Windows 11 CRITICAL_PROCESS_DIED Blue Screen: Complete Fix Guide (Stop Code 0x000000EF)
Fix Windows 11 CRITICAL_PROCESS_DIED BSOD (stop code 0x000000EF) with step-by-step commands, safe mode workarounds, and registry repairs.
- CRITICAL_PROCESS_DIED (stop code 0x000000EF) occurs when a core Windows kernel process — such as smss.exe, csrss.exe, wininit.exe, or winlogon.exe — terminates unexpectedly, forcing an immediate system crash.
- Common root causes include corrupted system files, faulty or incompatible drivers (especially after Windows Updates), bad RAM or disk sectors, malware targeting system processes, and aggressive third-party security software.
- Quick fix path: Boot into Safe Mode → run 'sfc /scannow' and 'DISM /RestoreHealth' → roll back or update suspect drivers → if Safe Mode is inaccessible, use Windows Recovery Environment (WinRE) from installation media to execute the same commands offline.
| Method | When to Use | Time | Risk |
|---|---|---|---|
| SFC + DISM System File Repair | Corrupted Windows system files after update or crash | 15–30 min | Low |
| Driver Rollback / Uninstall | BSOD started after a driver or Windows Update | 10–20 min | Low |
| Safe Mode Boot | System crashes before reaching desktop | 5–10 min | Low |
| WinRE Offline Repair (bootable USB) | Safe Mode inaccessible; machine boot-loops | 30–60 min | Low-Medium |
| CHKDSK Disk Scan | Suspected bad sectors or disk corruption | 20–120 min | Low |
| Windows Memory Diagnostic / MemTest86 | RAM-related crashes, random BSODs | 30–480 min | Low |
| System Restore | Known-good restore point exists before issue started | 20–40 min | Low-Medium |
| In-Place Upgrade Repair Install | Widespread corruption, no restore point | 60–120 min | Medium |
| Clean Windows 11 Install | All other methods failed; drive is healthy | 60–120 min | High (data loss) |
Understanding the CRITICAL_PROCESS_DIED Error
When Windows 11 displays a blue screen with the message CRITICAL_PROCESS_DIED and the stop code 0x000000EF, it means the Windows kernel detected that a process essential to system operation was terminated abnormally. Unlike user-space application crashes, these processes run at a privilege level where their failure cannot be recovered gracefully — so Windows halts entirely to prevent data corruption or security breaches.
Processes that most frequently trigger this error include:
smss.exe— Session Manager Subsystemcsrss.exe— Client/Server Runtime Subsystemwininit.exe— Windows Initialization Processwinlogon.exe— Windows Logon Applicationservices.exe— Service Control Manager
The exact stop message you will see on screen reads:
Your PC ran into a problem and needs to restart.
We're just collecting some error info, and then we'll restart for you.
Stop code: CRITICAL_PROCESS_DIED
Step 1: Identify Whether You Can Boot Normally
Before attempting any fix, determine your current boot state:
Scenario A — Windows boots but crashes intermittently: You have the most options. Log in when you can, open an elevated PowerShell or Command Prompt, and proceed with the diagnostic commands in the code block below.
Scenario B — Windows boot-loops and crashes before login: You need Safe Mode or WinRE.
Scenario C — Safe Mode is also unavailable (windows 11 critical process died no safe mode): You must use a Windows 11 bootable USB.
Step 2: Enter Safe Mode or Windows Recovery Environment
Accessing Safe Mode
If the system gives you any window before crashing:
- Hold Shift and click Restart from the Start menu or login screen.
- Navigate: Troubleshoot → Advanced Options → Startup Settings → Restart.
- Press F4 for Safe Mode or F5 for Safe Mode with Networking.
Alternatively, force three consecutive hard shutdowns (hold power button during boot) to trigger Automatic Repair mode, then navigate to Startup Settings.
Creating a Bootable USB (Safe Mode Not Accessible)
- Download the Windows 11 Media Creation Tool from https://www.microsoft.com/software-download/windows11
- Create installation media on a USB drive (8 GB+).
- Boot from USB (press F12, F2, or DEL during POST to access boot menu).
- On the setup screen, click Repair your computer (bottom-left) instead of Install.
- Navigate to Troubleshoot → Advanced Options → Command Prompt.
