Windows Blue Screen of Death (BSOD): Complete Troubleshooting Guide for All Stop Codes
Fix Windows Blue Screen errors including MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION, VIDEO_TDR_FAILURE & more. Step-by-step repair guide with real commands.
- Hardware faults (failing RAM, corrupt storage, overheating GPU) are the most common root cause of recurring BSODs, responsible for 40-60% of cases.
- Driver conflicts — especially GPU drivers (nvlddmkm.sys), filesystem drivers (ntfs.sys), and WDF violations — trigger the majority of software-related blue screens.
- Corrupt system files, misconfigured Windows updates, or malware can cause stop codes like 0xc00021a, UNMOUNTABLE_BOOT_VOLUME, and boot loops.
- Quick fix summary: Boot into Safe Mode, run 'sfc /scannow' and 'DISM /RestoreHealth', check Event Viewer for the faulting module, update or roll back drivers, then run Windows Memory Diagnostic to rule out RAM failure.
| Method | When to Use | Time | Risk |
|---|---|---|---|
| SFC + DISM Repair | Corrupt system files, random BSODs, failed updates | 15-30 min | Low |
| Driver Rollback / Update | BSOD after driver/Windows update, nvlddmkm.sys, ntfs.sys errors | 10-20 min | Low |
| Windows Memory Diagnostic / MemTest86 | MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, random crashes under load | 1-8 hours | Low |
| CHKDSK /r | NTFS.SYS, UNMOUNTABLE_BOOT_VOLUME, disk-related stop codes | 30-120 min | Low-Medium |
| Startup Repair / Recovery Environment | Boot loop, 0xc00021a, cannot reach desktop | 10-30 min | Low |
| Clean Driver Install (DDU) | Persistent GPU BSODs, VIDEO_TDR_FAILURE, nvlddmkm.sys | 20-40 min | Medium |
| System Restore / Reset | Multiple failed fixes, unknown cause, post-update loops | 30-120 min | Medium-High |
| Hardware Replacement | MemTest86 errors, SMART failures, confirmed hardware fault | Variable | None (hardware) |
Understanding the Windows Blue Screen of Death (BSOD)
A Windows Blue Screen of Death (BSOD) — technically called a Stop Error or Kernel Stop — occurs when the Windows kernel encounters a condition it cannot safely recover from. The system halts, dumps memory to a file (minidump or full dump), and displays a stop code. Modern Windows 10/11 BSODs show a QR code you can scan to look up the error online.
Every BSOD has:
- A stop code (e.g.,
MEMORY_MANAGEMENT,SYSTEM_SERVICE_EXCEPTION,VIDEO_TDR_FAILURE) - A hex error code (e.g.,
0x0000001A,0xC0000005) - An optional faulting module (e.g.,
ntfs.sys,nvlddmkm.sys,wdf01000.sys) - A minidump file at
C:\Windows\Minidump\containing crash data
Step 1: Capture the Stop Code
If you can reach the desktop:
- Open Event Viewer → Windows Logs → System. Filter by Event ID 41 (kernel power) or ID 1001 (BugCheck). The BugCheck event contains the exact stop code and parameters.
- Check
C:\Windows\Minidump\for.dmpfiles. Use WinDbg or the free WhoCrashed tool to analyze them and identify the faulting driver.
If you are stuck in a BSOD loop (cannot boot):
- Force-restart 3 times to trigger Automatic Repair, or boot from a Windows USB and choose Troubleshoot → Advanced Options → Startup Repair.
- From the Recovery Environment (RE) command prompt, run:
bcdedit /set {default} bootmenupolicy legacyto enable the legacy boot menu so you can press F8 for Safe Mode.
Step 2: Boot into Safe Mode
Safe Mode loads only essential drivers. Most software-related BSODs will not occur in Safe Mode, helping you isolate the cause.
- From Settings: Settings → System → Recovery → Advanced Startup → Restart Now → Troubleshoot → Advanced Options → Startup Settings → Restart → Press 4 (Safe Mode) or 5 (Safe Mode with Networking).
- From boot menu (F8): Requires legacy boot policy enabled via
bcdeditabove.
