What does stop code DRIVER_IRQL_NOT_LESS_OR_EQUAL mean in Windows 11?

Stop code DRIVER_IRQL_NOT_LESS_OR_EQUAL (bug check 0x000000D1) means a kernel-mode driver tried to access pageable or invalid memory at an elevated Interrupt Request Level (IRQL >= DISPATCH_LEVEL). The 'What failed' line on the BSOD screen (e.g., 'tcpip.sys' or 'nvlddmkm.sys') identifies the specific driver. Update or roll back that driver to fix the issue.

Why does ntoskrnl.exe cause IRQL_NOT_LESS_OR_EQUAL on Windows 11?

When the BSOD dump cites ntoskrnl.exe for IRQL_NOT_LESS_OR_EQUAL, it usually means the Windows kernel itself detected the violation but the true root cause is upstream — most often faulty RAM, a corrupted system file, or a driver that corrupted kernel memory before the crash. Run SFC /scannow, DISM /RestoreHealth, and MemTest86 to diagnose. ntoskrnl.exe itself is rarely the root cause.

Why does tcpip.sys trigger DRIVER_IRQL_NOT_LESS_OR_EQUAL on Windows 11?

tcpip.sys is the Windows TCP/IP kernel driver. It is commonly cited in IRQL BSODs because third-party VPN software, firewall filter drivers, or outdated network adapter (NIC) drivers interact with it at the wrong IRQL. To fix: update your NIC driver from the manufacturer's website, uninstall VPN clients, and temporarily disable third-party firewalls. Also run 'netsh winsock reset' and 'netsh int ip reset' as Administrator.

How do I fix IRQL_NOT_LESS_OR_EQUAL if Windows 11 won't boot at all?

If Windows 11 crashes before reaching the desktop: (1) Force three interrupted boots to enter WinRE, (2) Go to Troubleshoot → Advanced Options → Command Prompt, (3) Run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth', (4) If a specific driver is suspected, use 'bcdedit /set safeboot minimal' to force Safe Mode on next boot, then disable or uninstall the driver from Device Manager, (5) Run 'bcdedit /deletevalue safeboot' to return to normal boot after the fix.

Can RAM cause IRQL_NOT_LESS_OR_EQUAL BSODs on Windows 11?

Yes. Faulty, incompatible, or improperly seated RAM is a primary non-driver cause. When RAM returns corrupt data during a kernel memory read, the IRQL guard fires. Signs that RAM is the cause include BSODs that occur across different drivers, random timing, and crashes during memory-intensive tasks. Run Windows Memory Diagnostic (mdsched.exe) for a quick check, or MemTest86 overnight for definitive results. Also try disabling XMP/EXPO profiles in BIOS and testing one RAM stick at a time.

IRQL_NOT_LESS_OR_EQUAL Windows 11: Complete BSOD Fix Guide (2024)

Fix IRQL_NOT_LESS_OR_EQUAL BSOD on Windows 11 caused by bad drivers, RAM, or ntoskrnl.exe. Step-by-step commands and proven solutions inside.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,118 words

Key Takeaways

Root cause 1: A kernel-mode driver (such as tcpip.sys, ntoskrnl.exe, or a third-party GPU/NIC driver) is accessing memory at an Interrupt Request Level (IRQL) that is too high, corrupting the kernel stack.
Root cause 2: Faulty, overclocked, or incompatible RAM causes invalid memory address references that trigger the IRQL guard — confirmed by Windows Memory Diagnostic or MemTest86.
Root cause 3: Outdated, corrupted, or newly installed drivers — especially network adapter drivers (tcpip.sys), antivirus kernel filters, and display drivers — are the most frequent culprits on Windows 11 after an OS update.
Quick fix summary: Boot into Safe Mode, identify the offending driver via WinDbg or WhoCrashed, update or roll back that driver, run SFC and DISM to repair system files, and test RAM if crashes persist.

Fix Approaches Compared
Method	When to Use	Time	Risk
Update/Roll Back Faulty Driver	Crash started after a driver or Windows update	5–15 min	Low
Run SFC + DISM Repair	System files corrupted; ntoskrnl.exe referenced in dump	15–30 min	Low
Windows Memory Diagnostic / MemTest86	Random BSODs with no consistent driver blame	30 min – 8 hrs	None
Disable Overclocking / XMP	OC or XMP profile active; instability after hardware change	2–5 min	None
Clean-Boot + Driver Verifier	Third-party software or unknown driver suspected	30–60 min	Medium (may trigger more BSODs)
Reset / Reinstall Windows 11	All other methods failed; system unbootable	1–3 hrs	High (data loss if not backed up)

Understanding the IRQL_NOT_LESS_OR_EQUAL Error on Windows 11

When Windows 11 displays a blue screen with the stop code IRQL_NOT_LESS_OR_EQUAL (bug check code 0x0000000A), it means a kernel-mode process or driver attempted to touch pageable memory while running at an IRQL that was equal to or higher than DISPATCH_LEVEL (IRQL 2). The Windows kernel enforces strict rules about which memory pages are accessible at each interrupt level. Violating those rules causes an immediate, unrecoverable kernel panic.

