What causes the MEMORY_MANAGEMENT BSOD in Windows 11?

The MEMORY_MANAGEMENT stop code (0x0000001A) is most commonly caused by faulty or incompatible RAM modules, incorrect XMP/EXPO memory profiles in BIOS, corrupt Windows system files, or failing storage drives. Start by running Windows Memory Diagnostic (mdsched.exe) and MemTest86. If RAM passes, run SFC /scannow and DISM /Online /Cleanup-Image /RestoreHealth to repair system files. Also check BIOS memory settings and try running RAM at JEDEC default speeds instead of XMP.

Why does ntoskrnl.exe or ntkrnlmp.exe appear in my Windows 11 BSOD?

ntoskrnl.exe and ntkrnlmp.exe are the Windows NT kernel executables. When they appear in a crash dump, it usually means a kernel-mode driver has caused an exception that the kernel couldn't handle — ntoskrnl.exe itself is rarely the root cause. Use WinDbg to open the minidump from C:\Windows\Minidump\ and run '!analyze -v' to identify the actual faulting driver. Common culprits include GPU drivers, network adapter drivers, and third-party antivirus software. Update or rollback drivers and run SFC to resolve these crashes.

How do I fix a ksecdd.sys BSOD on Windows 11?

ksecdd.sys handles kernel-mode security operations. BSODs referencing this file are often triggered by third-party security software (antivirus, VPNs, endpoint protection), corrupt Windows Update packages, or enterprise DLP/firewall agents. Boot into Safe Mode and uninstall recently added security software. Run SFC and DISM to repair the Windows image. Install any pending Windows updates, particularly cumulative and security patches. If the problem started after a specific update, use System Restore or manually uninstall the update via Settings → Windows Update → Update history → Uninstall updates.

My Windows 11 PC keeps crashing with a BSOD after every Windows Update. What should I do?

If BSODs consistently appear after a Windows Update, the update likely installed a problematic driver or patched a system file incompatibly with your hardware. First, try rolling back the most recent driver updates via Device Manager. If that fails, uninstall the problematic Windows Update: go to Settings → Windows Update → Update history → Uninstall updates, and remove the most recent cumulative update. You can also use 'wusa /uninstall /kb:XXXXXXX' in Command Prompt (replacing XXXXXXX with the KB number). After removal, pause updates temporarily while Microsoft issues a fix.

How do I analyze a Windows 11 minidump file to find the real BSOD cause?

Download and install WinDbg from the Microsoft Store or Windows SDK. Open WinDbg, go to File → Open Crash Dump, and navigate to C:\Windows\Minidump\ to open the most recent .dmp file. In the command window, type '!analyze -v' and press Enter. The analysis will identify the faulting module, the stop code, and a probable cause. Key fields to look for are 'Probably caused by' (shows the driver or module), 'FAILURE_BUCKET_ID', and the stack trace. This information tells you exactly which driver or component to update, rollback, or remove.

BSOD Windows 11 Fix: Memory Management, ntoskrnl.exe, ntkrnlmp.exe & ksecdd.sys Crashes

Fix BSOD errors on Windows 11 including memory_management, ntoskrnl.exe, ntkrnlmp.exe & ksecdd.sys crashes. Step-by-step troubleshooting guide with real command

Last updated: March 1, 2026

Last verified: March 1, 2026

2,094 words

Key Takeaways

Most Windows 11 BSODs (Blue Screen of Death) are caused by faulty RAM, outdated or corrupt drivers, damaged system files, or overheating hardware components.
Common stop codes include MEMORY_MANAGEMENT (0x0000001A), PAGE_FAULT_IN_NONPAGED_AREA, SYSTEM_SERVICE_EXCEPTION, and KERNEL_SECURITY_CHECK_FAILURE — each pointing to specific subsystems like ntoskrnl.exe, ntkrnlmp.exe, or ksecdd.sys.
Quick fix summary: Run SFC /scannow and DISM to repair system files, update or rollback drivers, run Windows Memory Diagnostic or MemTest86 for RAM issues, and check Event Viewer for the faulting module before attempting more invasive repairs.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC /scannow + DISM	Corrupt or missing system files suspected	15–30 min	Low
Driver Rollback / Update	BSOD started after Windows Update or driver install	10–20 min	Low
Windows Memory Diagnostic	Frequent random BSODs, MEMORY_MANAGEMENT stop code	30–60 min	None
MemTest86 (bootable)	Deep RAM fault diagnosis, multiple BSOD types	2–8 hours	None
Clean Boot / Safe Mode	Isolating third-party software or driver conflicts	20–40 min	Low
Startup Repair / System Restore	System won't boot, crash loop after update	20–60 min	Medium
Reset / Reinstall Windows 11	All other methods failed, persistent BSODs	1–3 hours	High (data risk)

Understanding Windows 11 BSOD Errors

A Blue Screen of Death (BSOD) in Windows 11 is a critical system halt triggered when the OS kernel encounters an unrecoverable error. Unlike Windows 10, Windows 11 displays a dark screen with a sad-face emoji and a stop code such as:

