What does 'Stop Code: SYSTEM_SERVICE_EXCEPTION' mean in Windows 11?

The stop code SYSTEM_SERVICE_EXCEPTION (0x0000003B) means the Windows 11 kernel detected an exception — an unexpected error — during a system service call. This usually happens when a kernel-mode driver (such as a GPU, network, or antivirus driver) performs an illegal memory operation or crashes during execution. Windows cannot recover gracefully from kernel-mode exceptions, so it triggers the BSOD to prevent data corruption.

Why does Windows 11 keep getting a blue screen with SYSTEM_SERVICE_EXCEPTION after a Windows Update?

A Windows Update can push new driver versions that conflict with existing hardware or software on your system. If the BSOD started immediately after a cumulative update or driver update, open Device Manager and roll back recently updated drivers (especially GPU, network, and chipset drivers). You can also uninstall the problematic Windows Update via Settings → Windows Update → Update History → Uninstall Updates, then hide that update until a fix is available.

How do I fix SYSTEM_SERVICE_EXCEPTION BSOD in a Windows 11 VMware virtual machine?

In a VMware environment, this error is almost always caused by missing or outdated VMware Tools. Open the VMware application, go to VM → Install VMware Tools or Update VMware Tools, then run the installer inside the Windows 11 guest using the 'Complete' option and restart the VM. Also ensure your VMware Workstation or ESXi version is up to date, and consider switching the VM's network adapter to VMXNET3 if the issue persists after updating VMware Tools.

Which file is usually associated with the SYSTEM_SERVICE_EXCEPTION BSOD on Windows 11?

The faulting file varies by root cause. Common files include: nvlddmkm.sys (NVIDIA GPU driver), dxgmms2.sys (DirectX graphics subsystem), win32k.sys (Windows GUI — often triggered by antivirus or DRM software), ntoskrnl.exe (Windows kernel — often triggered by bad RAM or deep driver conflict), ksecdd.sys (Kernel Security — often triggered by VPN clients or network security software), and vmci.sys or vmhgfs.sys (VMware components). Analyzing the minidump file with WinDbg or WhoCrashed will identify the exact file on your system.

Can faulty RAM cause a SYSTEM_SERVICE_EXCEPTION blue screen on Windows 11?

Yes, defective or unstable RAM can cause SYSTEM_SERVICE_EXCEPTION errors, especially when the faulting module is ntoskrnl.exe or when you experience multiple different BSODs. Run Windows Memory Diagnostic (mdsched.exe) or the more thorough MemTest86 (bootable tool) to check for RAM errors. If errors are detected, reseat the RAM sticks, test each module individually, or replace the faulty module.

SYSTEM_SERVICE_EXCEPTION Blue Screen in Windows 11: Complete Fix Guide (Stop Code 0x0000003B)

Fix the SYSTEM_SERVICE_EXCEPTION BSOD on Windows 11. Step-by-step guide covering driver updates, SFC/DISM scans, VMware fixes, and memory diagnostics.

Last updated: March 1, 2026

Last verified: March 1, 2026

2,207 words

Key Takeaways

The SYSTEM_SERVICE_EXCEPTION (Stop Code 0x0000003B) BSOD is most commonly caused by a corrupt, outdated, or incompatible kernel-mode driver — graphics, network, and antivirus drivers are the top offenders.
Running System File Checker (SFC) and DISM can resolve corrupted Windows system files that trigger this exception during kernel-to-user mode transitions.
In VMware environments, the error is almost always caused by missing or outdated VMware Tools — installing the latest version of VMware Tools resolves it in most cases.
Quick fix summary: Boot into Safe Mode, identify the faulty driver using WinDbg or the minidump file, update or roll back the driver, run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth', then verify with a full Windows Memory Diagnostic scan.

