Error Medic

Windows Blue Screen of Death (BSOD): Complete Troubleshooting Guide for All Stop Codes

Fix Windows Blue Screen errors including MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION, VIDEO_TDR_FAILURE & more. Step-by-step repair guide with real commands.

Last updated:
Last verified:
2,038 words
Key Takeaways
  • Hardware faults (failing RAM, corrupt storage, overheating GPU) are the most common root cause of recurring BSODs, responsible for 40-60% of cases.
  • Driver conflicts — especially GPU drivers (nvlddmkm.sys), filesystem drivers (ntfs.sys), and WDF violations — trigger the majority of software-related blue screens.
  • Corrupt system files, misconfigured Windows updates, or malware can cause stop codes like 0xc00021a, UNMOUNTABLE_BOOT_VOLUME, and boot loops.
  • Quick fix summary: Boot into Safe Mode, run 'sfc /scannow' and 'DISM /RestoreHealth', check Event Viewer for the faulting module, update or roll back drivers, then run Windows Memory Diagnostic to rule out RAM failure.
Fix Approaches Compared
MethodWhen to UseTimeRisk
SFC + DISM RepairCorrupt system files, random BSODs, failed updates15-30 minLow
Driver Rollback / UpdateBSOD after driver/Windows update, nvlddmkm.sys, ntfs.sys errors10-20 minLow
Windows Memory Diagnostic / MemTest86MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, random crashes under load1-8 hoursLow
CHKDSK /rNTFS.SYS, UNMOUNTABLE_BOOT_VOLUME, disk-related stop codes30-120 minLow-Medium
Startup Repair / Recovery EnvironmentBoot loop, 0xc00021a, cannot reach desktop10-30 minLow
Clean Driver Install (DDU)Persistent GPU BSODs, VIDEO_TDR_FAILURE, nvlddmkm.sys20-40 minMedium
System Restore / ResetMultiple failed fixes, unknown cause, post-update loops30-120 minMedium-High
Hardware ReplacementMemTest86 errors, SMART failures, confirmed hardware faultVariableNone (hardware)

Understanding the Windows Blue Screen of Death (BSOD)

A Windows Blue Screen of Death (BSOD) — technically called a Stop Error or Kernel Stop — occurs when the Windows kernel encounters a condition it cannot safely recover from. The system halts, dumps memory to a file (minidump or full dump), and displays a stop code. Modern Windows 10/11 BSODs show a QR code you can scan to look up the error online.

Every BSOD has:

  • A stop code (e.g., MEMORY_MANAGEMENT, SYSTEM_SERVICE_EXCEPTION, VIDEO_TDR_FAILURE)
  • A hex error code (e.g., 0x0000001A, 0xC0000005)
  • An optional faulting module (e.g., ntfs.sys, nvlddmkm.sys, wdf01000.sys)
  • A minidump file at C:\Windows\Minidump\ containing crash data

Step 1: Capture the Stop Code

If you can reach the desktop:

  1. Open Event Viewer → Windows Logs → System. Filter by Event ID 41 (kernel power) or ID 1001 (BugCheck). The BugCheck event contains the exact stop code and parameters.
  2. Check C:\Windows\Minidump\ for .dmp files. Use WinDbg or the free WhoCrashed tool to analyze them and identify the faulting driver.

If you are stuck in a BSOD loop (cannot boot):

  1. Force-restart 3 times to trigger Automatic Repair, or boot from a Windows USB and choose Troubleshoot → Advanced Options → Startup Repair.
  2. From the Recovery Environment (RE) command prompt, run: bcdedit /set {default} bootmenupolicy legacy to enable the legacy boot menu so you can press F8 for Safe Mode.

Step 2: Boot into Safe Mode

Safe Mode loads only essential drivers. Most software-related BSODs will not occur in Safe Mode, helping you isolate the cause.

