What causes ntoskrnl.exe or ntkrnlmp.exe to be listed in a Windows 11 BSOD?

ntoskrnl.exe (single-processor) and ntkrnlmp.exe (multi-processor) are the Windows NT kernel images. When they appear as the faulting module in a BSOD, it almost always means a third-party kernel-mode driver is corrupting memory that the kernel relies on, and the crash is being attributed to the kernel. Common culprits include GPU drivers (NVIDIA/AMD), antivirus software, network drivers, or overclocking utilities. Use WinDbg to open the minidump from C:\Windows\Minidump\ and run '!analyze -v' to identify the true faulting driver.

How do I fix a ksecdd.sys BSOD on Windows 11?

ksecdd.sys is the Kernel Security Support Provider Interface driver. BSODs caused by it are typically linked to: (1) Incompatible or corrupt third-party antivirus or endpoint security software — try uninstalling it and testing. (2) VPN drivers interfering with Secure Boot or kernel security. (3) A corrupt Windows security component — run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' in an elevated prompt. (4) A recent Windows Update that introduced a regression — check if uninstalling the latest cumulative update resolves the issue. Also ensure Secure Boot is enabled correctly in UEFI/BIOS.

Why am I getting a MEMORY_MANAGEMENT BSOD (0x0000001A) on Windows 11?

Stop code MEMORY_MANAGEMENT (0x0000001A) indicates a severe memory management error. Primary causes include: (1) Faulty or failing RAM — run MemTest86 for 8+ hours to confirm. (2) Overclocking instability with XMP/EXPO enabled in BIOS — disable XMP and test at stock speeds. (3) A driver leaking or improperly accessing kernel memory. (4) Corrupt virtual memory / page file — reset the page file to system managed. (5) A failing SSD or HDD causing bad reads into memory. Address hardware first before assuming software.

My Windows 11 BSOD appeared after an update. How do I fix it?

Go to Settings > Windows Update > Update History > Uninstall Updates. Sort by install date and remove the most recent cumulative update. Alternatively, run 'wusa /uninstall /kb:XXXXXXX' in an elevated command prompt with the specific KB number. If you cannot boot, enter the Windows Recovery Environment (hold Shift + Restart), go to Troubleshoot > Advanced Options > Uninstall Updates. After removing the update, use 'sfc /scannow' to repair any residual file corruption. You can also pause Windows Updates temporarily from Settings > Windows Update > Pause Updates to prevent reinstallation.

How do I analyze a Windows 11 BSOD minidump file to find the real cause?

Install WinDbg Preview from the Microsoft Store. Open it, go to File > Start Debugging > Open Dump File, and navigate to C:\Windows\Minidump\. Once loaded, type '!analyze -v' in the command window and press Enter. The output will show the exact faulting module, the stack trace, and a probable cause. Look for lines starting with 'DRIVER_OBJECT' or 'IMAGE_NAME:' — these identify the specific driver or module responsible, which is often different from what the blue screen displays. Save this information before seeking further support.

BSOD Windows 11 Fix: Memory Management, ntoskrnl.exe, ksecdd.sys & More

Fix BSOD on Windows 11 caused by ntoskrnl.exe, ksecdd.sys, ntkrnlmp.exe, or memory management errors. Step-by-step commands and solutions inside.

Last updated: March 1, 2026

Last verified: March 1, 2026

1,992 words

Key Takeaways

Most Windows 11 BSODs (Blue Screen of Death) are triggered by faulty RAM, outdated or corrupt drivers, system file corruption, or incompatible kernel modules like ntoskrnl.exe, ntkrnlmp.exe, or ksecdd.sys.
Memory management BSODs specifically point to RAM hardware failure, overclocking instability, or a driver that is improperly accessing kernel memory — run Windows Memory Diagnostic and MemTest86 to confirm.
Quick fix summary: Run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' in an elevated command prompt, update all drivers (especially GPU and chipset), check Event Viewer for the faulting module, and if ntoskrnl.exe or ksecdd.sys is listed, update Windows or roll back recent patches.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC + DISM Scan	System files are corrupt, random BSODs after update	10-30 min	Low
Driver Update / Rollback	BSOD started after hardware or driver change, ksecdd.sys or ntoskrnl.exe listed	15-45 min	Low-Medium
Windows Memory Diagnostic / MemTest86	MEMORY_MANAGEMENT stop code, random crashes under load	30 min – 8 hrs	None
Windows Update / Patch Rollback	BSOD appeared after a cumulative update	20-60 min	Low
Startup Repair / System Restore	Cannot boot into Windows at all	20-60 min	Medium
Clean Boot (msconfig)	Suspect third-party software conflict	10-20 min	Low
RAM Replacement	MemTest86 reports errors, MEMORY_MANAGEMENT persists	30-60 min	Low (hardware)
Windows 11 Reset / Reinstall	All other methods failed, BSOD on every boot	1-3 hrs	High (data loss risk)