Fix Approaches Compared
Method	When to Use	Time	Risk
Update/Roll Back Drivers	After a recent driver or Windows update caused the BSOD	10–20 min	Low
SFC + DISM System File Repair	When no specific driver is identified or system files are suspected corrupt	20–40 min	Very Low
Windows Memory Diagnostic	When RAM instability is suspected (random BSODs, multiple stop codes)	30–60 min	Very Low
Update VMware Tools	Windows 11 guest VM in VMware Workstation/ESXi showing this BSOD	5–15 min	Low
Clean Boot / Identify Conflicting Software	Third-party antivirus or security software is suspected	15–30 min	Low
System Restore or Reset	No driver/file fix works; system is unstable across multiple sessions	30–120 min	Medium
Analyze Minidump with WinDbg	Need to pinpoint the exact faulting module before acting	10–15 min	Very Low

Understanding the SYSTEM_SERVICE_EXCEPTION Error in Windows 11

The SYSTEM_SERVICE_EXCEPTION blue screen of death (BSOD) carries the stop code 0x0000003B and appears when a kernel-mode exception occurs during a system service call — essentially when a driver or system component running in kernel space crashes while transitioning to user mode. Windows 11 cannot safely recover from this state, so it halts the system, generates a minidump file, and displays the blue screen.

The exact text you see on screen reads:

Your PC ran into a problem and needs to restart.
Stop Code: SYSTEM_SERVICE_EXCEPTION

Sometimes a faulting file is listed beneath the stop code, such as win32k.sys, ntoskrnl.exe, dxgmms2.sys, nvlddmkm.sys, or ksecdd.sys. That filename is your first clue.

Step 1: Boot Into Safe Mode (If the System Loops)

If Windows 11 continuously reboots into the BSOD, you must first get to a stable state.

Force three consecutive hard shutdowns (hold power button until screen goes dark) during the Windows boot animation. On the third attempt, Windows enters Windows Recovery Environment (WinRE).
Navigate to Troubleshoot → Advanced Options → Startup Settings → Restart.
Press F4 to boot into Safe Mode or F5 for Safe Mode with Networking.

Once in Safe Mode, only essential drivers load. If the BSOD stops in Safe Mode, a third-party driver or startup application is almost certainly responsible.

Step 2: Locate and Analyze the Minidump File

Windows writes a minidump to C:\Windows\Minidump\ after every BSOD. This is the most reliable way to identify the faulting driver.

Option A — Use WinDbg Preview (Recommended)

Install WinDbg Preview from the Microsoft Store.
Open WinDbg → File → Open Crash Dump → navigate to C:\Windows\Minidump\ and open the most recent .dmp file.
In the command window, type: !analyze -v
Look for the FAULTING_MODULE and IMAGE_NAME lines. They will identify the exact driver or system file responsible.

Option B — Use WhoCrashed (Simpler UI)

Download WhoCrashed from Resplendence Software. It automatically parses all minidump files and presents a human-readable report identifying the faulting driver.

Common faulting modules and their meaning:

nvlddmkm.sys → NVIDIA display driver
dxgmms2.sys → DirectX graphics kernel
win32k.sys → Windows GUI subsystem (often antivirus or DRM conflict)
ntoskrnl.exe → Windows kernel itself (RAM, hardware, or deep driver conflict)
vmci.sys / vmhgfs.sys → VMware components
ksecdd.sys → Kernel Security Support Provider (often network driver or VPN)

Step 3: Update or Roll Back the Faulting Driver

If a specific driver is identified:

Press Win + X → Device Manager.
Locate the device associated with the faulting .sys file (e.g., for nvlddmkm.sys → Display Adapters → NVIDIA GPU).
Right-click → Update Driver → Search automatically for drivers.
If the BSOD started after a recent driver update, right-click → Properties → Driver tab → Roll Back Driver.

For NVIDIA GPU drivers specifically, use DDU (Display Driver Uninstaller) in Safe Mode to perform a clean removal, then install the latest WHQL-certified driver from nvidia.com.

For network adapters, go to Device Manager → Network Adapters, update the driver for your Ethernet or Wi-Fi adapter.

