Windows 11 Blue Screen (BSOD) Fix: Stop Codes, Causes & Step-by-Step Solutions
Fix Windows 11 blue screen errors including KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT, CRITICAL_PROCESS_DIED & more. Step-by-step diagnostic guide.
- Most Windows 11 BSODs are caused by faulty, outdated, or incompatible drivers — especially GPU drivers (nvlddmkm.sys, amdkmdag.sys) and storage drivers (stornvme.sys, ntfs.sys).
- Hardware issues such as failing RAM (PFN_LIST_CORRUPT, MEMORY_MANAGEMENT), corrupted system files (CRITICAL_PROCESS_DIED, 0xC000021A), and software conflicts from security tools (vgk.sys, klhk.sys) are the next most common root causes.
- Quick fixes include running 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' in an elevated command prompt, updating or rolling back the most recently changed driver, running Windows Memory Diagnostic for RAM errors, and using BlueScreenView to identify the exact crash module before attempting repairs.
| Method | When to Use | Time Required | Risk Level |
|---|---|---|---|
| sfc /scannow + DISM repair | Corrupted system files (CRITICAL_PROCESS_DIED, 0xC000021A) | 15–30 min | Low |
| Roll back or update driver | BSOD triggered after driver/update install (nvlddmkm.sys, amdkmdag.sys) | 10–20 min | Low |
| Windows Memory Diagnostic / MemTest86 | PFN_LIST_CORRUPT, MEMORY_MANAGEMENT, BAD_POOL_CALLER | 30 min–8 hrs | None |
| Uninstall recent Windows Update (Safe Mode) | Blue screen started after a Windows Update | 10–15 min | Low–Medium |
| Startup Repair (WinRE) | Blue screen loop preventing normal boot | 10–20 min | Low |
| System Restore | BSOD appeared after software or driver change | 20–40 min | Low–Medium |
| Clean boot (msconfig) | Frequent random BSOD, suspected third-party software conflict | 15–30 min | Low |
| In-place upgrade repair install | Persistent BSOD, multiple fixes failed | 1–2 hrs | Medium |
| Reinstall Windows 11 | All other methods failed, hardware confirmed good | 2–4 hrs | High (data loss risk) |
Understanding Windows 11 Blue Screen Errors (BSOD)
A Blue Screen of Death (BSOD) — officially called a Stop Error — occurs when Windows 11 encounters a critical fault it cannot recover from. The system forcibly halts to prevent data corruption and displays a stop code, a QR code linking to https://www.windows.com/stopcode, and optionally a failing .sys file name. In Windows 11 Insider and some retail builds, the screen may appear green instead of blue (Green Screen of Death), which is functionally identical.
Every BSOD writes a minidump file to C:\Windows\Minidump\ and logs an event in Windows Event Viewer under Windows Logs > System (Event ID 41, Kernel-Power for unexpected shutdowns, or BugCheck events). Capturing this information is the first step before attempting any fix.
Step 1: Identify Your Stop Code and Failing Module
Option A — Read the blue screen directly. The stop code appears in large text, e.g., KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT, CRITICAL_PROCESS_DIED, or as a hex code like 0x0000003B (SYSTEM_SERVICE_EXCEPTION), 0x0000004E (PFN_LIST_CORRUPT), 0x000000D1 (DRIVER_IRQL_NOT_LESS_OR_EQUAL), 0x00000133 (DPC_WATCHDOG_VIOLATION), 0xC000021A (STATUS_SYSTEM_PROCESS_TERMINATED).
Option B — Use BlueScreenView (BlueScreenView Windows 11). Download the free NirSoft BlueScreenView utility, run it, and it will automatically parse all minidump files in C:\Windows\Minidump\. The failing driver or module is highlighted in pink — this is the single most actionable piece of data you need. Common culprits include:
ntoskrnl.exe— core kernel issue, often RAM or driver-relatednvlddmkm.sys— NVIDIA GPU driver crashamdkmdag.sys— AMD GPU driver crashntfs.sys— file system corruptiontcpip.sys/netio.sys/ndis.sys— network stack faultstornvme.sys— NVMe storage driver faultvgk.sys— Valorant anti-cheat (VANGUARD) kernel driver conflictklhk.sys— Kaspersky security driveramifldrv64.sys— BIOS/UEFI firmware flashing driverdxgmms2.sys— DirectX GPU memory managerwin32kbase.sys/win32kfull.sys— Win32 kernel subsystemcldflt.sys— OneDrive cloud filter driverbtha2dp.sys— Bluetooth A2DP audio driverhswultpep.sys— Intel power management driver
Option C — Windows Event Viewer. Press Win + X, select Event Viewer, navigate to Windows Logs > System, and filter for Event ID 1001 (BugCheck) to see the stop code and parameters.
Step 2: Immediate Triage — Can You Boot?
If Windows 11 boots normally: Proceed to the software fixes below.
If stuck in a blue screen loop: Force the PC to power off three times in a row during boot. Windows will automatically enter Windows Recovery Environment (WinRE). From WinRE, select Troubleshoot > Advanced Options and choose Startup Repair, System Restore, or Command Prompt.