Understanding Windows 11 BSOD Errors

A Blue Screen of Death (BSOD) in Windows 11 is a critical system failure that forces the OS to halt to prevent further damage. You will typically see a blue screen with a sad emoji, a stop code such as:

MEMORY_MANAGEMENT (0x0000001A)
SYSTEM_SERVICE_EXCEPTION (0x0000003B)
KERNEL_SECURITY_CHECK_FAILURE (0x00000139)
PAGE_FAULT_IN_NONPAGED_AREA (0x00000050)
IRQL_NOT_LESS_OR_EQUAL (0x0000000A)

The faulting file listed beneath the stop code (e.g., ntoskrnl.exe, ntkrnlmp.exe, ksecdd.sys) tells you which kernel component triggered the crash. Here is what each means:

ntoskrnl.exe / ntkrnlmp.exe: The Windows NT OS Kernel. When this is listed, the crash is usually caused by a third-party driver corrupting kernel memory, or a Windows Update issue — not the kernel itself being bad.
ksecdd.sys: The Kernel Security Support Provider Interface driver. BSODs attributed to ksecdd.sys are frequently linked to Secure Boot conflicts, antivirus kernel-mode drivers, VPN software, or a corrupted Windows security component.
MEMORY_MANAGEMENT: Signals physical RAM errors, a driver incorrectly freeing memory, overclocking instability, or a corrupt page file.

Step 1: Read the Crash Dump in Event Viewer

Before applying any fix, identify the exact faulting module.

Press Win + X and select Event Viewer.
Navigate to Windows Logs > System.
Filter by Critical level events and look for entries with source BugCheck or Kernel-Power (Event ID 41).
Note the stop code and the module name listed.

Alternatively, use WinDbg or the built-in Get-WinEvent PowerShell command to read the minidump:

Get-WinEvent -LogName System | Where-Object {$_.Id -eq 1001} | Select-Object -First 10 | Format-List

Minidump files are stored at C:\Windows\Minidump\. You can analyze them with WinDbg Preview from the Microsoft Store.

Step 2: Run System File Checker and DISM

Corrupt system files are a leading cause of BSODs after Windows Updates. Run these commands in an elevated Command Prompt (Run as Administrator):

sfc /scannow

Wait for the scan to complete. If it reports violations it could not fix:

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Reboot after completion and monitor for BSODs.

Step 3: Update or Roll Back Drivers

Outdated GPU, NIC, or chipset drivers are a very common cause of ntoskrnl.exe and ksecdd.sys BSODs.

Update drivers:

Press Win + X > Device Manager.
Right-click your GPU (Display Adapters), NIC (Network Adapters), and chipset entries.
Select Update driver > Search automatically.

For NVIDIA: Download the latest Game Ready or Studio driver from nvidia.com and use DDU (Display Driver Uninstaller) in Safe Mode for a clean install.

Roll back a driver:

In Device Manager, right-click the device > Properties.
Go to the Driver tab and click Roll Back Driver if available.

For ksecdd.sys specifically: Disable or uninstall third-party antivirus and VPN software temporarily. If BSODs stop, that software's kernel-mode driver is the culprit. Check for updates or contact the vendor.

Step 4: Run Memory Diagnostics

For MEMORY_MANAGEMENT BSODs:

Windows Memory Diagnostic (quick):

Press Win + R, type mdsched.exe, press Enter.
Choose Restart now and check for problems.
After reboot, results appear in Event Viewer under Windows Logs > System (source: MemoryDiagnostics-Results).

MemTest86 (thorough):

Download MemTest86 from memtest86.com.
Flash to a USB drive and boot from it.
Run at least 2 full passes (8+ hours recommended).
If any errors are found, your RAM module(s) are failing and need replacement.

Also check for overclocking: If XMP/EXPO is enabled in BIOS, try disabling it and running at stock RAM speeds to rule out instability.

Step 5: Check the Page File and Virtual Memory

A corrupt or undersized page file can cause MEMORY_MANAGEMENT BSODs:

Press Win + X > System > Advanced system settings.
Under Performance, click Settings > Advanced > Virtual Memory > Change.
Uncheck Automatically manage paging file size for all drives.
Select the C: drive, choose System managed size, click Set, then OK.
Reboot.

