What causes DRIVER_IRQL_NOT_LESS_OR_EQUAL (stop code 0x000000D1) on Windows 11?

DRIVER_IRQL_NOT_LESS_OR_EQUAL (0x000000D1) is specifically triggered when a kernel-mode driver — as opposed to the OS kernel itself — accesses pageable memory at an elevated IRQL. The most common culprits on Windows 11 are network adapter drivers (tcpip.sys, ndis.sys), GPU drivers (nvlddmkm.sys), and third-party security software. Check your minidump file in C:\Windows\Minidump to identify the exact driver named in the crash. Update or uninstall that driver to resolve the issue.

My BSOD says IRQL_NOT_LESS_OR_EQUAL and points to ntoskrnl.exe — what does that mean?

When ntoskrnl.exe is listed as the faulting module, it usually means the actual culprit driver couldn't be identified at the time of the crash, or the crash occurred deep within the kernel. This commonly points to: (1) faulty RAM — run Windows Memory Diagnostic or MemTest86 to confirm; (2) a driver that corrupted kernel memory before crashing; or (3) an incompatible Windows 11 update. Start with a full RAM test, then run SFC /scannow and DISM to repair system files, before investigating drivers.

How do I fix DRIVER_IRQL_NOT_LESS_OR_EQUAL caused by tcpip.sys on Windows 11?

tcpip.sys crashes are almost always network driver-related. To fix: (1) Open Device Manager → Network Adapters → right-click your NIC → Update driver. (2) If that fails, uninstall the network adapter driver completely and reinstall using the manufacturer's latest driver from their official website. (3) Disable Large Send Offload (LSO) in your adapter's Advanced properties — this setting is a known trigger. (4) If you use a VPN, temporarily uninstall it to test, as VPN TAP/TUN drivers inject into the networking stack and frequently conflict with tcpip.sys.

My Windows 11 PC keeps getting IRQL_NOT_LESS_OR_EQUAL after a Windows Update — how do I roll it back?

To roll back a Windows Update that introduced the BSOD: (1) Go to Settings → Windows Update → Update History → Uninstall Updates. (2) Find the most recently installed Quality Update and uninstall it. (3) Alternatively, boot into WinRE: hold Shift while clicking Restart → Troubleshoot → Advanced Options → Uninstall Updates. (4) To prevent the update from reinstalling, use the Microsoft Show or Hide Updates tool (wushowhide.diagcab) to block the specific KB article. Also check if a driver update was bundled with the Windows Update and roll back that driver in Device Manager.

Can bad RAM cause IRQL_NOT_LESS_OR_EQUAL errors and how do I test it?

Yes, defective RAM is one of the most common hardware causes of IRQL_NOT_LESS_OR_EQUAL on Windows 11, and it's often misattributed to ntoskrnl.exe. To test: (1) Run mdsched.exe (Windows Memory Diagnostic) for a quick 15-minute test. (2) For definitive results, create a MemTest86 bootable USB from memtest86.com and run at least 2 complete passes (4–8 hours). Any reported errors mean the RAM is defective. Try removing one stick at a time and testing with each individually to isolate the faulty module. Also try reseating all RAM sticks and clearing the BIOS XMP/EXPO overclock profile.

IRQL_NOT_LESS_OR_EQUAL Windows 11: Complete Fix Guide for BSOD Stop Code

Fix IRQL_NOT_LESS_OR_EQUAL BSOD on Windows 11. Step-by-step guide covering driver updates, memory checks, ntoskrnl.exe & tcpip.sys crashes. Resolve in minutes.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,253 words

Key Takeaways

Root Cause 1: A faulty, outdated, or incompatible kernel-mode driver (most commonly network drivers like tcpip.sys, or third-party antivirus/VPN drivers) attempts to access pageable memory at an elevated IRQL level, triggering the kernel panic.
Root Cause 2: Defective or improperly seated RAM causes memory access violations that the kernel misinterprets as IRQL violations — especially apparent in ntoskrnl.exe-attributed crashes.
Root Cause 3: Overclocked CPU or RAM running outside stable voltage/frequency parameters destabilizes kernel interrupt handling, producing sporadic IRQL_NOT_LESS_OR_EQUAL stop codes.
Quick Fix Summary: Update or roll back the offending driver identified in the minidump file, run Windows Memory Diagnostic to rule out RAM issues, disable overclocking in BIOS, and use Driver Verifier to isolate problematic kernel-mode drivers.

