyContinue |
Sort-Object LastWriteTime -Descending |
Select-Object Name, LastWriteTime, Length
# 3. Run System File Checker
Write-Host "`n=== Running SFC Scan ==="
sfc /scannow
# 4. Run DISM Health Restore
Write-Host "`n=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth
# 5. Check disk health via SMART (WMIC)
Write-Host "`n=== Disk SMART Status ==="
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus, Size
# 6. Schedule CHKDSK on next reboot
Write-Host "`n=== Scheduling CHKDSK ==="
cmd /c "echo Y | chkdsk C: /f /r"
# Note: Will run on next system restart
# 7. Check for pending Windows updates (may cause BSODs if incomplete)
Write-Host "`n=== Checking Windows Update Status ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
# 8. List recently installed drivers (potential culprits)
Write-Host "`n=== Recently Installed Drivers (last 30 days) ==="
$cutoff = (Get-Date).AddDays(-30)
Get-WindowsDriver -Online |
Where-Object { $_.Date -gt $cutoff } |
Select-Object Driver, ProviderName, Date, Version |
Sort-Object Date -Descending
# 9. Check RAM info
Write-Host "`n=== RAM Information ==="
Get-CimInstance Win32_PhysicalMemory |
Select-Object Tag, Capacity, Speed, Manufacturer, PartNumber
# 10. Launch Windows Memory Diagnostic (interactive)
Write-Host "`n=== Launching Windows Memory Diagnostic ==="
Write-Host "Select 'Restart now and check for problems' to begin RAM testing."
Start-Process mdsched.exe
# 11. Export last 50 System errors to CSV for offline review
Write-Host "`n=== Exporting System Errors to C:\bsod_report.csv ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 50 |
Select-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message |
Export-Csv -Path 'C:\bsod_report.csv' -NoTypeInformation
Write-Host "Report saved to C:\bsod_report.csv"
# 12. Check Driver Verifier status
Write-Host "`n=== Driver Verifier Status ==="
verifier /query
Write-Host "`n=== Diagnostic Complete ==="
Write-Host "Review the output above and check C:\bsod_report.csv for detailed event logs."Error Medic Editorial
The Error Medic Editorial team consists of senior DevOps engineers, Windows SREs, and system administrators with 10+ years of experience diagnosing and resolving critical Windows failures in enterprise and consumer environments. Our guides are built from real incident post-mortems, Microsoft documentation, and thousands of community-validated fixes.
Sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
- https://learn.microsoft.com/en-us/troubleshoot/windows-client/performance/stop-error-or-blue-screen-error-troubleshooting
- https://support.microsoft.com/en-us/windows/fix-blue-screen-errors-in-windows-f1b2b5d6-01c8-4178-b1ef-0f8b0aeaabeb
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg
- https://answers.microsoft.com/en-us/windows/forum/all/blue-screen-of-death-bsod/
- https://www.memtest86.com/
- https://github.com/nicehash/NiceHashQuickMiner/issues