Error Medic

IRQL_NOT_LESS_OR_EQUAL Windows 11: Complete Fix Guide (BSOD Stop Code)

Fix IRQL_NOT_LESS_OR_EQUAL BSOD on Windows 11. Step-by-step guide covering driver updates, memory checks, tcpip.sys, ntoskrnl.exe & more.

Last updated:
Last verified:
2,088 words
Key Takeaways
  • IRQL_NOT_LESS_OR_EQUAL is caused by a driver or kernel component accessing memory at an incorrect interrupt request level (IRQL), most commonly faulty or incompatible device drivers (network, GPU, storage), corrupted system files, or defective RAM.
  • DRIVER_IRQL_NOT_LESS_OR_EQUAL specifically names the offending driver in the stop screen (e.g., tcpip.sys, nvlddmkm.sys, ntoskrnl.exe) — identifying that file is the fastest path to a fix.
  • Quick fix summary: Boot into Safe Mode, identify the faulting driver using WinDbg or WhoCrashed, update or roll back the driver, run SFC and DKMS scans, test RAM with Windows Memory Diagnostic, and disable overclocking if applicable.
Fix Approaches Compared
MethodWhen to UseTimeRisk
Update/Roll Back Faulty DriverDriver name shown on BSOD screen (e.g., tcpip.sys, nvlddmkm.sys)5-15 minLow
Run SFC & DISM Repairntoskrnl.exe listed or no driver named; suspect corrupted system files15-30 minVery Low
Windows Memory Diagnostic / MemTest86Random BSODs with no consistent driver; possible RAM fault30 min – 8 hrsVery Low
Uninstall Recent Windows UpdateBSOD started immediately after a Windows Update10 minLow
Disable Overclocking / XMP ProfileCustom CPU/RAM overclock or XMP/EXPO enabled in BIOS5 minVery Low
Clean Boot & Third-Party Driver AuditBSOD on startup or during specific app; multiple possible culprits20-40 minLow
Reset / Reinstall Windows 11All other fixes failed; BSOD persists in Safe Mode1-3 hrsMedium – backup data first

Understanding the IRQL_NOT_LESS_OR_EQUAL Error on Windows 11

When Windows 11 displays a blue screen with the stop code IRQL_NOT_LESS_OR_EQUAL (or its driver-specific variant DRIVER_IRQL_NOT_LESS_OR_EQUAL), the kernel has detected that a driver or system component tried to access a memory address at an interrupt request level (IRQL) that is too high. In plain terms: a piece of code reached into memory it should not touch at that moment, and Windows killed the session to prevent data corruption.

The exact message you see on the crash screen will be one of:

  • STOP CODE: IRQL_NOT_LESS_OR_EQUAL
  • STOP CODE: DRIVER_IRQL_NOT_LESS_OR_EQUAL (with an offending file listed below)
  • What failed: tcpip.sys — network stack driver
  • What failed: ntoskrnl.exe — Windows kernel itself (often points to RAM or a kernel-mode driver bug)
  • What failed: nvlddmkm.sys — NVIDIA display driver
  • What failed: dxgkrnl.sys — DirectX kernel

Common root causes include:

  1. Outdated, corrupted, or incompatible device drivers — most frequent cause on Windows 11
  2. Faulty or incompatible RAM — especially after hardware changes
  3. Corrupted Windows system files — often after failed updates
  4. Overclocking or aggressive XMP/EXPO memory profiles
  5. Conflicting third-party security or antivirus software

Step 1: Read the Crash Screen and Dump File

Before touching anything, capture the exact stop code and failing module. If the PC reboots too fast:

  1. Go to Settings → System → About → Advanced System Settings → Startup and Recovery → Settings.
  2. Uncheck Automatically restart under System failure.
  3. Set Write debugging information to Small memory dump (256 KB).

Dump files land in C:\Windows\Minidump\. Use WhoCrashed (free tool) or WinDbg to read them.

In WinDbg (open as Administrator, File → Open Crash Dump):

!analyze -v

Look for the MODULE_NAME and IMAGE_NAME fields — these identify the faulting driver.


Step 2: Boot into Safe Mode (if PC won't stay up)

If Windows 11 keeps crashing on boot:

  1. Force-power-off the PC 3 times in a row. Windows will enter Automatic Repair mode.
  2. Choose Advanced options → Startup Settings → Restart.
  3. Press 4 (Safe Mode) or 5 (Safe Mode with Networking).

All subsequent steps can be run from Safe Mode.


Step 3: Update or Roll Back the Offending Driver

If a driver filename was shown on the BSOD:

  • tcpip.sys → Update your network adapter driver. Open Device Manager (devmgmt.msc), expand Network Adapters, right-click your adapter → Update driver. Also check for Windows Update (tcpip.sys is part of the OS — a cumulative update often fixes it).
  • nvlddmkm.sys / atikmdag.sys → Uninstall your GPU driver fully using DDU (Display Driver Uninstaller) in Safe Mode, then reinstall the latest stable version from NVIDIA/AMD.
  • ntoskrnl.exe → Skip to Step 5 (RAM check) and Step 6 (SFC/DISM), as the kernel image itself rarely corrupts independently.

To roll back a driver:

  1. Open Device Manager.
  2. Right-click the device → Properties → Driver tab → Roll Back Driver.
  3. Restart and monitor.

Step 4: Run SFC and DISM to Repair System Files

Corrupted Windows files — especially after a botched update — can cause the kernel (ntoskrnl.exe) to fault at the wrong IRQL. Open an elevated Command Prompt or PowerShell:

# Step 1: Repair the Windows component store
DISM /Online /Cleanup-Image /RestoreHealth

# Step 2: Scan and repair protected system files
sfc /scannow

Both commands require Administrator privileges. After completion, restart and check Event Viewer (eventvwr.msc) → Windows Logs → System for critical errors.


Step 5: Test Your RAM

Faulty RAM is a silent killer for IRQL errors. Run the built-in Windows Memory Diagnostic:

  1. Press Win + R, type mdsched.exe, press Enter.
  2. Choose Restart now and check for problems.
  3. Let it complete (one pass ≈ 15-30 minutes).

For deeper testing, use MemTest86 (bootable USB, runs outside Windows). Run at least 2 full passes. Any errors = RAM is faulty. Try reseating the sticks first; if errors persist, replace the failing module.

If you have an XMP or EXPO profile enabled in BIOS (common on DDR5 systems paired with Windows 11), try disabling it to run RAM at its default JEDEC speed. This alone resolves the BSOD for many users.


Step 6: Uninstall Problematic Windows Updates

If the BSOD started right after a Windows Update:

  1. Go to Settings → Windows Update → Update History → Uninstall Updates.
  2. Sort by date and remove the most recent cumulative or driver update.
  3. After uninstalling, go to Windows Update → Advanced Options → Pause Updates temporarily.

Alternatively, use DISM from an elevated prompt:

# List recently installed packages
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# Remove a specific update (replace KB number)
wusa /uninstall /kb:5034765 /quiet /norestart

Step 7: Perform a Clean Boot

Third-party software — VPNs, antivirus, gaming overlays, virtual audio drivers — can inject kernel-mode code that triggers IRQL violations.

  1. Press Win + R, type msconfig, press Enter.
  2. Under Services tab, check Hide all Microsoft services, then click Disable all.
  3. Under Startup tab, open Task Manager and disable all startup items.
  4. Restart. If the BSOD stops, re-enable services in small batches to isolate the culprit.

Common offenders on Windows 11: Malwarebytes real-time protection, older versions of Norton/McAfee, Killer Network software, Nahimic audio service, MSI Afterburner/RivaTuner.


Step 8: Check for Hardware Issues

If all software fixes fail:

  • Reseat GPU, RAM sticks, and storage cables — poor contact causes intermittent faults.
  • Run SMART diagnostics on your SSD/HDD: wmic diskdrive get status or use CrystalDiskInfo.
  • Check CPU temperatures under load (HWiNFO64). Overheating causes erratic memory access patterns.
  • Test with one RAM stick at a time if you have dual-channel setup.

Step 9: Last Resort — Reset Windows 11

If BSOD persists even in Safe Mode and you've exhausted all other options:

  1. Go to Settings → System → Recovery → Reset this PC.
  2. Choose Keep my files (safer) or Remove everything.
  3. Select Cloud download for a clean OS image.

Always back up your data before resetting.

Frequently Asked Questions

powershell
# ============================================================
# IRQL_NOT_LESS_OR_EQUAL Diagnostic & Fix Script for Windows 11
# Run PowerShell as Administrator
# ============================================================

# 1. List the 5 most recent minidump files
Write-Host "`n[1] Recent Minidump Files:" -ForegroundColor Cyan
Get-ChildItem -Path "C:\Windows\Minidump" -Filter "*.dmp" -ErrorAction SilentlyContinue |
Sort-Object LastWriteTime -Descending | Select-Object -First 5 | Format-Table Name, LastWriteTime

# 2. Check for recent critical errors in System Event Log
Write-Host "`n[2] Recent Critical/Error Events (System Log, last 24h):" -ForegroundColor Cyan
$since = (Get-Date).AddHours(-24)
Get-WinEvent -FilterHashtable @{LogName='System'; Level=1,2; StartTime=$since} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, Id, Message | Format-List

# 3. Repair Windows component store (DISM)
Write-Host "`n[3] Running DISM RestoreHealth..." -ForegroundColor Cyan
DISM /Online /Cleanup-Image /RestoreHealth

# 4. Scan and repair system files (SFC)
Write-Host "`n[4] Running SFC scan..." -ForegroundColor Cyan
sfc /scannow

# 5. Reset TCP/IP stack (fixes tcpip.sys-related BSODs)
Write-Host "`n[5] Resetting TCP/IP and Winsock..." -ForegroundColor Cyan
netsh winsock reset
netsh int ip reset
netsh int ipv6 reset

# 6. Check RAM status via WMI
Write-Host "`n[6] RAM Module Info:" -ForegroundColor Cyan
Get-WmiObject Win32_PhysicalMemory | Select-Object BankLabel, Capacity, Speed, Manufacturer | Format-Table -AutoSize

# 7. List third-party kernel-mode drivers (potential IRQL culprits)
Write-Host "`n[7] Third-Party Kernel Drivers (non-Microsoft):" -ForegroundColor Cyan
Get-WmiObject Win32_SystemDriver | Where-Object { $_.PathName -notmatch 'Windows\\System32\\drivers\\' -and $_.State -eq 'Running' } |
Select-Object Name, DisplayName, PathName | Format-Table -AutoSize

# 8. Check disk health via SMART
Write-Host "`n[8] Disk SMART Status:" -ForegroundColor Cyan
Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus -ErrorAction SilentlyContinue |
Select-Object InstanceName, PredictFailure | Format-Table -AutoSize

# 9. List recently installed Windows updates (last 10)
Write-Host "`n[9] Recent Windows Updates:" -ForegroundColor Cyan
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, InstalledOn, Description

# 10. Schedule Windows Memory Diagnostic on next reboot
Write-Host "`n[10] Scheduling Memory Diagnostic on next restart..." -ForegroundColor Cyan
mdsched.exe

Write-Host "`nDiagnostics complete. Review output above and check C:\Windows\Logs\CBS\CBS.log for SFC details." -ForegroundColor Green
E

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems specialists with combined experience across enterprise IT environments, cloud infrastructure, and end-user computing. We research, test, and verify every fix against real hardware and virtual lab environments before publishing. Our guides are designed to be actionable, accurate, and beginner-accessible without sacrificing technical depth.

Sources

Related Articles in Windows 11 Irql_not_less_or_equal

Explore More windows Guides