  • From Settings: Settings → System → Recovery → Advanced Startup → Restart Now → Troubleshoot → Advanced Options → Startup Settings → Restart → Press 4 (Safe Mode) or 5 (Safe Mode with Networking).
  • From boot menu (F8): Requires legacy boot policy enabled via bcdedit above.

Step 3: Repair System Files

Run the following commands in an elevated Command Prompt or PowerShell (in Safe Mode if possible):

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Restart after completion. SFC repairs corrupt protected system files. DISM fetches a clean copy from Windows Update if SFC cannot fix files itself.


Step 4: Identify and Fix the Faulting Driver

Common stop codes and their drivers:

Stop Code Common Culprit Fix
VIDEO_TDR_FAILURE nvlddmkm.sys (NVIDIA), atikmpag.sys (AMD) Reinstall GPU driver via DDU
SYSTEM_SERVICE_EXCEPTION ntfs.sys, third-party AV drivers Update or uninstall the driver
MEMORY_MANAGEMENT RAM hardware, memory-mapped driver Run MemTest86, check RAM seating
PFN_LIST_CORRUPT RAM, SSD/HDD firmware MemTest86, CHKDSK, update firmware
KERNEL_SECURITY_CHECK_FAILURE Corrupt/incompatible driver or malware SFC, driver rollback, antivirus scan
UNEXPECTED_KERNEL_MODE_TRAP Overclocking, RAM instability Reset XMP/OC, run MemTest86
UNMOUNTABLE_BOOT_VOLUME Corrupt boot partition, ntfs.sys CHKDSK, Startup Repair
WDF_VIOLATION Faulty WDF kernel-mode driver Update driver, check Windows Update
0xc00021a Critical system process crash (winlogon, csrss) SFC, DISM, System Restore
NTFS_FILE_SYSTEM (ntfs.sys) Disk corruption, dying drive CHKDSK /r, check SMART data

To remove GPU drivers cleanly (recommended for nvlddmkm.sys / VIDEO_TDR_FAILURE):

  1. Boot into Safe Mode.
  2. Download Display Driver Uninstaller (DDU) from Wagnardsoft.
  3. Run DDU → Clean and Restart.
  4. Reinstall the latest GPU driver from NVIDIA or AMD's official site.

To roll back a driver: Device Manager → Right-click device → Properties → Driver tab → Roll Back Driver.


Step 5: Check Storage Health

For UNMOUNTABLE_BOOT_VOLUME, NTFS_FILE_SYSTEM, or frequent disk-related crashes:

# From Recovery Environment or elevated CMD:
chkdsk C: /f /r /x

# Check SMART data using PowerShell:
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select DeviceId, ReadErrorsTotal, WriteErrorsTotal, Temperature

# Or use wmic:
wmic diskdrive get status

If SMART reports errors or CHKDSK finds unrecoverable bad sectors, back up data immediately and replace the drive.


Step 6: Test RAM

For MEMORY_MANAGEMENT, PFN_LIST_CORRUPT, or UNEXPECTED_KERNEL_MODE_TRAP:

Windows built-in test: Search for "Windows Memory Diagnostic" → Restart now and check for problems. Results appear in Event Viewer under Source: MemoryDiagnostics-Results.

MemTest86 (more thorough): Download from memtest86.com, create a bootable USB, run for at least 2 full passes (overnight recommended). Any errors indicate failing RAM.

Also try: removing one RAM stick at a time, reseating sticks, or testing in alternate slots. Reset XMP/DOCP profiles in BIOS if you have overclocked RAM.


Step 7: Check for Malware

Some BSODs — particularly KERNEL_SECURITY_CHECK_FAILURE and unexpected stop codes — can be caused by rootkits or malware corrupting kernel-mode code.

  1. Boot into Safe Mode with Networking.
  2. Run Microsoft Safety Scanner (msert.exe) or Malwarebytes free edition.
  3. After cleaning, run sfc /scannow again to repair any files damaged by the malware.

