What does the stop code CRITICAL_PROCESS_DIED (0x000000EF) mean in Windows 11?

The stop code CRITICAL_PROCESS_DIED (bug check value 0x000000EF) means that a kernel-level process that Windows 11 requires to operate — such as lsass.exe, csrss.exe, smss.exe, or wininit.exe — was unexpectedly terminated. Because these processes are critical to system integrity, Windows cannot continue running and forces a BSOD to prevent data corruption. The root cause is usually corrupted system files, a bad driver, a failed Windows Update, malware, or failing hardware.

My Windows 11 PC shows Critical Process Died and cannot boot at all. What should I do first?

If Windows 11 cannot boot due to CRITICAL_PROCESS_DIED, interrupt the startup process three times in a row (hold the power button during the Windows logo each time). This triggers the Automatic Repair screen, where you can access Advanced Options → Troubleshoot. From there, try Startup Repair first, then System Restore if a restore point is available. If those fail, open Command Prompt from Advanced Options and run 'sfc /scannow' and 'DISM /Image:C:\ /Cleanup-Image /RestoreHealth'. As a last resort, boot from a Windows 11 USB drive to access full repair tools or perform a reset.

Can a Windows Update cause Critical Process Died on Windows 11?

Yes, this is a well-documented cause reported frequently on communities like Reddit and Microsoft Answers. A faulty cumulative update can install a driver or system file that conflicts with existing hardware or software, leading to the CRITICAL_PROCESS_DIED BSOD. To fix this, go to Settings → Windows Update → Update History → Uninstall Updates and remove the most recently installed update. If you cannot boot, use WinRE (Advanced Options → Uninstall Updates) to remove the latest quality or feature update.

How can I tell which driver or process caused the Critical Process Died BSOD?

The best way is to analyze the memory dump file created when the BSOD occurred. Open Event Viewer (Win+X → Event Viewer → Windows Logs → System) and look for Critical events around the crash time. For deeper analysis, install WinDbg (Windows Debugger) from the Microsoft Store or the Windows SDK. Open the minidump file located at C:\Windows\Minidump\*.dmp and run '!analyze -v' in WinDbg. The output will identify the faulting module — typically a .sys file corresponding to a specific driver — such as nvlddmkm.sys for NVIDIA or ntfs.sys for file system issues.

Will resetting Windows 11 to fix Critical Process Died delete my files?

It depends on the reset option you choose. When you go to Troubleshoot → Reset this PC, you can select 'Keep my files' — this reinstalls Windows 11 while preserving your personal files in the Users folder, but it will remove installed applications and drivers. The 'Remove everything' option performs a full wipe, deleting all files, apps, and settings. Always back up important data to an external drive or cloud storage before performing any reset. If you can still boot intermittently, use File History or manually copy files before resetting.

Critical Process Died Windows 11: Complete Fix Guide for BSOD Stop Code

Fix the Critical Process Died BSOD in Windows 11 with proven solutions: SFC scan, driver rollback, startup repair, and more. Step-by-step guide.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,262 words

Key Takeaways

Root cause 1: A critical Windows kernel process (such as lsass.exe, csrss.exe, or wininit.exe) was terminated unexpectedly due to a corrupted system file, bad driver, or malware.
Root cause 2: Recently installed drivers, Windows Updates, or third-party software can corrupt memory regions or overwrite system files, triggering the CRITICAL_PROCESS_DIED stop code (0x000000EF).
Root cause 3: Failing or misconfigured hardware — especially RAM, SSDs with outdated firmware, or overheating components — can force Windows to kill critical processes to prevent further corruption.
Quick fix summary: Boot into Safe Mode or Windows Recovery Environment, run SFC /scannow and DISM to repair system files, roll back or uninstall recent drivers, and use Startup Repair if the system cannot boot normally.

Fix Approaches Compared
Method	When to Use	Time	Risk
SFC + DISM Scan	Corrupted or missing system files detected in Event Viewer	10–30 min	Low
Driver Rollback / Uninstall	BSOD started after a driver or Windows Update	5–15 min	Low
Windows Startup Repair	System cannot boot past the BSOD screen	15–30 min	Low
System Restore	A restore point exists before the issue started	20–40 min	Low–Medium
Check Disk (chkdsk)	Suspect file system corruption or bad sectors on drive	30–120 min	Low
Memory Diagnostic (mdsched)	Random BSODs, system instability, suspect RAM failure	30–60 min	Low
Reset / Clean Install Windows 11	All other methods fail, system is unbootable	60–180 min	High (data loss)

Understanding the Critical Process Died Error in Windows 11

The CRITICAL_PROCESS_DIED stop code (bug check code 0x000000EF) appears as a Blue Screen of Death (BSOD) when Windows 11 detects that a process essential to the operating system's operation has been terminated unexpectedly. The full error message you will see on screen is:

Your PC ran into a problem and needs to restart.
Stop code: CRITICAL PROCESS DIED

Windows relies on several protected processes to function. If any of the following are forcibly terminated or crash, the OS cannot recover and halts:

lsass.exe – Local Security Authority Subsystem (handles authentication)
csrss.exe – Client/Server Runtime Subsystem (manages Win32 console)
wininit.exe – Windows Initialization Manager
services.exe – Service Control Manager
smss.exe – Session Manager Subsystem

This error is different from generic application crashes because Windows cannot continue operation without these processes running.