The full error string you will see on screen is typically:

Your PC ran into a problem and needs to restart.
Stop code: IRQL_NOT_LESS_OR_EQUAL

or the variant:

Stop code: DRIVER_IRQL_NOT_LESS_OR_EQUAL
What failed: tcpip.sys

The difference is subtle: IRQL_NOT_LESS_OR_EQUAL (0x0000000A) is the generic form raised by the kernel itself, while DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1) specifically implicates a driver attempting DMA or memory access at the wrong IRQL.

Step 1: Capture the Minidump and Identify the Culprit

Before blindly reinstalling Windows, read the crash dump. Windows writes minidumps to C:\Windows\Minidump after every BSOD.

Option A — WhoCrashed (fastest for non-developers): Download WhoCrashed (free) from resplendence.com and point it at your minidump folder. It will name the faulty driver module.

Option B — WinDbg (most authoritative):

Install WinDbg Preview from the Microsoft Store.
Open the latest .dmp file from C:\Windows\Minidump.
Run !analyze -v in the command pane.

The output will show a line like:

Probably caused by: tcpip.sys (tcpip+0x1a3f2)

or:

Probably caused by: ntoskrnl.exe (nt+0x7f3c8)

Note the module name — this is your primary suspect.

Configure Windows to always generate minidumps:

Right-click Start → System → Advanced system settings → Startup and Recovery → Settings.
Set Write debugging information to Small memory dump (256 KB).
Ensure the path is %SystemRoot%\Minidump.

Step 2: Boot into Safe Mode

If the BSOD occurs on every boot, you must use Safe Mode to perform repairs.

Force three consecutive hard reboots (hold Power until shutdown during the Windows logo). Windows will auto-enter the Windows Recovery Environment (WinRE).
Navigate to Troubleshoot → Advanced options → Startup Settings → Restart.
Press 4 (Enable Safe Mode) or 5 (Enable Safe Mode with Networking).

All subsequent troubleshooting steps can be performed from Safe Mode.

Step 3: Update or Roll Back the Suspected Driver

If a specific driver was named in the dump (e.g., tcpip.sys, nvlddmkm.sys, iaStorA.sys):

To update:

Press Win + X → Device Manager.
Locate the device associated with the driver (Network Adapters for tcpip.sys, Display adapters for GPU drivers).
Right-click → Update driver → Search automatically.
Alternatively, download the latest driver directly from the manufacturer website (NVIDIA, Intel, AMD, Realtek, etc.).

To roll back:

In Device Manager, right-click the device → Properties → Driver tab → Roll Back Driver.
This is especially useful after a Windows Update automatically replaced a working driver.

If ntoskrnl.exe is the only module cited:

This usually indicates RAM errors or kernel file corruption rather than a third-party driver. Proceed to Steps 4 and 5.

Step 4: Repair System Files with SFC and DISM

Corrupted Windows system files — including ntoskrnl.exe itself — can cause IRQL violations. Run both tools in order:

# Step 4a: Run DISM to repair the Windows image first
DISM /Online /Cleanup-Image /RestoreHealth

# Step 4b: Run System File Checker after DISM completes
sfc /scannow

# Step 4c: If SFC finds unrepairable files, check the log
findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log | findstr /v "verify" | more

Restart after both commands complete.

Step 5: Test RAM

Faulty RAM is the leading non-driver cause of IRQL_NOT_LESS_OR_EQUAL. Two approaches:

Windows Memory Diagnostic (built-in):

Press Win + R, type mdsched.exe, press Enter.
Choose Restart now and check for problems.
After reboot, results appear in the notification tray. Check Event Viewer → Windows Logs → System and filter for source MemoryDiagnostics-Results.

MemTest86 (gold standard):

Download from memtest86.com and create a bootable USB.
Run at least 2 full passes (overnight recommended).
Any errors = RAM replacement required.

If RAM errors are found, try reseating sticks, testing one stick at a time, or disabling XMP/EXPO profiles in BIOS (XMP sets RAM above spec and can destabilize the memory controller).

Step 6: Use Driver Verifier to Find Hidden Culprits

If the dump is inconclusive and crashes continue, Driver Verifier stresses all non-Microsoft drivers and forces an immediate, more informative BSOD the moment a driver misbehaves.

