What causes MEMORY_MANAGEMENT BSOD in Windows 11?

The MEMORY_MANAGEMENT stop code (0x0000001A) in Windows 11 is most commonly caused by faulty RAM modules, incorrect memory timings or voltages (especially with XMP/EXPO overclocking profiles), driver bugs that corrupt kernel memory, or Windows system file corruption. Run Windows Memory Diagnostic or MemTest86 to rule out hardware failure first, then use SFC /scannow and DISM to repair system files. If RAM tests fail, replace the faulty DIMM.

Why does ksecdd.sys cause a BSOD on Windows 11?

ksecdd.sys is the Kernel Security Support Provider Interface driver and is a core Windows security component. BSODs attributed to ksecdd.sys usually indicate a conflict with third-party antivirus or endpoint security software, a corrupted Windows security subsystem from a failed update, or LSA (Local Security Authority) configuration issues. Boot into Safe Mode, uninstall third-party security software, run DISM and SFC, and roll back recent cumulative updates if the BSOD started after a Windows Update.

Is ntoskrnl.exe or ntkrnlmp.exe itself broken when it shows as the faulting module?

Not necessarily. ntoskrnl.exe (and its multiprocessor variant ntkrnlmp.exe) are the Windows NT kernel executables. When they appear as the faulting module in a BSOD minidump, it usually means another driver or component corrupted kernel memory and the kernel itself detected the fault at crash time. Use WinDbg with '!analyze -v' on the minidump file to trace the actual root cause, and run Driver Verifier ('verifier /standard /all') to identify the misbehaving driver.

How do I fix a BSOD that only happens under load or gaming on Windows 11?

BSODs that occur only under load typically indicate thermal issues, RAM instability under stress, or an overclocked/unstable GPU. Check CPU and GPU temperatures with HWiNFO64 during load. Disable XMP/EXPO RAM profiles in BIOS to run at base JEDEC speeds. Run FurMark for GPU stress testing and MemTest86 for RAM. If temperatures exceed safe thresholds (CPU >95°C, GPU >95°C), clean dust from heatsinks and reapply thermal paste. Also update your GPU driver via the manufacturer's website rather than Windows Update.

Can a Windows 11 update itself cause a BSOD loop?

Yes. Problematic cumulative updates have been known to introduce kernel driver conflicts or corrupt system files, resulting in BSOD loops — sometimes involving ksecdd.sys or ntoskrnl.exe. If Windows 11 is stuck in a BSOD loop after an update, boot into WinRE (Windows Recovery Environment) by holding Shift + Restart or booting from USB media. Navigate to Troubleshoot → Advanced Options → Uninstall Updates and remove the latest quality or feature update. Alternatively, use System Restore to revert to a pre-update checkpoint.

BSOD Windows 11 Fix: Stop Errors Including memory_management, ntoskrnl.exe, ntkrnlmp.exe & ksecdd.sys

Fix BSOD Windows 11 stop errors including memory_management, ntoskrnl.exe, ntkrnlmp.exe, and ksecdd.sys with step-by-step diagnostic commands and proven solutio

Last updated: March 1, 2026

Last verified: March 1, 2026

2,071 words

Key Takeaways

Root cause 1: Faulty or incompatible RAM is responsible for a large percentage of Windows 11 BSODs, especially MEMORY_MANAGEMENT (0x0000001A) and PAGE_FAULT_IN_NONPAGED_AREA errors linked to ntoskrnl.exe or ntkrnlmp.exe.
Root cause 2: Corrupt system files, outdated or buggy drivers (including ksecdd.sys — the Kernel Security Support Provider Interface driver), and Windows Update failures trigger stop errors by corrupting kernel memory regions.
Quick fix summary: Run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' to repair system files, use Windows Memory Diagnostic or MemTest86 to test RAM, roll back or update suspect drivers via Device Manager, and check Event Viewer for the exact stop code and faulting module before attempting deeper hardware-level repairs.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC + DISM Repair	Corrupt system files, failed Windows Update, random BSODs	15-45 min	Low
Driver Rollback / Update	BSOD started after a driver or Windows Update install; ksecdd.sys or ntoskrnl.exe faulting module	10-20 min	Low
Windows Memory Diagnostic	Suspected RAM issue, MEMORY_MANAGEMENT BSOD, ntkrnlmp.exe errors	30-60 min	None
MemTest86 (Bootable)	Thorough RAM validation, multiple BSOD codes, SFC passes but BSODs persist	2-8 hrs	None
RAM Reseating / Replacement	MemTest86 reports errors, hardware fault confirmed	30-60 min	Medium (hardware)
Clean Boot / Safe Mode	Isolate third-party software or driver conflicts causing BSODs	15-30 min	Low
Windows 11 Repair Install (In-place Upgrade)	Persistent BSODs unresolved by all software fixes	60-120 min	Low-Medium
Full Reinstall of Windows 11	Last resort — hardware confirmed good, OS entirely corrupt	2-4 hrs	High (data loss if no backup)