If the BSOD occurs during Windows 11 installation or upgrade: Boot from the Windows 11 installation media, disconnect all non-essential peripherals (USB hubs, external drives, secondary monitors), disable Secure Boot and TPM temporarily in UEFI if the error is 0xC000021A, and retry. Also ensure your storage controller driver (AHCI/NVMe) is not in IDE compatibility mode in BIOS.
Step 3: Fix System File Corruption
Open Command Prompt as Administrator and run the following commands in order:
sfc /scannow
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
After DISM completes, run sfc /scannow one more time to ensure all protected files are repaired. Reboot and check if the BSOD recurs. This addresses stop codes like CRITICAL_PROCESS_DIED, 0xC000021A, NTFS_FILE_SYSTEM, and SYSTEM_SERVICE_EXCEPTION.
Step 4: Update or Roll Back Drivers
The majority of Windows 11 BSODs trace to a specific driver. If your BSOD started after a Windows Update or a manual driver install:
- Press
Win + X> Device Manager. - Right-click the suspect device (Display adapter for nvlddmkm.sys/amdkmdag.sys, Network adapter for netio.sys/ndis.sys) > Properties > Driver tab.
- Click Roll Back Driver if available. If grayed out, download the previous driver version from the manufacturer's website and install it.
- Alternatively, use Display Driver Uninstaller (DDU) in Safe Mode to fully remove GPU drivers before reinstalling a stable version.
For amdkmdag.sys crashes, use AMD Cleanup Utility before reinstalling Adrenalin drivers. For nvlddmkm.sys, use DDU and install the NVIDIA Studio Driver rather than the Game Ready Driver for improved stability.
Step 5: Test RAM for Errors
PFN_LIST_CORRUPT, MEMORY_MANAGEMENT (0x0000001A), and BAD_POOL_CALLER (0x000000C2) strongly suggest faulty RAM.
- Windows Memory Diagnostic: Press
Win + R, typemdsched.exe, select Restart now and check for problems. Review results in Event Viewer (Event ID 1201 under System). - MemTest86: For thorough testing, create a bootable USB with MemTest86 and run at least two full passes. Any errors indicate a RAM slot or DIMM that needs replacement or reseating.
- Reseat RAM: Power off, remove and firmly reinsert RAM sticks. If you have two sticks, test each slot individually.
Step 6: Check Storage Health
NTFS_FILE_SYSTEM (ntfs.sys), INACCESSIBLE_BOOT_DEVICE, and stornvme.sys crashes can indicate storage degradation.
Run in elevated Command Prompt:
chkdsk C: /f /r /x
This schedules a disk check on next reboot. For NVMe/SSD drives, also check SMART data using CrystalDiskInfo. If the drive shows Caution or Bad status, back up immediately and replace.
Step 7: Address Specific Stop Codes
KERNEL_SECURITY_CHECK_FAILURE (Windows 11): Usually a driver incompatibility or corrupted driver. Run verifier /reset in CMD after using Driver Verifier to isolate the bad driver. Also check for BIOS/UEFI firmware updates, particularly on Acer, Lenovo, and HP laptops.
APC_INDEX_MISMATCH (Windows 11): Commonly caused by a display driver or audio driver mismatch. Update or reinstall the GPU driver and audio driver. On Lenovo devices, update the Lenovo Vantage and associated hardware drivers.
WDF_VIOLATION (Windows 11): Windows Driver Framework violation. Often caused by btha2dp.sys (Bluetooth) or a third-party driver. Update Bluetooth drivers or disable Bluetooth in Device Manager to confirm.
DRIVER_OVERRAN_STACK_BUFFER / ATTEMPTED_WRITE_TO_READONLY_MEMORY: Both indicate a driver writing to memory it shouldn't. Use Driver Verifier (verifier.exe) to identify the exact driver, then update or uninstall it.
PDC_WATCHDOG_TIMEOUT / INTERNAL_POWER_ERROR: Power management driver issue, commonly hswultpep.sys on Intel systems. Update Intel Management Engine Interface (MEI) drivers and chipset drivers from the manufacturer's support page.
BUGCODE_NDIS_DRIVER / RDR_FILE_SYSTEM: Network driver fault. Update your NIC drivers, and for RDR_FILE_SYSTEM, check SMB client settings and run netsh winsock reset.
0xC000021A (Windows 11) — Stop code 0xC000021A: This critical error means a user-mode subsystem (winlogon.exe or csrss.exe) has been fatally compromised. Fixes include: running SFC/DISM, booting into Safe Mode and uninstalling recent updates (Settings > Windows Update > Update History > Uninstall Updates), or using Startup Repair from WinRE.
Step 8: Uninstall Problematic Windows Updates
If the BSOD began after a Windows 11 update:
- Boot into Safe Mode (hold Shift while clicking Restart, or use WinRE).
- Go to Settings > Windows Update > Update History > Uninstall Updates.
- Uninstall the most recently installed cumulative update.