Step 6: Uninstall Recent Windows Updates

If BSODs began after a cumulative update:

Go to Settings > Windows Update > Update history > Uninstall updates.
Sort by Installed On and remove the most recent cumulative or optional update.
Reboot and test.

You can also use the command line:

wusa /uninstall /kb:XXXXXXX

Replace XXXXXXX with the KB number shown in Update History.

Step 7: Startup Repair and System Restore (Boot Failures)

If Windows 11 cannot boot:

Boot from a Windows 11 USB installer.
Select Repair your computer > Troubleshoot > Advanced options.
Try Startup Repair first.
If that fails, use System Restore to roll back to a point before the BSODs started.
As a last resort, use Reset this PC (keep files or remove everything).

Step 8: Check Hardware — Temperatures and Storage

Use HWInfo64 or HWMonitor to check CPU and GPU temperatures. Sustained temps above 95°C (CPU) or 90°C (GPU) can cause crashes.
Run CrystalDiskInfo to check SSD/HDD SMART data. A failing drive with reallocated sectors will cause BSODs.
Reseat RAM sticks and try booting with one stick at a time to isolate a faulty module.
Check all power connectors are fully seated, especially GPU power cables.

Frequently Asked Questions

powershell

# ============================================================
# Windows 11 BSOD Diagnostic & Fix Script
# Run in an elevated PowerShell (Run as Administrator)
# ============================================================

# 1. Check for recent BugCheck events in System log
Write-Host "=== Recent BugCheck Events ==="
Get-WinEvent -LogName System -ErrorAction SilentlyContinue |
    Where-Object { $_.Id -eq 1001 -or $_.Id -eq 41 } |
    Select-Object -First 10 |
    Format-List TimeCreated, Id, Message

# 2. List minidump files with timestamps
Write-Host "
=== Minidump Files ==="
Get-ChildItem -Path "C:\Windows\Minidump\" -Filter "*.dmp" -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending |
    Select-Object Name, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}}

# 3. Run System File Checker
Write-Host "
=== Running SFC Scan ==="
Start-Process -FilePath "sfc" -ArgumentList "/scannow" -Wait -NoNewWindow

# 4. Run DISM to repair Windows image
Write-Host "
=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth

# 5. Check disk health via SMART
Write-Host "
=== Disk Health (SMART) ==="
Get-PhysicalDisk | Select-Object FriendlyName, OperationalStatus, HealthStatus, Size |
    Format-Table -AutoSize

# 6. Check RAM info
Write-Host "
=== Installed RAM Modules ==="
Get-CimInstance -ClassName Win32_PhysicalMemory |
    Select-Object Manufacturer, PartNumber, Capacity, Speed, ConfiguredClockSpeed |
    Format-Table -AutoSize

# 7. Check for recent driver installations (last 30 days)
Write-Host "
=== Recently Installed Drivers (Last 30 Days) ==="
$cutoff = (Get-Date).AddDays(-30)
Get-WindowsDriver -Online -ErrorAction SilentlyContinue |
    Where-Object { $_.Date -ge $cutoff } |
    Select-Object Driver, OriginalFileName, Date, ProviderName |
    Sort-Object Date -Descending |
    Format-Table -AutoSize

# 8. List recently installed updates
Write-Host "
=== Recent Windows Updates ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 |
    Format-Table HotFixID, Description, InstalledOn -AutoSize

# 9. Export full driver list to desktop for review
$exportPath = "$env:USERPROFILE\Desktop\Drivers_Export.txt"
Get-WindowsDriver -Online | Sort-Object OriginalFileName | Out-File -FilePath $exportPath
Write-Host "
Driver list exported to: $exportPath"

# 10. Schedule Memory Diagnostic on next reboot
Write-Host "
=== Scheduling Windows Memory Diagnostic ==="
Start-Process -FilePath "mdsched.exe"

Write-Host "
=== Diagnostic Complete ==="
Write-Host "Review Event Viewer > Windows Logs > System for BugCheck entries."
Write-Host "Open minidumps with WinDbg Preview and run: !analyze -v"
Write-Host "Check MemoryDiagnostics-Results in Event Viewer after reboot."

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems administrators with 10+ years of experience diagnosing critical system failures across enterprise and consumer environments. We specialize in translating kernel-level error analysis into actionable, step-by-step remediation guides for developers and IT professionals.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.