Step 3: Repair System Files
Run the following commands in an elevated Command Prompt or PowerShell (in Safe Mode if possible):
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth
Restart after completion. SFC repairs corrupt protected system files. DISM fetches a clean copy from Windows Update if SFC cannot fix files itself.
Step 4: Identify and Fix the Faulting Driver
Common stop codes and their drivers:
| Stop Code | Common Culprit | Fix |
|---|---|---|
VIDEO_TDR_FAILURE |
nvlddmkm.sys (NVIDIA), atikmpag.sys (AMD) |
Reinstall GPU driver via DDU |
SYSTEM_SERVICE_EXCEPTION |
ntfs.sys, third-party AV drivers |
Update or uninstall the driver |
MEMORY_MANAGEMENT |
RAM hardware, memory-mapped driver | Run MemTest86, check RAM seating |
PFN_LIST_CORRUPT |
RAM, SSD/HDD firmware | MemTest86, CHKDSK, update firmware |
KERNEL_SECURITY_CHECK_FAILURE |
Corrupt/incompatible driver or malware | SFC, driver rollback, antivirus scan |
UNEXPECTED_KERNEL_MODE_TRAP |
Overclocking, RAM instability | Reset XMP/OC, run MemTest86 |
UNMOUNTABLE_BOOT_VOLUME |
Corrupt boot partition, ntfs.sys | CHKDSK, Startup Repair |
WDF_VIOLATION |
Faulty WDF kernel-mode driver | Update driver, check Windows Update |
0xc00021a |
Critical system process crash (winlogon, csrss) | SFC, DISM, System Restore |
NTFS_FILE_SYSTEM (ntfs.sys) |
Disk corruption, dying drive | CHKDSK /r, check SMART data |
To remove GPU drivers cleanly (recommended for nvlddmkm.sys / VIDEO_TDR_FAILURE):
- Boot into Safe Mode.
- Download Display Driver Uninstaller (DDU) from Wagnardsoft.
- Run DDU → Clean and Restart.
- Reinstall the latest GPU driver from NVIDIA or AMD's official site.
To roll back a driver: Device Manager → Right-click device → Properties → Driver tab → Roll Back Driver.
Step 5: Check Storage Health
For UNMOUNTABLE_BOOT_VOLUME, NTFS_FILE_SYSTEM, or frequent disk-related crashes:
# From Recovery Environment or elevated CMD:
chkdsk C: /f /r /x
# Check SMART data using PowerShell:
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select DeviceId, ReadErrorsTotal, WriteErrorsTotal, Temperature
# Or use wmic:
wmic diskdrive get status
If SMART reports errors or CHKDSK finds unrecoverable bad sectors, back up data immediately and replace the drive.
Step 6: Test RAM
For MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, or UNEXPECTED_KERNEL_MODE_TRAP:
Windows built-in test: Search for "Windows Memory Diagnostic" → Restart now and check for problems. Results appear in Event Viewer under Source: MemoryDiagnostics-Results.
MemTest86 (more thorough): Download from memtest86.com, create a bootable USB, run for at least 2 full passes (overnight recommended). Any errors indicate failing RAM.
Also try: removing one RAM stick at a time, reseating sticks, or testing in alternate slots. Reset XMP/DOCP profiles in BIOS if you have overclocked RAM.
Step 7: Check for Malware
Some BSODs — particularly KERNEL_SECURITY_CHECK_FAILURE and unexpected stop codes — can be caused by rootkits or malware corrupting kernel-mode code.
- Boot into Safe Mode with Networking.
- Run Microsoft Safety Scanner (
msert.exe) or Malwarebytes free edition. - After cleaning, run
sfc /scannowagain to repair any files damaged by the malware.
Step 8: System Restore or Reset
If all else fails:
- System Restore: Control Panel → Recovery → Open System Restore → choose a restore point dated before BSODs started.
- Reset this PC: Settings → System → Recovery → Reset this PC → Keep my files (or Remove everything for a clean slate).
- In-place upgrade repair: Boot from Windows ISO → Run setup.exe → Upgrade → Keep files and apps. This reinstalls Windows without losing data.