- Alternatively, in WinRE Command Prompt, use DISM to remove an update:
dism /image:C:\ /get-packagesto list packages, thendism /image:C:\ /remove-package /packagename:[PackageName].
Step 9: Clean Boot to Isolate Third-Party Software
Anti-cheat software (vgk.sys — Valorant Vanguard), antivirus kernel drivers (klhk.sys — Kaspersky), and VPN drivers frequently cause random BSODs in Windows 11.
- Press
Win + R, typemsconfig, go to Services tab. - Check Hide all Microsoft services, then click Disable all.
- Go to Startup tab > Open Task Manager, disable all startup items.
- Reboot. If BSOD stops, re-enable services in groups to identify the culprit.
Step 10: BIOS/UEFI Firmware Update and Settings Check
For persistent BSODs, especially on Acer, Lenovo, ASUS, or HP hardware:
- Visit the manufacturer's support site and install the latest UEFI/BIOS firmware.
- In BIOS, ensure XMP/EXPO RAM profiles are set to the rated speed (or disable XMP if unstable).
- Enable AHCI mode for SATA drives.
- Ensure Secure Boot and TPM 2.0 are enabled for Windows 11 compatibility.
Step 11: Last Resort — In-Place Repair Upgrade
If all above steps fail, perform an in-place upgrade repair without losing files:
- Download the Windows 11 ISO from Microsoft.
- Mount the ISO and run
setup.exe. - Choose Keep personal files and apps.
- Complete the upgrade — this reinstalls Windows system files while preserving your data and most apps.
Frequently Asked Questions
# ============================================================
# Windows 11 Blue Screen Diagnostic & Fix Script
# Run all commands in an elevated Command Prompt or PowerShell
# ============================================================
# --- STEP 1: Check and repair protected system files ---
sfc /scannow
# --- STEP 2: DISM - Repair Windows component store ---
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
# Run SFC again after DISM to catch any residual issues
sfc /scannow
# --- STEP 3: Schedule disk error check on next reboot ---
chkdsk C: /f /r /x
# --- STEP 4: Reset TCP/IP and Winsock stack (fixes netio.sys / tcpip.sys BSODs) ---
netsh int ip reset resetlog.txt
netsh winsock reset
ipconfig /flushdns
# --- STEP 5: View recent BugCheck events in Event Log (PowerShell) ---
# Run this in PowerShell as Administrator
Get-WinEvent -LogName System | Where-Object { $_.Id -eq 1001 -and $_.ProviderName -eq 'Microsoft-Windows-WER-SystemErrorReporting' } | Select-Object -First 10 | Format-List TimeCreated, Message
# --- STEP 6: List all minidump files with timestamps ---
Get-ChildItem -Path "C:\Windows\Minidump" -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, @{Name='SizeMB';Expression={[math]::Round($_.Length/1MB,2)}}
# --- STEP 7: Enable Driver Verifier to catch bad drivers (use cautiously, may cause BSOD on boot) ---
# Run in CMD as Administrator. This monitors all non-Microsoft drivers.
verifier /standard /all
# To reset Driver Verifier after identifying the driver:
verifier /reset
# --- STEP 8: Check RAM using Windows Memory Diagnostic (schedules on next reboot) ---
mdsched.exe
# --- STEP 9: Export System event log for offline analysis ---
wevtutil epl System C:\Logs\System_Events.evtx
# --- STEP 10: Check for pending Windows Updates via PowerShell ---
Install-Module PSWindowsUpdate -Force
Get-WindowsUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot
# --- STEP 11: Get list of installed drivers with version info (helps identify old drivers) ---
driverquery /v /fo csv > C:\Logs\drivers.csv
# --- STEP 12: Check SMART health for NVMe/SSD (requires NVMe management tools) ---
# Using built-in WMI:
Get-WmiObject -Namespace root\wmi -Class MSStorageDriver_FailurePredictStatus | Select-Object InstanceName, PredictFailure, Reason
# --- STEP 13: Uninstall a specific Windows Update by KB number (e.g., KB5031354) ---
wusa /uninstall /kb:5031354 /quiet /norestart
# --- STEP 14: Rebuild Boot Configuration Data (use in WinRE Command Prompt for boot loops) ---
bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd
# --- STEP 15: Run SFC offline (use in WinRE Command Prompt when Windows won't boot) ---
# Replace D: with the actual Windows partition drive letter as seen from WinRE
sfc /scannow /offbootdir=D:\ /offwindir=D:\WindowsError Medic Editorial
The Error Medic Editorial team consists of senior DevOps engineers, Microsoft Certified Solutions Experts (MCSE), and SRE professionals with a combined 40+ years of experience diagnosing Windows system errors, kernel crashes, and enterprise infrastructure incidents. Our guides are built from real-world incident postmortems, official Microsoft documentation, and community-validated troubleshooting workflows.
Sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
- https://support.microsoft.com/en-us/windows/troubleshoot-blue-screen-errors-5c62726c-6489-52da-a372-3f73142c14ad
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference
- https://www.nirsoft.net/utils/blue_screen_view.html
- https://stackoverflow.com/questions/tagged/bsod+windows-11
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg