Error Medic

Windows Blue Screen of Death (BSOD): Complete Troubleshooting Guide for All Stop Codes

Fix Windows blue screen errors including MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION, VIDEO_TDR_FAILURE & more. Step-by-step repair guide with real commands.

Last updated:
Last verified:
2,072 words
Key Takeaways
  • Most BSODs are caused by faulty drivers, bad RAM, corrupted system files, or failing storage devices — the stop code displayed (e.g., 0xc00021a, MEMORY_MANAGEMENT, KERNEL_SECURITY_CHECK_FAILURE) points directly to the root cause.
  • Hardware issues such as overheating, failing NVMe/SSD drives (UNMOUNTABLE_BOOT_VOLUME, NTFS.SYS), and incompatible GPU drivers (nvlddmkm.sys, VIDEO_TDR_FAILURE) are among the top triggers for recurring blue screen loops.
  • Quick fix path: Boot into Safe Mode → run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' → check Event Viewer for the faulting module → update or roll back the offending driver → run Windows Memory Diagnostic or MemTest86 for RAM issues → use Startup Repair if the system won't boot.
BSOD Fix Approaches Compared
MethodWhen to UseTimeRisk
SFC + DISM ScanCorrupted system files, random BSODs, post-update failures15–30 minLow
Driver Rollback / UpdateBSOD after driver/Windows update; nvlddmkm.sys, wdf_violation, video_tdr_failure10–20 minLow
Windows Memory Diagnostic / MemTest86MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, BAD_POOL_HEADER30 min – 8 hrsNone
CHKDSK /f /rUNMOUNTABLE_BOOT_VOLUME, NTFS.SYS, disk I/O errors30 min – 2 hrsLow
Startup Repair (WinRE)BSOD loop at startup, 0xc00021a, system won't boot10–30 minLow
System RestoreBSOD started after a specific install/update20–40 minLow–Medium
Clean Driver Reinstall (DDU)Persistent GPU BSODs after driver update20–30 minLow
Reinstall WindowsSevere system corruption, recurring unfixable BSODs1–3 hrsHigh (data loss risk)

Understanding the Windows Blue Screen of Death (BSOD)

A Blue Screen of Death (BSOD) — officially called a Stop Error — occurs when Windows encounters a critical system error it cannot recover from safely. The system halts to prevent data corruption, writes a memory dump file to disk, and displays a stop code. Since Windows 8, a QR code also appears on the blue screen linking to Microsoft's support site.

Every BSOD has three key identifiers:

  • Stop code (e.g., MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION)
  • Faulting module (e.g., ntfs.sys, nvlddmkm.sys, wdf01000.sys)
  • Bug check code in hex (e.g., 0x0000001A, 0x0000003B, 0xC0000021A)

Step 1: Capture and Read the Stop Code

If the system reboots too fast to read the screen:

  1. Open System PropertiesAdvancedStartup and Recovery → Settings
  2. Uncheck Automatically restart under System Failure
  3. On the next crash, the screen stays visible

Alternatively, read past crashes from the memory dump:

windir\Minidump\  (small memory dumps, default location)
C:\Windows\MEMORY.DMP  (full/kernel dump)

Open dumps with WinDbg (Windows Debugger from the Windows SDK) or upload to an online BSOD analyzer.


Step 2: Check Event Viewer for the Faulting Module

  1. Press Win + XEvent Viewer
  2. Navigate to Windows Logs → System
  3. Filter by Error and look for events near the crash time
  4. Also check Windows Logs → Application for critical errors
  5. For BSOD-specific logs: Applications and Services Logs → Microsoft → Windows → WER-Diagnostics

The faulting module (e.g., nvlddmkm.sys for NVIDIA GPU driver crashes, ntfs.sys for filesystem corruption) is almost always listed here.


Step 3: Run System File Checker and DISM

Corrupted Windows system files cause a large percentage of BSODs. Run these commands in an elevated Command Prompt:

sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Restart after completion and test for stability.


Step 4: Diagnose RAM (MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, UNEXPECTED_KERNEL_MODE_TRAP)

Stop codes 0x0000001A (MEMORY_MANAGEMENT), 0x0000004E (PFN_LIST_CORRUPT), and 0x0000007F (UNEXPECTED_KERNEL_MODE_TRAP) almost always indicate RAM hardware failure or misconfiguration.

Windows Memory Diagnostic (built-in):

mdsched.exe

Choose Restart now and check for problems. Results appear after reboot in Event Viewer under Memory Diagnostic-Results.

MemTest86 (more thorough): Download from memtest86.com, write to USB, boot from it, and let it run at least 2 full passes (overnight preferred). Any errors = replace the RAM stick.

Additional RAM checks:

  • Reseat RAM sticks (remove, clean contacts, reinsert)
  • Test one stick at a time to isolate a faulty module
  • Check XMP/EXPO profile in BIOS — disable if overclocked

Step 5: Fix Disk/Filesystem Errors (NTFS.SYS, UNMOUNTABLE_BOOT_VOLUME)

Stop codes involving ntfs.sys or UNMOUNTABLE_BOOT_VOLUME (0x000000ED) point to filesystem corruption or a failing drive.

chkdsk C: /f /r /x

If the drive is in use, schedule it for next boot. Also check drive health:

wmic diskdrive get status
powershell Get-PhysicalDisk | Select FriendlyName, HealthStatus, OperationalStatus

For NVMe drives, use the manufacturer's tool (Samsung Magician, WD Dashboard, CrystalDiskInfo) to check reallocated sectors and SMART data.


Step 6: Fix Driver-Related BSODs

GPU Drivers (nvlddmkm.sys / VIDEO_TDR_FAILURE)

nvlddmkm.sys is the NVIDIA kernel-mode driver. VIDEO_TDR_FAILURE (0x00000116) means the GPU stopped responding.

Fix:

  1. Boot into Safe Mode (hold Shift → Restart → Troubleshoot → Advanced Options → Safe Mode with Networking)
  2. Use Display Driver Uninstaller (DDU) to completely remove GPU drivers
  3. Download the latest or a known-stable driver from nvidia.com or amd.com
  4. Perform a clean install

SYSTEM_SERVICE_EXCEPTION (0x0000003B)

Caused by a system service crashing — often antivirus, filter drivers, or third-party kernel-mode software.

  • Check the faulting module in WinDbg or Event Viewer
  • Update or uninstall the offending application
  • Commonly: win32kfull.sys, ntfs.sys, ataport.sys

WDF_VIOLATION (0x0000010D)

Windows Driver Framework violation — usually a peripheral driver (USB, audio, printer).

  • Unplug all non-essential USB devices
  • Update chipset, USB, and audio drivers from the motherboard manufacturer's site

KERNEL_SECURITY_CHECK_FAILURE (0x00000139)

Memory corruption or invalid kernel data structure, often from incompatible or outdated drivers.

  • Run verifier.exe (Driver Verifier) to stress-test drivers
  • Check for BIOS updates

Step 7: Fix Boot-Time BSODs (0xc00021a, Startup Loop)

0xC0000021A means a critical system process (Winlogon or CSRSS) terminated unexpectedly.

From Windows Recovery Environment (WinRE):

  1. Boot from Windows USB → Repair your computer
  2. Troubleshoot → Advanced Options → Startup Repair
  3. If Startup Repair fails, try System Restore
  4. As last resort before reinstall: Command Prompt in WinRE:
bootrec /fixmbr
bootrec /fixboot
bootrec /rebuildbcd
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Step 8: Check for Malware

Certain BSODs (especially on ntfs.sys, winlogon.exe, or random stop codes) can be caused by rootkits or kernel-level malware.

  1. Boot from a rescue USB (Kaspersky Rescue Disk, Malwarebytes bootable)
  2. Run Windows Defender Offline Scan: Start → Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan
  3. Check for suspicious services: msconfig → Services → Hide all Microsoft services

Step 9: Advanced — Use Driver Verifier

Driver Verifier stresses drivers to catch misbehaving ones that cause intermittent BSODs:

verifier.exe

Select Create standard settingsAutomatically select all drivers installed on this computer. Reboot. The next BSOD will now name the exact faulty driver. Disable Verifier after finding the culprit:

verifier /reset

Step 10: Interpret the BSOD QR Code and Stop Code

Since Windows 10, each BSOD shows a QR code and a stop code like MEMORY_MANAGEMENT. Scan the QR code or visit: https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2

Common stop codes quick-reference:

  • 0x0000001A = MEMORY_MANAGEMENT → RAM failure
  • 0x0000003B = SYSTEM_SERVICE_EXCEPTION → driver/service crash
  • 0x0000007E = SYSTEM_THREAD_EXCEPTION_NOT_HANDLED → driver crash
  • 0x00000116 = VIDEO_TDR_FAILURE → GPU driver hung
  • 0x000000ED = UNMOUNTABLE_BOOT_VOLUME → disk/filesystem error
  • 0x0000004E = PFN_LIST_CORRUPT → RAM or driver corruption
  • 0xC0000021A = STATUS_SYSTEM_PROCESS_TERMINATED → critical process crash
  • 0x0000010D = WDF_VIOLATION → driver framework error
  • 0x00000139 = KERNEL_SECURITY_CHECK_FAILURE → memory/stack corruption

Frequently Asked Questions

powershell
# ============================================================
# Windows BSOD Comprehensive Diagnostic Script
# Run as Administrator in PowerShell
# ============================================================

# 1. Display recent BSOD events from Event Log
Write-Host "=== Recent BSOD Events ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1001,6008} -MaxEvents 10 | 
    Select-Object TimeCreated, Id, Message | Format-List

# 2. List minidump files with timestamps
Write-Host "`n=== Minidump Files ==="
Get-ChildItem 'C:\Windows\Minidump\' -ErrorAction SilentlyContinue | 
    Sort-Object LastWriteTime -Descending | 
    Select-Object Name, LastWriteTime, Length

# 3. Run System File Checker
Write-Host "`n=== Running SFC Scan ==="
sfc /scannow

# 4. Run DISM Health Restore
Write-Host "`n=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth

# 5. Check disk health via SMART (WMIC)
Write-Host "`n=== Disk SMART Status ==="
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus, Size

# 6. Schedule CHKDSK on next reboot
Write-Host "`n=== Scheduling CHKDSK ==="
cmd /c "echo Y | chkdsk C: /f /r"
# Note: Will run on next system restart

# 7. Check for pending Windows updates (may cause BSODs if incomplete)
Write-Host "`n=== Checking Windows Update Status ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# 8. List recently installed drivers (potential culprits)
Write-Host "`n=== Recently Installed Drivers (last 30 days) ==="
$cutoff = (Get-Date).AddDays(-30)
Get-WindowsDriver -Online | 
    Where-Object { $_.Date -gt $cutoff } | 
    Select-Object Driver, ProviderName, Date, Version | 
    Sort-Object Date -Descending

# 9. Check RAM info
Write-Host "`n=== RAM Information ==="
Get-CimInstance Win32_PhysicalMemory | 
    Select-Object Tag, Capacity, Speed, Manufacturer, PartNumber

# 10. Launch Windows Memory Diagnostic (interactive)
Write-Host "`n=== Launching Windows Memory Diagnostic ==="
Write-Host "Select 'Restart now and check for problems' to begin RAM testing."
Start-Process mdsched.exe

# 11. Export last 50 System errors to CSV for offline review
Write-Host "`n=== Exporting System Errors to C:\bsod_report.csv ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Level=2} -MaxEvents 50 | 
    Select-Object TimeCreated, Id, LevelDisplayName, ProviderName, Message | 
    Export-Csv -Path 'C:\bsod_report.csv' -NoTypeInformation
Write-Host "Report saved to C:\bsod_report.csv"

# 12. Check Driver Verifier status
Write-Host "`n=== Driver Verifier Status ==="
verifier /query

Write-Host "`n=== Diagnostic Complete ==="
Write-Host "Review the output above and check C:\bsod_report.csv for detailed event logs."
E

Error Medic Editorial

The Error Medic Editorial team consists of senior DevOps engineers, Windows SREs, and system administrators with 10+ years of experience diagnosing and resolving critical Windows failures in enterprise and consumer environments. Our guides are built from real incident post-mortems, Microsoft documentation, and thousands of community-validated fixes.

Sources

Related Articles in Other Windows Blue Screen

Explore More windows Guides