Step 1: Identify Whether You Can Boot Windows 11

Your first priority is determining whether Windows 11 can boot at all.

Scenario A: Windows can boot (BSOD is intermittent) If you can reach the desktop even occasionally, you have the most options available. Proceed directly to the diagnostic commands in Step 2.

Scenario B: Windows cannot boot (BSOD loops on startup) If the system repeatedly crashes before reaching the desktop, you must boot into the Windows Recovery Environment (WinRE):

Force-interrupt startup three times (hold the power button during the Windows logo) to trigger Automatic Repair.
On the Automatic Repair screen, click Advanced options.
Navigate to: Troubleshoot → Advanced options.

Alternatively, boot from a Windows 11 USB installation media and select Repair your computer.

From WinRE Advanced Options you can access:

Startup Repair
System Restore
Command Prompt (for manual fixes)
Uninstall Updates
System Image Recovery

Step 2: Run System File Checker and DISM

Corrupted Windows system files are among the most common causes. Run these commands as Administrator in Command Prompt or PowerShell.

System File Checker:

sfc /scannow

This scans all protected system files and replaces corrupted versions with cached copies. Wait for it to complete (do not interrupt). If it reports "Windows Resource Protection found corrupt files but was unable to fix some of them," proceed with DISM.

DISM (Deployment Image Servicing and Management):

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

DISM downloads replacements from Windows Update servers when the local cache is itself corrupted. Run SFC again after DISM completes.

If you are in WinRE Command Prompt and Windows cannot boot, you must point DISM to the offline Windows image. First, identify your Windows drive letter using:

diskpart
list volume
exit

Then run:

DISM /Image:D:\ /Cleanup-Image /RestoreHealth

(Replace D: with your actual Windows partition letter.)

Step 3: Check for Problem Drivers

A faulty, outdated, or incompatible driver is the second-most-common cause of CRITICAL_PROCESS_DIED. Review the Windows Event Log for clues:

Press Win + X → Event Viewer.
Navigate to Windows Logs → System.
Filter by Critical and Error level events around the time of the crash.
Look for entries referencing .sys files (kernel drivers), such as:
- nvlddmkm.sys (NVIDIA GPU driver)
- iastora.sys / iaStorAVC.sys (Intel Storage driver)
- ntfs.sys (NTFS file system driver)

To roll back a driver:

Press Win + X → Device Manager.
Right-click the suspected device → Properties → Driver → Roll Back Driver.

To uninstall a driver via command line:

pnputil /enum-drivers
pnputil /delete-driver oem12.inf /uninstall /force

For graphics drivers, use Display Driver Uninstaller (DDU) in Safe Mode for a clean removal:

Boot into Safe Mode: Settings → System → Recovery → Advanced Startup → Restart Now → Troubleshoot → Advanced Options → Startup Settings → Restart → Press 4.
Run DDU and select "Clean and restart."
Install the latest driver from the manufacturer's official site.

Step 4: Uninstall Recent Windows Updates

If the BSOD started after a Windows Update, uninstall it:

From Settings (if bootable):

Settings → Windows Update → Update History → Uninstall Updates.
Select the most recent update and click Uninstall.

From WinRE (if not bootable):

Advanced Options → Uninstall Updates.
Select Uninstall latest quality update or Uninstall latest feature update.

Step 5: Run Check Disk for Drive Errors

File system corruption or bad sectors can cause process termination. Run CHKDSK from an elevated Command Prompt:

chkdsk C: /f /r /x

The /f flag fixes errors, /r locates bad sectors and recovers readable data, and /x forces a dismount. You will be prompted to schedule this on the next reboot if the drive is in use.

Step 6: Test RAM with Windows Memory Diagnostic

Faulty RAM can corrupt process memory, triggering this BSOD. To run the Windows Memory Diagnostic:

mdsched.exe

Choose Restart now and check for problems. After the test, results appear in Event Viewer under Windows Logs → System, source: MemoryDiagnostics-Results.

For more thorough testing, use MemTest86 (bootable USB tool) and run at least two full passes.