Fix Approaches Compared
Method	When to Use	Time	Risk
Update/Roll Back Offending Driver	Driver name visible in BSOD or minidump (e.g., tcpip.sys, nvlddmkm.sys)	5–15 min	Low
Windows Memory Diagnostic / MemTest86	Crash attributed to ntoskrnl.exe or random, no clear driver	30 min – 8 hrs	None
Driver Verifier	Multiple suspect drivers, crash happens intermittently	1–2 hrs setup + monitoring	Medium (can trigger more BSODs to isolate cause)
SFC & DISM System File Repair	System files corrupted after update or failed installation	20–40 min	Low
Disable Overclocking in BIOS	System is overclocked, crashes under load	5 min	None
Clean Boot / Selective Startup	Crash started after installing new software	15–30 min	None
Reinstall Windows 11	All other methods failed, hardware confirmed good	1–2 hrs	High (data loss if not backed up)

Understanding the IRQL_NOT_LESS_OR_EQUAL Error on Windows 11

The IRQL_NOT_LESS_OR_EQUAL stop code (Bug Check 0x0000000A) occurs when a kernel-mode process or driver attempts to access a memory address at an Interrupt Request Level (IRQL) that is too high. Windows uses IRQLs to prioritize hardware and software interrupts. If a driver tries to touch pageable memory while running at DISPATCH_LEVEL or above — when paging is not permitted — the kernel has no choice but to halt the system entirely to prevent data corruption.

On Windows 11, this error most frequently appears as:

IRQL_NOT_LESS_OR_EQUAL with stop code 0x0000000A
DRIVER_IRQL_NOT_LESS_OR_EQUAL with stop code 0x000000D1

The full BSOD message you'll see on screen reads:

Your PC ran into a problem and needs to restart.
Stop Code: IRQL_NOT_LESS_OR_EQUAL
What failed: [driver_name].sys

Common offending files include tcpip.sys (networking stack), ntoskrnl.exe (Windows kernel), nvlddmkm.sys (NVIDIA GPU driver), netio.sys, and third-party antivirus drivers.

Step 1: Identify the Failing Component via Minidump Analysis

Before applying any fix, identify what caused the crash. Windows writes a minidump file each time a BSOD occurs.

Locate your minidump files:

Press Win + R, type %SystemRoot%\Minidump, press Enter.
You should see .dmp files timestamped at each crash.

Analyze with WinDbg (Windows Debugger):

Install WinDbg from the Microsoft Store or via the Windows SDK.
Open WinDbg, go to File > Open Crash Dump, select the latest .dmp file.
In the command window, type: !analyze -v
Look for the MODULE_NAME, IMAGE_NAME, and FAULTING_MODULE fields.

Alternatively, use the free tool WhoCrashed or BlueScreenView from NirSoft to parse minidumps without needing WinDbg expertise.

Example WinDbg output indicating a network driver:

Bug Check 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL)
Probably caused by: tcpip.sys
FAULTING_MODULE: fffff80012a00000 tcpip

Example output indicating RAM or kernel issue:

Bug Check 0x0000000A (IRQL_NOT_LESS_OR_EQUAL)
Probably caused by: ntoskrnl.exe
FAULTING_MODULE: fffff80009e00000 nt

Step 2: Update or Roll Back the Offending Driver

This resolves the majority of IRQL_NOT_LESS_OR_EQUAL crashes on Windows 11.

If a specific driver (e.g., tcpip.sys) is identified:

For tcpip.sys (network driver issues):

Press Win + X → Device Manager.
Expand Network Adapters.
Right-click your adapter → Update driver → Search automatically.
If a recent Windows Update changed the driver, right-click → Properties → Driver tab → Roll Back Driver.