Step 4: Run SFC and DISM to Repair System Files

Corrupt Windows system files can cause win32k.sys or ntoskrnl.exe exceptions. Open an elevated Command Prompt (Run as Administrator) and run the following commands in sequence:

sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

After DISM completes, run sfc /scannow one more time. Restart the system when finished.

Step 5: Fix SYSTEM_SERVICE_EXCEPTION in VMware (Windows 11 Guest)

If you are running Windows 11 as a virtual machine inside VMware Workstation, VMware Player, or VMware ESXi, this BSOD is almost always caused by outdated or missing VMware Tools.

To fix:

In VMware menu → VM → Install VMware Tools (or Update VMware Tools).
Inside the Windows 11 guest, run the VMware Tools installer from the mounted virtual CD drive.
Select Complete installation type and restart the VM.

Additionally, ensure your VMware Workstation or ESXi host is updated to the latest version, and that the VM hardware compatibility level matches your host version.

If VMware Tools is already current, check for conflicting virtual hardware:

Change the VM's network adapter from E1000 to VMXNET3.
Change the storage controller from IDE to PVSCSI for better driver compatibility.

Step 6: Run Windows Memory Diagnostic

Faulty RAM is a less common but serious cause of 0x0000003B crashes. Run the built-in memory test:

Press Win + R → type mdsched.exe → Enter.
Select Restart now and check for problems.
Windows restarts and runs the memory test (takes 20–60 minutes).
Results appear in Event Viewer after reboot: Win + X → Event Viewer → Windows Logs → System → filter for source MemoryDiagnostics-Results.

If errors are found, reseat your RAM sticks, test each stick individually, or replace the faulty module.

Step 7: Disable or Replace Conflicting Security Software

Third-party antivirus, endpoint detection tools, and VPN clients install kernel-mode drivers that frequently cause SYSTEM_SERVICE_EXCEPTION. If win32k.sys or ksecdd.sys appears in your minidump:

Boot into Safe Mode.
Uninstall third-party antivirus (Avast, AVG, Kaspersky, McAfee, etc.) using the vendor's dedicated removal tool.
Restart normally and monitor for BSOD recurrence.
If stable, reinstall a fresh copy or switch to Microsoft Defender.

Step 8: Check for Windows Updates

Microsoft periodically releases cumulative updates that patch known BSOD-causing bugs:

Settings → Windows Update → Check for updates.
Install all pending updates, including optional driver updates listed under Advanced Options → Optional Updates.
Restart and monitor.

Step 9: Perform a System Restore or Reset

If none of the above steps resolve the issue:

System Restore: Control Panel → Recovery → Open System Restore → choose a restore point dated before the crashes began.

Reset Windows 11 (Keep Files): Settings → System → Recovery → Reset this PC → Keep my files. This reinstalls Windows while preserving personal data but removes installed applications.

Additional VMware-Specific Notes

For enterprise VMware ESXi environments, also verify:

The VM's guest OS setting is configured as Windows 11 (64-bit) and not a legacy Windows version.
Secure Boot is enabled in the VM firmware settings if required by your OS configuration.
The vmci.sys driver version matches the installed VMware Tools version by checking Get-WmiObject -Class Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like '*VMCI*'} in PowerShell.

Frequently Asked Questions

powershell

# ============================================================
# Windows 11 SYSTEM_SERVICE_EXCEPTION Diagnostic & Fix Script
# Run PowerShell as Administrator
# ============================================================

# --- 1. List recent minidump files ---
Write-Host "=== Recent Minidump Files ==="
$minidumpPath = "C:\Windows\Minidump"
if (Test-Path $minidumpPath) {
    Get-ChildItem -Path $minidumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object -First 5 Name, LastWriteTime, @{Name='Size(KB)';Expression={[math]::Round($_.Length/1KB,1)}}
} else {
    Write-Host "No minidump directory found. Enable small memory dumps via: System Properties > Advanced > Startup and Recovery."
}

# --- 2. Check Windows Event Log for BSOD events ---
Write-Host "`n=== BugCheck Events (Last 10) ==="
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 10 | Select-Object TimeCreated, Message | Format-List