Step 3: Run System File Checker and DISM
These two tools address the majority of CRITICAL_PROCESS_DIED cases caused by file corruption.
From an elevated Command Prompt or PowerShell (in Windows or WinRE):
sfc /scannow
Wait for the scan to complete (can take 10–20 minutes). If it reports "Windows Resource Protection found corrupt files but was unable to fix some of them," run DISM next:
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
After DISM completes, run SFC again:
sfc /scannow
Restart and test. If the BSOD recurs, continue to the next steps.
Running SFC offline from WinRE (when Windows won't boot):
In WinRE Command Prompt, first identify your Windows drive letter (it may not be C: in recovery):
dir C:\
dir D:\
Look for the Windows folder. Assuming it is on D::
sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows
Step 4: Check and Repair the Disk
Bad sectors or file system corruption on the boot drive frequently cause critical process terminations when a process reads a corrupt memory-mapped file:
chkdsk C: /f /r /x
The /f flag fixes errors, /r locates bad sectors and recovers readable data, and /x forces the volume to dismount first. You will be prompted to schedule the scan on next reboot — type Y and restart.
For NVMe/SSD drives, also check manufacturer health tools (Samsung Magician, CrystalDiskInfo) and look for reallocated sector counts in S.M.A.R.T. data.
Step 5: Identify and Roll Back Faulty Drivers
Driver-related BSODs are the most common cause of windows 11 critical process died on boot, especially after Windows Update installs new drivers automatically.
Read the Minidump File
Windows saves crash dump files to C:\Windows\Minidump\. Use WinDbg Preview (free from Microsoft Store) or the legacy WinDbg to analyze them:
- Open WinDbg → File → Open Crash Dump → select the
.dmpfile. - In the command window type:
!analyze -v - Look for MODULE_NAME, IMAGE_NAME, and FAULTING_MODULE_PATH in the output. These lines name the driver or process responsible.
Common culprits include: nvlddmkm.sys (NVIDIA), amdkmdag.sys (AMD GPU), ntfs.sys (file system), iastora.sys (Intel storage), antivirus kernel drivers.
Roll Back a Driver
- Open Device Manager (Win + X → Device Manager).
- Expand the category for the suspect device.
- Right-click → Properties → Driver tab → Roll Back Driver.
If Roll Back is greyed out, the previous driver was not saved. Instead:
- Uninstall the device driver entirely (check "Delete the driver software").
- Download the previous version from the manufacturer's website manually.
- Or run:
pnputil /delete-driver oem##.inf /uninstall /force(replace##with the actual number frompnputil /enum-drivers).
Disable Windows Update from Auto-Installing Drivers
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v ExcludeWUDriversInQualityUpdate /t REG_DWORD /d 1 /f
Step 6: Test RAM
Faulty RAM causes random critical process deaths because kernel data structures become corrupted in memory:
Built-in tool (basic):
- Press Win + R → type
mdsched.exe→ Restart now and check for problems. - Results appear after reboot in Event Viewer → Windows Logs → System (source: MemoryDiagnostics-Results).
MemTest86 (thorough — recommended):
- Download from https://www.memtest86.com/, create bootable USB, boot from it, and run at least 2 full passes (ideally overnight). Any errors indicate bad RAM that must be replaced or reseated.
Step 7: Scan for Malware
Malware that injects into or replaces system processes will cause CRITICAL_PROCESS_DIED when Windows detects the tampered process:
Start-MpScan -ScanType FullScan
Or boot from a dedicated rescue USB (Malwarebytes Rescue, Kaspersky Rescue Disk) to scan offline without the OS running.
Step 8: Perform a System Restore
If the error started recently and a restore point exists:
- From WinRE: Troubleshoot → Advanced Options → System Restore.
- Select a restore point dated before the issue began.
- Confirm and allow the restore to complete.
This rolls back system files, drivers, and registry settings without affecting personal files.
Step 9: In-Place Upgrade Repair Install
If nothing else works and you want to preserve installed apps and files:
- Boot into Windows (or Safe Mode if possible).
- Mount or run the Windows 11 ISO.
- Launch
setup.exe→ choose Upgrade this PC now. - When prompted, select Keep personal files and apps.
This reinstalls all system files while preserving your data and applications. It effectively replaces corrupted OS components without requiring a clean wipe.