Reading a Minidump with WinDbg
Install WinDbg Preview from the Microsoft Store. Open a .dmp file and run:
!analyze -v
The output will show the stop code, the faulting thread, the call stack, and the responsible module — giving you the exact driver or system component to target.
Frequently Asked Questions
# ============================================================
# Windows BSOD Diagnostic & Repair Script
# Run as Administrator in PowerShell
# ============================================================
Write-Host "=== Step 1: List recent minidump files ==="
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
Get-ChildItem $dumpPath -Filter *.dmp | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length
} else {
Write-Host "No minidump folder found. Minidumps may be disabled."
}
Write-Host "`n=== Step 2: Check Event Log for BugCheck (BSOD) events ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 10 | ForEach-Object {
Write-Host "Time: $($_.TimeCreated) | Message: $($_.Message.Substring(0, [Math]::Min(200, $_.Message.Length)))"
}
Write-Host "`n=== Step 3: Run System File Checker ==="
sfc /scannow
Write-Host "`n=== Step 4: Run DISM to repair Windows image ==="
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
Write-Host "`n=== Step 5: Check disk health via SMART ==="
Get-PhysicalDisk | ForEach-Object {
$disk = $_
Write-Host "Disk: $($disk.FriendlyName) | Status: $($disk.HealthStatus) | Usage: $($disk.Usage)"
try {
$rel = $disk | Get-StorageReliabilityCounter
Write-Host " ReadErrors: $($rel.ReadErrorsTotal) | WriteErrors: $($rel.WriteErrorsTotal) | Temp: $($rel.Temperature)C"
} catch {
Write-Host " Could not retrieve reliability counter."
}
}
Write-Host "`n=== Step 6: Schedule CHKDSK on next reboot (for C: drive) ==="
# Uncomment below to schedule:
# chkdsk C: /f /r /x
# Write-Host "CHKDSK scheduled. Restart to run."
Write-Host "`n=== Step 7: Check for Windows Memory Diagnostic results in Event Log ==="
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-MemoryDiagnostics-Results'} -MaxEvents 5 -ErrorAction SilentlyContinue | ForEach-Object {
Write-Host "Time: $($_.TimeCreated) | Result: $($_.Message)"
}
Write-Host "`n=== Step 8: List all non-Microsoft kernel drivers (potential BSOD culprits) ==="
Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq 'Running' } | ForEach-Object {
$file = $_.PathName -replace '\\\\?\\', ''
try {
$sig = Get-AuthenticodeSignature $file -ErrorAction SilentlyContinue
if ($sig.SignerCertificate.Subject -notmatch 'Microsoft') {
Write-Host "Third-party driver: $($_.Name) | File: $($_.PathName)"
}
} catch {}
}
Write-Host "`n=== Step 9: Check for pending Windows Updates ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, InstalledOn, Description
Write-Host "`n=== BSOD Diagnostic Complete. Review output above. ==="
Write-Host "Next steps:"
Write-Host " - If SFC/DISM found errors: Restart and test"
Write-Host " - If third-party drivers listed: Update or remove them"
Write-Host " - If disk errors: Replace drive after backup"
Write-Host " - For RAM issues: Run MemTest86 (memtest86.com)"
Write-Host " - For GPU BSODs: Use DDU to clean-reinstall GPU driver"Error Medic Editorial
The Error Medic Editorial team consists of senior DevOps engineers, SREs, and Windows systems administrators with 10+ years of experience diagnosing kernel crashes, driver conflicts, and system failures across enterprise and consumer environments. Our guides are built from real-world incident postmortems and validated against live test environments.
Sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg
- https://learn.microsoft.com/en-us/windows/client-management/troubleshoot-stop-errors
- https://support.microsoft.com/en-us/windows/fix-blue-screen-errors-in-windows-4b5f1d0b-35c3-4372-b4b4-5c4d629c7d35
- https://answers.microsoft.com/en-us/windows/forum/all/blue-screen-memory-management/
- https://www.reddit.com/r/techsupport/wiki/index#wiki_bsod_-_blue_screen_of_death