# --- 3. Run System File Checker ---
Write-Host "`n=== Running SFC (System File Checker) ==="
sfc /scannow

# --- 4. Run DISM to repair Windows image ---
Write-Host "`n=== Running DISM RestoreHealth ==="
DISM /Online /Cleanup-Image /RestoreHealth

# --- 5. Check for driver signing violations ---
Write-Host "`n=== Unsigned or Problematic Drivers ==="
Get-WmiObject -Class Win32_PnPSignedDriver | Where-Object { $_.IsSigned -eq $false } | Select-Object DeviceName, DriverVersion, Manufacturer | Format-Table -AutoSize

# --- 6. List recently installed drivers (last 30 days) ---
Write-Host "`n=== Drivers Installed or Updated in Last 30 Days ==="
$cutoff = (Get-Date).AddDays(-30)
Get-WmiObject -Class Win32_PnPSignedDriver | Where-Object { $_.DriverDate -ne $null } | ForEach-Object {
    $driverDate = [System.Management.ManagementDateTimeConverter]::ToDateTime($_.DriverDate)
    if ($driverDate -gt $cutoff) {
        [PSCustomObject]@{
            DeviceName    = $_.DeviceName
            DriverVersion = $_.DriverVersion
            DriverDate    = $driverDate
            Manufacturer  = $_.Manufacturer
        }
    }
} | Sort-Object DriverDate -Descending | Format-Table -AutoSize

# --- 7. Check VMware Tools status (if in a VM) ---
Write-Host "`n=== VMware Tools Status ==="
$vmwareService = Get-Service -Name 'VMTools' -ErrorAction SilentlyContinue
if ($vmwareService) {
    Write-Host "VMware Tools service status: $($vmwareService.Status)"
    $vmtoolsReg = Get-ItemProperty -Path 'HKLM:\SOFTWARE\VMware, Inc.\VMware Tools' -ErrorAction SilentlyContinue
    if ($vmtoolsReg) { Write-Host "VMware Tools version: $($vmtoolsReg.InstallPath)" }
} else {
    Write-Host "VMware Tools service not found (not a VMware VM or Tools not installed)."
}

# --- 8. Trigger Windows Memory Diagnostic (scheduled for next reboot) ---
Write-Host "`n=== Scheduling Windows Memory Diagnostic ==="
$response = Read-Host "Do you want to schedule a memory diagnostic on next reboot? (y/n)"
if ($response -eq 'y') {
    Start-Process -FilePath 'mdsched.exe' -ArgumentList '/f' -Wait
    Write-Host "Memory diagnostic scheduled. Restart the computer to run it."
}

# --- 9. Check pending Windows Updates ---
Write-Host "`n=== Checking Windows Update Status ==="
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn, Description | Format-Table -AutoSize

Write-Host "`n=== Diagnostic Complete. Review output above and check minidump files with WinDbg or WhoCrashed. ==="

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows systems specialists with 10+ years of experience diagnosing kernel-level failures, BSOD events, and enterprise infrastructure issues. Our guides are built from real-world incident postmortems, official Microsoft documentation, and community-validated fixes.

Sources

Explore More windows Guides

Acer Aspire Blue Screen of Death Fix: How to Stop BSOD Crashes on Acer Laptops

Fix Acer Aspire Blue Screen of Death errors fast. Step-by-step guide covering driver updates, RAM checks, overheating, and Windows repair commands.

Acer Aspire Blue Screen of Death Fix: Step-by-Step Troubleshooting Guide (BSOD Errors Solved)

Fix Acer Aspire blue screen of death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK and more. Step-by-step commands included.

Acer Aspire Blue Screen of Death Fix: Stop Codes, Causes & Complete Solutions

Fix Acer Aspire Blue Screen of Death errors fast. Covers MEMORY_MANAGEMENT, DRIVER_IRQL, KERNEL_SECURITY_CHECK_FAILURE & more with exact commands.