MEMORY_MANAGEMENT (0x0000001A)
PAGE_FAULT_IN_NONPAGED_AREA (0x00000050)
SYSTEM_SERVICE_EXCEPTION (0x0000003B)
KERNEL_SECURITY_CHECK_FAILURE (0x00000139)
IRQL_NOT_LESS_OR_EQUAL (0x0000000A)

The error also references a faulting module — commonly ntoskrnl.exe, ntkrnlmp.exe, or ksecdd.sys. Understanding what each module does helps narrow down the cause:

ntoskrnl.exe / ntkrnlmp.exe: The Windows NT kernel executable (multi-processor variant for ntkrnlmp.exe). Crashes here usually indicate driver corruption, RAM issues, or kernel-level software conflicts.
ksecdd.sys: The Kernel Security Support Provider Interface driver. BSODs referencing this file often point to security software conflicts, TLS/SSL driver issues, or Windows Update corruption.

Step 1: Collect Crash Dump Information

Before attempting fixes, gather diagnostic data from the crash.

Read the minidump file: Windows stores crash dumps at C:\Windows\Minidump\. Use WinDbg or the built-in Event Viewer to analyze them.

Open Event Viewer → Windows Logs → System.
Filter by Critical events and look for Event ID 41 (Kernel-Power) or 1001 (BugCheck).
Note the BugCheck code and parameters shown in the event details.

Enable automatic memory dumps if not already configured:

Right-click This PC → Properties → Advanced system settings → Startup and Recovery → Settings.
Under Write debugging information, select Automatic memory dump or Small memory dump (256 KB).
Ensure the path is %SystemRoot%\Minidump.

Step 2: Run System File Checker and DISM

Corrupt system files are a leading cause of BSODs referencing ntoskrnl.exe or ntkrnlmp.exe.

Open Command Prompt as Administrator and run:

sfc /scannow

If SFC reports corruption it cannot fix, run DISM to repair the Windows image:

DISM /Online /Cleanup-Image /RestoreHealth

After DISM completes, re-run SFC:

sfc /scannow

Restart your PC and monitor for further BSODs.

Step 3: Update or Rollback Drivers

Driver conflicts are the #1 cause of Windows 11 BSODs, especially after major updates.

To update drivers:

Press Win + X → Device Manager.
Expand Display adapters, Network adapters, and Storage controllers.
Right-click each → Update driver → Search automatically.
Alternatively, visit your hardware manufacturer's website for the latest drivers (NVIDIA, AMD, Intel).

To rollback a driver:

In Device Manager, right-click the suspected device → Properties → Driver tab.
Click Roll Back Driver if the option is available.
This is particularly useful when BSODs began immediately after a Windows Update.

To identify the faulting driver using PowerShell:

Get-WinEvent -LogName System | Where-Object {$_.Id -eq 1001} | Select-Object -First 5 | Format-List

Step 4: Diagnose RAM (Memory Management BSOD)

The MEMORY_MANAGEMENT stop code (0x0000001A) almost always indicates faulty RAM or incorrect memory configuration.

Windows Memory Diagnostic (quick):

Press Win + R → type mdsched.exe → Enter.
Choose Restart now and check for problems.
Results appear in Event Viewer → Windows Logs → System → Event ID 1201 after reboot.

MemTest86 (thorough):

Download MemTest86 from https://www.memtest86.com/
Create a bootable USB and run at least 2 full passes.
Any errors confirm faulty RAM that must be replaced or reseated.

Reseat RAM:

Power off completely, remove RAM sticks, clean the slots with compressed air, and firmly re-insert.
If you have multiple sticks, test with one at a time to isolate a faulty module.

Step 5: Address ksecdd.sys BSODs

The ksecdd.sys driver handles security communications in the Windows kernel. BSODs here are commonly caused by:

Third-party antivirus or VPN software interfering with the security stack.
Corrupt Windows Update modifying kernel security drivers.
TLS/SSL driver conflicts from enterprise security tools.

Fix steps:

Boot into Safe Mode (hold Shift + Restart → Troubleshoot → Advanced Options → Startup Settings → Enable Safe Mode with Networking).
Uninstall any recently installed antivirus, VPN, or firewall software.
Run SFC and DISM as described in Step 2.
Check Windows Update for any pending security patches: Settings → Windows Update → Check for updates.
If the issue persists, use System Restore to revert to a point before the ksecdd.sys crashes began.

Step 6: Check Storage Health

A failing SSD or HDD can cause BSODs, especially during write-intensive operations.

Check disk health with CHKDSK:

chkdsk C: /f /r /x

Schedule on next reboot if the drive is in use, then restart.

Check NVMe/SSD health with PowerShell:

Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId, ReadErrorsTotal, WriteErrorsTotal, Temperature

Or use manufacturer tools such as CrystalDiskInfo, Samsung Magician, or Intel SSD Toolbox.

Step 7: Perform a Clean Boot

If BSODs occur inconsistently and the above steps haven't resolved them, a clean boot isolates third-party software conflicts.