Understanding BSOD Stop Errors in Windows 11

A Blue Screen of Death (BSOD) in Windows 11 — officially called a Stop Error — occurs when the kernel detects a fatal inconsistency it cannot recover from. Windows halts execution, dumps memory to disk, and reboots. You will typically see a message like:

Your PC ran into a problem and needs to restart.
Stop code: MEMORY_MANAGEMENT
Failing module: ntoskrnl.exe

or:

Stop code: SYSTEM_SERVICE_EXCEPTION
Failing module: ksecdd.sys

Common Stop Codes and Their Meanings

0x0000001A — MEMORY_MANAGEMENT: A severe memory-subsystem error. Usually points to faulty RAM, memory timing issues, or a driver writing outside its allocated memory region.
0x0000007E / 0x0000003B — SYSTEM_SERVICE_EXCEPTION: A system service generated an unhandled exception. Often tied to ksecdd.sys (Kernel Security Support Provider) or third-party AV drivers.
0x00000050 — PAGE_FAULT_IN_NONPAGED_AREA: A requested page of memory is not available. Frequently involves ntoskrnl.exe or ntkrnlmp.exe (the multiprocessor version of the NT kernel).
0xC0000005 — ACCESS_VIOLATION in ntkrnlmp.exe: The kernel attempted to access an invalid memory address, common with overclocked or unstable RAM.

Step 1: Capture the Stop Code and Faulting Module

Before fixing anything, identify the exact error. Windows 11 logs every crash in Event Viewer.

Press Win + X → select Event Viewer.
Navigate to Windows Logs → System.
Filter by Event ID 41 (Kernel-Power — unexpected shutdown) and Event ID 1001 (BugCheck).
Note the stop code (e.g., 0x0000001A) and the faulting module (e.g., ntoskrnl.exe, ntkrnlmp.exe, ksecdd.sys).

Alternatively, use PowerShell to extract the last 10 critical events:

Get-WinEvent -LogName System | Where-Object {$_.LevelDisplayName -eq 'Critical'} | Select-Object -First 10 | Format-List TimeCreated, Message

For memory dump analysis, install WinDbg from the Microsoft Store and open C:\Windows\Minidump\*.dmp. Run:

!analyze -v

This gives you the exact faulting module, call stack, and stop code context.

Step 2: Repair System Files with SFC and DISM

Corrupted Windows system files are a leading cause of BSODs. Run these in an elevated Command Prompt or PowerShell:

sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

After DISM completes, run sfc /scannow again. Restart and monitor for BSODs. If DISM fails with error 0x800f081f, mount the Windows 11 ISO and point DISM to the WIM file:

DISM /Online /Cleanup-Image /RestoreHealth /Source:E:\sources\install.wim /LimitAccess

Step 3: Test and Diagnose RAM

Windows Memory Diagnostic (Quick)

Press Win + R, type mdsched.exe, press Enter.
Choose Restart now and check for problems.
After reboot, the tool runs in pre-OS environment. Results appear in Event Viewer under Windows Logs → System (source: MemoryDiagnostics-Results).

MemTest86 (Thorough — Recommended)

Download MemTest86 from https://www.memtest86.com/.
Flash it to a USB drive using the included tool.
Boot from USB and run at least 2 full passes (4+ passes recommended).
Any errors = faulty RAM. Replace the affected DIMM.

Pro tip: If you have dual-channel RAM (2 sticks), remove one stick, boot, test stability, then swap. This isolates a single bad DIMM.

Step 4: Address Driver-Specific BSODs

ksecdd.sys BSOD

ksecdd.sys is the Kernel Security Support Provider Interface driver, part of Windows security subsystem. BSODs from this module are commonly caused by:

Conflicting antivirus or endpoint security software
A buggy cumulative Windows Update
Corrupted Local Security Authority (LSA) configuration

Fix steps:

Boot into Safe Mode (hold Shift while clicking Restart → Troubleshoot → Advanced Options → Startup Settings → F4).
Uninstall third-party antivirus software via Settings → Apps.
Run SFC and DISM as described in Step 2.
Roll back recent Windows Updates: Settings → Windows Update → Update History → Uninstall Updates.

ntoskrnl.exe / ntkrnlmp.exe BSOD

ntkrnlmp.exe is the multiprocessor version of the NT kernel. It appears as the faulting module when a driver or application corrupts kernel memory. This is often a symptom rather than the root cause.

Use Driver Verifier to identify misbehaving drivers:
```
verifier /standard /all
```
Restart. When the verified driver causes a BSOD, the stop code will now name the actual culprit driver. Analyze the new minidump.
To disable Driver Verifier after testing:
```
verifier /reset
```
Update or roll back the identified driver via Device Manager → right-click device → Properties → Driver tab → Roll Back Driver or Update Driver.