Enable Driver Verifier:

:: Run as Administrator
verifier /standard /driver acpi.sys ataport.sys atikmpag.sys nvlddmkm.sys tcpip.sys
:: Or enable for ALL third-party drivers (more thorough, may crash faster)
verifier /standard /all

Restart. When the next BSOD occurs, the dump will now name the exact driver. After identifying the culprit, disable Verifier:

verifier /reset

Step 7: Disable or Uninstall Third-Party Antivirus / Security Software

Kernel-mode antivirus filter drivers from products like Avast, BitDefender, Kaspersky, and Malwarebytes have historically conflicted with Windows 11 kernel updates. Temporarily uninstalling them (not just disabling) can confirm if they are the cause. Use each vendor's dedicated removal tool (e.g., Avast Uninstall Utility) for a clean removal.

Step 8: Check for Windows Update Issues

A botched cumulative update can replace drivers or system files with incompatible versions.

# List recently installed updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Uninstall a specific update by KB number
wusa /uninstall /kb:5034441 /quiet /norestart

If the BSOD started after a specific update, uninstalling it and pausing updates for 7 days often resolves the issue while Microsoft releases a patched version.

Step 9: Check for Overheating

Thermal throttling and hardware protection mechanisms can corrupt in-flight memory operations. Download HWiNFO64 or Core Temp and monitor CPU/GPU temps under load. If temps exceed 95°C for CPU or 85°C for GPU, clean heatsinks, replace thermal paste, or improve case airflow.

Step 10: Last Resort — Reset or Clean Install Windows 11

If all above steps fail:

Reset this PC: Settings → System → Recovery → Reset this PC → Keep my files (tries to preserve personal data).
Clean install: Download the Windows 11 ISO from microsoft.com/software-download/windows11, create a bootable USB with Rufus, and perform a full clean install. Back up data first.

After a clean install, install drivers one by one and test stability before adding the next — this isolates which driver re-introduction triggers the BSOD.

Frequently Asked Questions

powershell

# ============================================================
# IRQL_NOT_LESS_OR_EQUAL Windows 11 — Full Diagnostic Script
# Run PowerShell as Administrator
# ============================================================

Write-Host "=== Step 1: Check recent minidump files ==="
$dumpPath = "$env:SystemRoot\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 5 Name, LastWriteTime, Length
} else {
    Write-Host "No minidump folder found. Enable small memory dumps in System Properties."
}

Write-Host ""
Write-Host "=== Step 2: List recent BSODs from Event Log ==="
Get-WinEvent -LogName System -ErrorAction SilentlyContinue | Where-Object { $_.Id -eq 41 -or $_.Id -eq 1001 } | Select-Object -First 10 TimeCreated, Id, Message | Format-List

Write-Host ""
Write-Host "=== Step 3: Show recently installed drivers ==="
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DriverDate -ge (Get-Date).AddDays(-30) } | Select-Object DeviceName, DriverVersion, DriverDate, InfName | Sort-Object DriverDate -Descending | Format-Table -AutoSize

Write-Host ""
Write-Host "=== Step 4: Run System File Checker ==="
Write-Host "Running DISM first (this may take 10-20 minutes)..."
DISM /Online /Cleanup-Image /RestoreHealth
Write-Host "Running SFC..."
sfc /scannow

Write-Host ""
Write-Host "=== Step 5: Reset TCP/IP stack (fixes tcpip.sys issues) ==="
netsh winsock reset
netsh int ip reset
Write-Host "TCP/IP stack reset. A restart is required for this to take effect."

Write-Host ""
Write-Host "=== Step 6: Check for Windows Update failures ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn, Description

Write-Host ""
Write-Host "=== Step 7: Enable Driver Verifier for all non-MS drivers ==="
Write-Host "WARNING: This will cause controlled BSODs to identify bad drivers."
Write-Host "Only run this if you have saved all work and are ready to reboot."
$confirm = Read-Host "Type YES to enable Driver Verifier, or press Enter to skip"
if ($confirm -eq "YES") {
    verifier /standard /all
    Write-Host "Driver Verifier enabled. Reboot now and reproduce the crash."
    Write-Host "After identifying the driver, run: verifier /reset"
} else {
    Write-Host "Driver Verifier skipped."
}

Write-Host ""
Write-Host "=== Step 8: Launch Windows Memory Diagnostic ==="
$memDiag = Read-Host "Type YES to schedule RAM test on next reboot"
if ($memDiag -eq "YES") {
    Start-Process mdsched.exe
} else {
    Write-Host "RAM test skipped. Consider running MemTest86 manually for thorough testing."
}

Write-Host ""
Write-Host "=== Diagnostic complete. Review output above and check minidumps with WinDbg or WhoCrashed. ==="

Error Medic Editorial

The Error Medic Editorial team consists of senior DevOps engineers, SREs, and Windows systems administrators with 10+ years of experience diagnosing kernel-level failures, memory errors, and driver conflicts across enterprise and consumer Windows environments. Our guides are based on real incident post-mortems, official Microsoft documentation, and community-verified solutions.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.