Press Win + R → type msconfig → Enter.
Under Services tab, check Hide all Microsoft services → click Disable all.
Under Startup tab → click Open Task Manager → disable all startup items.
Restart and observe if BSODs stop.
Gradually re-enable services and startup programs to identify the culprit.

Step 8: Use Startup Repair or System Restore

If Windows 11 crashes during boot:

Boot from Windows 11 installation media (USB).
Select Repair your computer → Troubleshoot → Advanced options.
Try Startup Repair first.
If that fails, use System Restore to roll back to a known good state.
As a last resort, select Reset this PC — choose Keep my files if possible.

Step 9: Check for Overheating

Thermal throttling and overheating cause random BSODs, particularly under load.

Use HWiNFO64 or Core Temp to monitor CPU and GPU temperatures.
CPU should stay below 90°C under full load; GPU below 85°C.
Clean dust from vents and heatsinks, reapply thermal paste on older systems, and ensure adequate case airflow.

Frequently Asked Questions

powershell

# ============================================================
# Windows 11 BSOD Diagnostic & Fix Script
# Run as Administrator in PowerShell
# ============================================================

# --- Step 1: Check recent BSOD events in Event Log ---
Write-Host "[*] Recent BugCheck (BSOD) events from System log:" -ForegroundColor Cyan
Get-WinEvent -LogName System -ErrorAction SilentlyContinue | 
    Where-Object { $_.Id -eq 1001 -and $_.ProviderName -eq 'Microsoft-Windows-WER-SystemErrorReporting' } | 
    Select-Object TimeCreated, Message | 
    Select-Object -First 5 | 
    Format-List

# --- Step 2: List minidump files ---
Write-Host "`n[*] Available minidump files:" -ForegroundColor Cyan
Get-ChildItem -Path "$env:SystemRoot\Minidump" -Filter "*.dmp" -ErrorAction SilentlyContinue | 
    Sort-Object LastWriteTime -Descending | 
    Select-Object Name, LastWriteTime, @{Name='SizeMB';Expression={[math]::Round($_.Length/1MB,2)}} | 
    Format-Table -AutoSize

# --- Step 3: Run System File Checker ---
Write-Host "`n[*] Running SFC (System File Checker)..." -ForegroundColor Yellow
Start-Process -FilePath "sfc" -ArgumentList "/scannow" -Wait -NoNewWindow

# --- Step 4: Run DISM to repair Windows image ---
Write-Host "`n[*] Running DISM to restore Windows image health..." -ForegroundColor Yellow
Start-Process -FilePath "DISM" -ArgumentList "/Online /Cleanup-Image /RestoreHealth" -Wait -NoNewWindow

# --- Step 5: Schedule CHKDSK on next reboot ---
Write-Host "`n[*] Scheduling CHKDSK for C: drive on next boot..." -ForegroundColor Yellow
Start-Process -FilePath "chkdsk" -ArgumentList "C: /f /r /x" -Wait -NoNewWindow

# --- Step 6: Check disk reliability counters ---
Write-Host "`n[*] Storage reliability counters:" -ForegroundColor Cyan
Get-PhysicalDisk | ForEach-Object {
    $disk = $_
    $rel = $disk | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        FriendlyName      = $disk.FriendlyName
        MediaType         = $disk.MediaType
        HealthStatus      = $disk.HealthStatus
        ReadErrorsTotal   = $rel.ReadErrorsTotal
        WriteErrorsTotal  = $rel.WriteErrorsTotal
        Temperature       = $rel.Temperature
    }
} | Format-Table -AutoSize

# --- Step 7: List recently installed drivers (last 30 days) ---
Write-Host "`n[*] Drivers installed/updated in the last 30 days:" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
Get-WmiObject Win32_PnPSignedDriver | 
    Where-Object { $_.DriverDate -ne $null -and [datetime]::ParseExact($_.DriverDate.Substring(0,8),'yyyyMMdd',$null) -gt $cutoff } | 
    Select-Object DeviceName, DriverVersion, DriverDate, Manufacturer | 
    Sort-Object DriverDate -Descending | 
    Format-Table -AutoSize

# --- Step 8: Check for recently installed Windows Updates ---
Write-Host "`n[*] Last 10 Windows Updates installed:" -ForegroundColor Cyan
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, Description, InstalledOn -AutoSize

# --- Step 9: Export system info for further analysis ---
Write-Host "`n[*] Exporting system info to C:\Temp\SystemInfo_BSOD.txt..." -ForegroundColor Yellow
New-Item -ItemType Directory -Path "C:\Temp" -Force | Out-Null
Get-ComputerInfo | Out-File -FilePath "C:\Temp\SystemInfo_BSOD.txt" -Force
Write-Host "[+] Done. Review C:\Temp\SystemInfo_BSOD.txt for full system details." -ForegroundColor Green

Write-Host "`n[*] Diagnostic complete. Reboot recommended after SFC/DISM." -ForegroundColor Green

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems administrators with 10+ years of hands-on experience diagnosing kernel panics, driver conflicts, and OS-level failures across enterprise and consumer Windows environments. Our guides are built from real incident post-mortems, official Microsoft documentation, and community-validated fixes.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.