Step 5: Check Storage Health

A failing SSD or HDD can cause random BSODs. Check drive health:

chkdsk C: /f /r /x

This runs on next reboot. Also check SMART data:

Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object -Property *

Or use CrystalDiskInfo (free tool) for a detailed SMART readout.

Step 6: Perform a Windows 11 Repair Install

If all software fixes fail but hardware tests pass, perform an in-place upgrade repair install:

Download the Windows 11 Installation Media tool from https://www.microsoft.com/software-download/windows11.
Run setup.exe from the mounted ISO.
Choose Keep personal files and apps.
Complete the upgrade — this reinstalls Windows system files without data loss.

This resolves deeply embedded corruption that SFC/DISM cannot reach.

Step 7: BIOS / UEFI and Hardware Checks

Update BIOS/UEFI: Outdated firmware causes memory compatibility issues. Visit your motherboard manufacturer's website.
Disable XMP/EXPO RAM profiles: Overclocked memory profiles can cause instability on Windows 11. In BIOS, set RAM to JEDEC standard speed.
Check CPU temperatures: Use HWiNFO64 or HWMonitor. Sustained CPU temps above 90°C cause thermal throttling and potential BSODs.
Reseat RAM and GPU: Physical connection issues cause intermittent memory errors.

Frequently Asked Questions

powershell

# ============================================================
# Windows 11 BSOD Diagnostic & Fix Script
# Run as Administrator in PowerShell
# ============================================================

# --- Step 1: Export last 20 critical/error system events to desktop ---
$logPath = "$env:USERPROFILE\Desktop\BSOD_Events.txt"
Get-WinEvent -LogName System -MaxEvents 500 | Where-Object {
    $_.LevelDisplayName -in @('Critical', 'Error') -and
    $_.Id -in @(41, 1001, 6008)
} | Select-Object -First 20 | Format-List TimeCreated, Id, Message | Out-File $logPath
Write-Host "[OK] Event log exported to $logPath"

# --- Step 2: List recent minidump files ---
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
    Write-Host "[INFO] Recent minidump files:"
    Get-ChildItem $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 5 | Format-Table Name, LastWriteTime, Length
} else {
    Write-Host "[WARN] No minidump folder found. Ensure Small Memory Dump is configured."
    # Configure small memory dump
    $regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"
    Set-ItemProperty -Path $regPath -Name "CrashDumpEnabled" -Value 3
    Set-ItemProperty -Path $regPath -Name "MinidumpDir" -Value "%SystemRoot%\Minidump"
    Write-Host "[OK] Small memory dump configured. Reboot required."
}

# --- Step 3: Run System File Checker ---
Write-Host "[INFO] Running SFC scan..."
Start-Process -FilePath "sfc" -ArgumentList "/scannow" -Wait -NoNewWindow

# --- Step 4: Run DISM health restoration ---
Write-Host "[INFO] Running DISM RestoreHealth..."
DISM /Online /Cleanup-Image /RestoreHealth

# --- Step 5: Check disk for errors (schedules for next reboot) ---
Write-Host "[INFO] Scheduling CHKDSK on C: for next reboot..."
echo Y | chkdsk C: /f /r /x 2>&1

# --- Step 6: Enable Driver Verifier for all drivers (use carefully -- will BSOD on bad driver) ---
# Uncomment the line below ONLY to identify a faulty driver. Disable after testing.
# verifier /standard /all

# --- Step 7: Query SMART data for physical drives ---
Write-Host "[INFO] Physical disk SMART reliability counters:"
Get-PhysicalDisk | Get-StorageReliabilityCounter | Select-Object DeviceId, ReadErrorsTotal, WriteErrorsTotal, Temperature, Wear | Format-Table -AutoSize

# --- Step 8: Check for pending Windows Updates ---
Write-Host "[INFO] Installed hotfixes (last 10):"
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, InstalledOn, Description

# --- Step 9: Export driver list for review ---
$driverLog = "$env:USERPROFILE\Desktop\Drivers_List.txt"
Get-WmiObject Win32_PnPSignedDriver | Select-Object DeviceName, DriverVersion, DriverDate, IsSigned | Sort-Object DriverDate -Descending | Format-Table -AutoSize | Out-File $driverLog
Write-Host "[OK] Driver list exported to $driverLog"

# --- Step 10: Disable XMP via registry notice (must be done in BIOS) ---
Write-Host "[NOTICE] If BSOD persists, disable XMP/EXPO in BIOS and test RAM at stock speed."
Write-Host "[DONE] Diagnostics complete. Review Desktop files and minidumps."

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems specialists with over a decade of experience diagnosing kernel-level failures, production incidents, and OS-level instability across enterprise and consumer environments. Our guides are grounded in real-world incident postmortems, official Microsoft documentation, and community-validated diagnostic techniques.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.