Step 10: Clean Install (Last Resort)
If the drive's S.M.A.R.T. data shows no hardware failure and all software fixes have failed:
- Back up all data to external storage.
- Boot from Windows 11 USB.
- Choose Install now → Custom installation → delete existing partitions and install fresh.
This resolves any software-layer corruption with certainty.
Frequently Asked Questions
# ============================================================
# Windows 11 CRITICAL_PROCESS_DIED Diagnostic & Fix Script
# Run in an elevated PowerShell (Run as Administrator)
# ============================================================
# --- 1. Check Windows version and recent crash events ---
Write-Host "=== System Information ==="
(Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsHardwareAbstractionLayer) | Format-List
Write-Host "`n=== Recent BSOD Events (last 7 days) ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, Message | Format-List
# --- 2. List minidump files ---
Write-Host "`n=== Minidump Files ==="
Get-ChildItem -Path "C:\Windows\Minidump" -Filter "*.dmp" -ErrorAction SilentlyContinue |
Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, Length
# --- 3. Run System File Checker ---
Write-Host "`n=== Running SFC (this may take 10-20 minutes) ==="
sfc /scannow
# --- 4. Run DISM Health Restore ---
Write-Host "`n=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth
# --- 5. Run SFC again after DISM ---
Write-Host "`n=== Re-running SFC after DISM ==="
sfc /scannow
# --- 6. Check disk health ---
Write-Host "`n=== Scheduling CHKDSK on next reboot ==="
cmd /c "echo Y | chkdsk C: /f /r /x"
Write-Host "CHKDSK scheduled. Restart to execute."
# --- 7. List recently installed drivers ---
Write-Host "`n=== Drivers installed in last 30 days ==="
Get-WmiObject Win32_PnPSignedDriver |
Where-Object { $_.DriverDate -gt (Get-Date).AddDays(-30).ToString("yyyyMMdd") + "000000.000000+000" } |
Select-Object DeviceName, DriverVersion, DriverDate, InfName |
Sort-Object DriverDate -Descending | Format-Table -AutoSize
# --- 8. List all third-party drivers (non-Microsoft) ---
Write-Host "`n=== Third-Party (Non-Microsoft) Drivers ==="
Get-WmiObject Win32_PnPSignedDriver |
Where-Object { $_.Manufacturer -ne 'Microsoft' -and $_.Manufacturer -ne '(Standard display types)' } |
Select-Object DeviceName, Manufacturer, DriverVersion, InfName |
Sort-Object Manufacturer | Format-Table -AutoSize
# --- 9. Check for pending Windows Updates ---
Write-Host "`n=== Checking Windows Update Status ==="
(New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher().Search("IsInstalled=0").Updates |
Select-Object Title, MsrcSeverity | Format-Table -AutoSize
# --- 10. Initiate Windows Memory Diagnostic ---
Write-Host "`n=== Scheduling Windows Memory Diagnostic ==="
$response = Read-Host "Schedule RAM test on next reboot? (Y/N)"
if ($response -eq 'Y') {
mdsched.exe
}
# --- 11. Quick malware scan via Windows Defender ---
Write-Host "`n=== Starting Windows Defender Quick Scan ==="
Start-MpScan -ScanType QuickScan
# --- 12. Export SFC log for review ---
Write-Host "`n=== SFC Log Location ==="
Write-Host "C:\Windows\Logs\CBS\CBS.log"
Write-Host "Filter for '[SR]' entries to see SFC results."
Get-Content "C:\Windows\Logs\CBS\CBS.log" -ErrorAction SilentlyContinue |
Select-String "\[SR\]" | Select-Object -Last 30
Write-Host "`n=== Diagnostic Complete. Review output above for issues. ==="Error Medic Editorial
Error Medic Editorial is a team of senior DevOps engineers, SREs, and Windows systems specialists with over a decade of experience diagnosing kernel-level failures, BSOD analysis, and enterprise Windows deployments. Our guides are built from real incident post-mortems, Microsoft documentation, and community-validated fixes — not generic walkthroughs.
Sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xef--critical-process-died
- https://support.microsoft.com/en-us/windows/fix-windows-update-errors-18b693b5-7818-5825-8a7e-2a4a37d6d787
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sfc
- https://answers.microsoft.com/en-us/windows/forum/all/critical-process-died-blue-screen-windows-11/
- https://www.memtest86.com/
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/using-the-minidump-file