Step 7: Use System Restore

If a restore point exists from before the error started, this is often the fastest recovery:

Press Win + R → type rstrui.exe → Enter.
Or from WinRE: Advanced Options → System Restore.
Select a restore point dated before the issue began and follow the wizard.

System Restore does not affect personal files but will remove apps and drivers installed after the restore point.

Step 8: Run Startup Repair

If the system cannot boot and the above steps have not resolved the issue:

Boot into WinRE (three interrupted startups or Windows 11 USB).
Go to Troubleshoot → Advanced Options → Startup Repair.
Select your account and let Windows diagnose and attempt repair automatically.

Step 9: Reset or Clean Install Windows 11 (Last Resort)

If all else fails, reset Windows 11:

WinRE → Troubleshoot → Reset this PC.
Choose Keep my files (reinstalls Windows, removes apps) or Remove everything (full wipe).
For a completely clean environment, boot from a Windows 11 USB and perform a fresh installation.

Preventing Future Occurrences

Keep Windows Update enabled and install updates regularly.
Only download drivers from manufacturer websites (never driver updater tools).
Enable Windows Defender and run periodic scans for malware.
Monitor drive health using CrystalDiskInfo (free tool).
Create a System Restore point before installing new hardware or software.
Check CPU and GPU temperatures with HWiNFO64 — sustained temps above 90°C can destabilize processes.

Frequently Asked Questions

powershell

# ============================================================
# Windows 11 Critical Process Died - Diagnostic & Fix Script
# Run PowerShell as Administrator
# ============================================================

# --- STEP 1: Check for corrupted system files ---
Write-Host "[1/7] Running System File Checker..." -ForegroundColor Cyan
sfc /scannow

# --- STEP 2: DISM health check and restore ---
Write-Host "[2/7] Running DISM CheckHealth..." -ForegroundColor Cyan
DISM /Online /Cleanup-Image /CheckHealth

Write-Host "[2/7] Running DISM RestoreHealth (requires internet)..." -ForegroundColor Cyan
DISM /Online /Cleanup-Image /RestoreHealth

# --- STEP 3: Check disk for errors (schedules on next reboot) ---
Write-Host "[3/7] Scheduling CHKDSK on C: drive for next reboot..." -ForegroundColor Cyan
echo Y | chkdsk C: /f /r /x

# --- STEP 4: List installed drivers (helps identify problem drivers) ---
Write-Host "[4/7] Listing third-party kernel drivers..." -ForegroundColor Cyan
driverquery /FO TABLE | Where-Object { $_ -notmatch "Microsoft" } | Select-Object -First 40

# --- STEP 5: View recent critical/error events from System log ---
Write-Host "[5/7] Fetching recent critical System events..." -ForegroundColor Cyan
Get-WinEvent -LogName System -MaxEvents 50 | 
  Where-Object { $_.LevelDisplayName -in @("Critical", "Error") } |
  Select-Object TimeCreated, Id, LevelDisplayName, Message |
  Format-List

# --- STEP 6: Check minidump files for recent crashes ---
Write-Host "[6/7] Listing recent minidump files..." -ForegroundColor Cyan
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem -Path $dumpPath -Filter "*.dmp" | 
      Sort-Object LastWriteTime -Descending | 
      Select-Object Name, LastWriteTime, @{Name="SizeMB";Expression={[math]::Round($_.Length/1MB,2)}} |
      Format-Table -AutoSize
} else {
    Write-Host "No minidump folder found. Enable full memory dumps in System Properties." -ForegroundColor Yellow
}

# --- STEP 7: Schedule Windows Memory Diagnostic ---
Write-Host "[7/7] Launching Windows Memory Diagnostic (will restart your PC)..." -ForegroundColor Cyan
Write-Host "Press ENTER to start memory test or CTRL+C to skip."
Read-Host
mdsched.exe

# ============================================================
# OFFLINE / WinRE COMMANDS (run from WinRE Command Prompt)
# Replace D: with your actual Windows partition letter
# ============================================================
# diskpart
# list volume
# exit
#
# sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows
# DISM /Image:D:\ /Cleanup-Image /RestoreHealth
# chkdsk D: /f /r
#
# To enable Driver Verifier (catch bad drivers - advanced):
# verifier /standard /all
# (Reboot - system will BSOD on load if a bad driver is detected)
# verifier /reset  (run this in safe mode to disable)
# ============================================================

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SRE specialists, and Windows system administrators with a combined 40+ years of experience diagnosing operating system failures, kernel panics, and enterprise infrastructure incidents. Our guides are built from real-world troubleshooting cases, Microsoft documentation, and community-sourced solutions from platforms like Reddit, Stack Overflow, and the Microsoft Tech Community.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.