For GPU drivers (nvlddmkm.sys, atikmpag.sys):

Download Display Driver Uninstaller (DDU) from Wagnardsoft.
Boot into Safe Mode (Win + R → msconfig → Boot → Safe Boot → Minimal).
Run DDU to completely remove GPU drivers.
Download the latest stable driver from NVIDIA or AMD official site and install fresh.

For all drivers — force Windows Update scan: Open PowerShell as Administrator and run:

Get-WindowsUpdateLog
wuauclt /detectnow

Step 3: Run System File Checker and DISM

Corrupted Windows 11 system files can produce IRQL violations attributed to ntoskrnl.exe. Run these commands in sequence:

SFC (System File Checker): Replaces corrupted protected system files with cached copies.

DISM (Deployment Image Servicing and Management): Repairs the Windows component store that SFC draws from.

Always run DISM before SFC for best results. See the code block section for exact commands.

Step 4: Test Your RAM with Windows Memory Diagnostic

Defective RAM is a silent killer — it often produces IRQL crashes attributed to ntoskrnl.exe with no clear driver culprit.

Press Win + R, type mdsched.exe, press Enter.
Choose Restart now and check for problems.
Windows will run the diagnostic on next boot. Results appear in Event Viewer after login:
- Press Win + R → eventvwr.msc → Windows Logs → System → filter for source MemoryDiagnostics-Results.

For thorough testing, use MemTest86 (bootable USB tool) and run at least 2 full passes (4–8 hours). Any errors indicate faulty RAM that must be replaced.

If RAM errors are found:

Test sticks individually to isolate the faulty module.
Try reseating RAM in different slots.
Reset XMP/EXPO profile in BIOS to stock JEDEC speeds if overclocked.

Step 5: Disable Overclocking and Check BIOS Settings

Overclocking increases system instability at the kernel level. If your CPU or RAM runs above stock speeds:

Reboot and enter BIOS/UEFI (usually Del, F2, or F10 during POST).
Navigate to OC Settings or AI Tweaker (ASUS) / M-Flash (MSI).
Set all values to Auto or Default.
Disable XMP/EXPO profiles temporarily to test at base RAM speeds.
Save and reboot.

Step 6: Use Driver Verifier to Isolate Problematic Drivers

Driver Verifier forces drivers to operate under stress conditions, causing the buggy driver to crash immediately rather than randomly — making it easier to identify.

Warning: Driver Verifier can cause frequent BSODs during testing. Only use it on a system you can troubleshoot, and disable it after identifying the problem driver.

Press Win + R, type verifier, press Enter.
Select Create standard settings → Next.
Choose Automatically select unsigned drivers first; if none found, choose Automatically select drivers built for older versions of Windows.
Reboot. When the system crashes, analyze the new minidump — it will now clearly name the driver.
To disable Driver Verifier after testing: open verifier → Delete existing settings → Reboot.

Step 7: Clean Boot to Isolate Third-Party Software

VPN clients, antivirus software, and kernel-level gaming anti-cheat systems (Vanguard, EasyAntiCheat) commonly cause IRQL violations.

Press Win + R, type msconfig, press Enter.
Services tab → check Hide all Microsoft services → click Disable all.
Startup tab → click Open Task Manager → disable all startup items.
Reboot. If crashes stop, re-enable services in groups of 5 to identify the culprit.

Common culprits to disable and test individually:

Third-party antivirus (Avast, Bitdefender, Malwarebytes)
VPN kernel drivers (ExpressVPN, NordVPN TAP adapter)
Overclocking software (MSI Afterburner, HWiNFO)
Kernel-level anti-cheat software

Frequently Asked Questions

powershell

# ============================================================
# IRQL_NOT_LESS_OR_EQUAL Windows 11 - Diagnostic & Fix Script
# Run PowerShell as Administrator
# ============================================================

# --- STEP 1: Check for recent BSOD events in Event Log ---
Write-Host "[1] Retrieving recent critical system errors..." -ForegroundColor Cyan
Get-WinEvent -LogName System -MaxEvents 50 | Where-Object {$_.LevelDisplayName -eq 'Critical'} | Select-Object TimeCreated, Id, Message | Format-List