Step 8: System Restore or Reset

If all else fails:

  • System Restore: Control Panel → Recovery → Open System Restore → choose a restore point dated before BSODs started.
  • Reset this PC: Settings → System → Recovery → Reset this PC → Keep my files (or Remove everything for a clean slate).
  • In-place upgrade repair: Boot from Windows ISO → Run setup.exe → Upgrade → Keep files and apps. This reinstalls Windows without losing data.

Reading a Minidump with WinDbg

Install WinDbg Preview from the Microsoft Store. Open a .dmp file and run:

!analyze -v

The output will show the stop code, the faulting thread, the call stack, and the responsible module — giving you the exact driver or system component to target.

Frequently Asked Questions

powershell
# ============================================================
# Windows BSOD Diagnostic & Repair Script
# Run as Administrator in PowerShell
# ============================================================

Write-Host "=== Step 1: List recent minidump files ==="
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem $dumpPath -Filter *.dmp | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length
} else {
    Write-Host "No minidump folder found. Minidumps may be disabled."
}

Write-Host "`n=== Step 2: Check Event Log for BugCheck (BSOD) events ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 10 | ForEach-Object {
    Write-Host "Time: $($_.TimeCreated) | Message: $($_.Message.Substring(0, [Math]::Min(200, $_.Message.Length)))"
}

Write-Host "`n=== Step 3: Run System File Checker ==="
sfc /scannow

Write-Host "`n=== Step 4: Run DISM to repair Windows image ==="
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Write-Host "`n=== Step 5: Check disk health via SMART ==="
Get-PhysicalDisk | ForEach-Object {
    $disk = $_
    Write-Host "Disk: $($disk.FriendlyName) | Status: $($disk.HealthStatus) | Usage: $($disk.Usage)"
    try {
        $rel = $disk | Get-StorageReliabilityCounter
        Write-Host "  ReadErrors: $($rel.ReadErrorsTotal) | WriteErrors: $($rel.WriteErrorsTotal) | Temp: $($rel.Temperature)C"
    } catch {
        Write-Host "  Could not retrieve reliability counter."
    }
}

Write-Host "`n=== Step 6: Schedule CHKDSK on next reboot (for C: drive) ==="
# Uncomment below to schedule:
# chkdsk C: /f /r /x
# Write-Host "CHKDSK scheduled. Restart to run."

Write-Host "`n=== Step 7: Check for Windows Memory Diagnostic results in Event Log ==="
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-MemoryDiagnostics-Results'} -MaxEvents 5 -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "Time: $($_.TimeCreated) | Result: $($_.Message)"
}

Write-Host "`n=== Step 8: List all non-Microsoft kernel drivers (potential BSOD culprits) ==="
Get-WmiObject Win32_SystemDriver | Where-Object { $_.State -eq 'Running' } | ForEach-Object {
    $file = $_.PathName -replace '\\\\?\\', ''
    try {
        $sig = Get-AuthenticodeSignature $file -ErrorAction SilentlyContinue
        if ($sig.SignerCertificate.Subject -notmatch 'Microsoft') {
            Write-Host "Third-party driver: $($_.Name) | File: $($_.PathName)"
        }
    } catch {}
}

Write-Host "`n=== Step 9: Check for pending Windows Updates ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, InstalledOn, Description

Write-Host "`n=== BSOD Diagnostic Complete. Review output above. ==="
Write-Host "Next steps:"
Write-Host "  - If SFC/DISM found errors: Restart and test"
Write-Host "  - If third-party drivers listed: Update or remove them"
Write-Host "  - If disk errors: Replace drive after backup"
Write-Host "  - For RAM issues: Run MemTest86 (memtest86.com)"
Write-Host "  - For GPU BSODs: Use DDU to clean-reinstall GPU driver"
E

Error Medic Editorial

The Error Medic Editorial team consists of senior DevOps engineers, SREs, and Windows systems administrators with 10+ years of experience diagnosing kernel crashes, driver conflicts, and system failures across enterprise and consumer environments. Our guides are built from real-world incident postmortems and validated against live test environments.

Sources

Related Articles in Other Windows Blue Screen

Explore More windows Guides