# --- STEP 2: List minidump files for WinDbg/BlueScreenView analysis ---
Write-Host "`n[2] Listing minidump files..." -ForegroundColor Cyan
$minidumpPath = "$env:SystemRoot\Minidump"
if (Test-Path $minidumpPath) {
    Get-ChildItem $minidumpPath -Filter *.dmp | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, @{N='SizeMB';E={[math]::Round($_.Length/1MB,2)}}
} else {
    Write-Warning "No minidump directory found. Ensure small memory dumps are enabled."
}

# --- STEP 3: Enable small memory dumps if not configured ---
Write-Host "`n[3] Configuring crash dump settings..." -ForegroundColor Cyan
$crashDumpKey = 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl'
Set-ItemProperty -Path $crashDumpKey -Name CrashDumpEnabled -Value 3    # 3 = small memory dump
Set-ItemProperty -Path $crashDumpKey -Name MinidumpsCount -Value 10
Set-ItemProperty -Path $crashDumpKey -Name AutoReboot -Value 1
Write-Host "Crash dump settings configured." -ForegroundColor Green

# --- STEP 4: Run DISM to repair Windows image ---
Write-Host "`n[4] Running DISM - Restore Health (this may take 10-20 minutes)..." -ForegroundColor Cyan
Dism.exe /Online /Cleanup-Image /RestoreHealth

# --- STEP 5: Run SFC to repair system files ---
Write-Host "`n[5] Running System File Checker..." -ForegroundColor Cyan
sfc /scannow

# --- STEP 6: Check driver status - list all non-Microsoft drivers ---
Write-Host "`n[6] Listing non-Microsoft (third-party) kernel drivers..." -ForegroundColor Cyan
Get-WmiObject Win32_SystemDriver | Where-Object {$_.PathName -notlike '*\Windows\*'} | Select-Object Name, PathName, State, Status | Format-Table -AutoSize

# --- STEP 7: Check for driver verifier status ---
Write-Host "`n[7] Current Driver Verifier settings:" -ForegroundColor Cyan
verifier /query

# --- STEP 8: Network adapter driver details (for tcpip.sys crashes) ---
Write-Host "`n[8] Network adapter driver information:" -ForegroundColor Cyan
Get-NetAdapter | Select-Object Name, InterfaceDescription, DriverName, DriverVersion, DriverDate, Status | Format-Table -AutoSize

# --- STEP 9: Check Windows Update history for recent driver updates ---
Write-Host "`n[9] Recent Windows Updates (last 10):" -ForegroundColor Cyan
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 | Format-Table HotFixID, Description, InstalledOn -AutoSize

# --- STEP 10: Check RAM slots and configuration ---
Write-Host "`n[10] RAM configuration:" -ForegroundColor Cyan
Get-WmiObject -Class Win32_PhysicalMemory | Select-Object BankLabel, DeviceLocator, @{N='CapacityGB';E={[math]::Round($_.Capacity/1GB,2)}}, Speed, Manufacturer, PartNumber | Format-Table -AutoSize

# --- STEP 11: Disable Driver Verifier (run this AFTER testing to restore stability) ---
# Uncomment the lines below ONLY after Driver Verifier testing is complete:
# Write-Host "`n[11] Disabling Driver Verifier..." -ForegroundColor Yellow
# verifier /reset
# Write-Host "Driver Verifier disabled. Reboot required." -ForegroundColor Green

Write-Host "`n=== Diagnostics Complete. Review output above and check minidump files. ==" -ForegroundColor Green
Write-Host "Next step: Open minidump files in WinDbg or BlueScreenView to identify the faulting driver." -ForegroundColor Yellow

Error Medic Editorial

The Error Medic Editorial team consists of senior DevOps engineers, SREs, and Windows systems specialists with 10+ years of experience diagnosing kernel panics, BSOD stop codes, and system-level failures across enterprise and consumer Windows environments. Our guides are tested on real hardware running Windows 10 and Windows 11, and we cross-reference official Microsoft documentation, driver release notes, and community-verified fixes to ensure accuracy. We specialize in translating cryptic error codes into clear, actionable troubleshooting steps that engineers and everyday users can follow.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.