Windows 11 Blue Screen of Death (BSOD) Fix: Stop Codes, Causes & Step-by-Step Solutions
Fix Windows 11 blue screen errors including KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT, CRITICAL_PROCESS_DIED & more. Step-by-step BSOD troubleshooting gui
- Most Windows 11 BSODs are caused by faulty or incompatible drivers (e.g., nvlddmkm.sys, amdkmdag.sys, ntoskrnl.exe), corrupted system files, or failing hardware (RAM, SSD/NVMe).
- Common stop codes include KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT, CRITICAL_PROCESS_DIED, SYSTEM_SERVICE_EXCEPTION, BAD_POOL_CALLER, IRQL_NOT_LESS_OR_EQUAL, and 0xC000021A.
- Quick fixes: run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' in an elevated PowerShell, update or roll back problematic drivers, run Windows Memory Diagnostic for RAM issues, and use BlueScreenView to identify the crashing module from minidump logs.
| Method | When to Use | Time | Risk |
|---|---|---|---|
| SFC + DISM System File Repair | Corrupted system files, ntfs.sys, ntoskrnl.exe BSODs | 15-30 min | Low |
| Driver Rollback / Update | After Windows 11 update, GPU/NIC driver BSODs (nvlddmkm.sys, amdkmdag.sys, netio.sys) | 10-20 min | Low |
| Windows Memory Diagnostic / MemTest86 | PFN_LIST_CORRUPT, MEMORY_MANAGEMENT, BAD_POOL_CALLER | 1-8 hours | Low |
| Startup Repair (WinRE) | Blue screen loop, BSOD on startup, 0xC000021A, INACCESSIBLE_BOOT_DEVICE | 10-20 min | Low |
| Check Disk (chkdsk) | NTFS_FILE_SYSTEM, stornvme.sys, disk-related BSODs | 20-60 min | Low-Medium |
| Uninstall Recent Windows Update | Blue screen after Windows 11 update (blue screen windows 11 update) | 10 min | Low |
| System Restore | Sudden BSODs after software or driver install | 20-40 min | Low-Medium |
| Clean Boot / Safe Mode Diagnosis | Random, intermittent, or gaming BSODs | 30-60 min | Low |
| BIOS/UEFI Firmware Update | ACPI_SYS, internal_power_error, hswultpep.sys, amifldrv64.sys BSODs | 15-30 min | Medium |
| Windows 11 Repair Install (In-Place Upgrade) | Persistent BSODs not fixed by other methods | 60-120 min | Medium |
| Full Windows 11 Reinstall | Hardware verified good but all else fails | 120+ min | High (data loss risk) |
Understanding Windows 11 Blue Screen Errors
A Blue Screen of Death (BSOD) — formally called a Stop Error or Bug Check — occurs when Windows 11 detects a fatal condition from which it cannot safely recover. The system halts completely, displays a blue screen with a stop code (e.g., KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT), and either restarts automatically or waits for user input.
In Windows 11, the BSOD screen displays:
- A sad face emoji (
:() - A brief description: e.g.,
Your PC ran into a problem and needs to restart. - A stop code: e.g.,
CRITICAL_PROCESS_DIED - A reference URL:
www.windows.com/stopcodeorwindows.com/stopcode - A QR code linking to Microsoft support
Note: Windows 11 Insider builds may show a Green Screen of Death instead of blue — this is functionally identical, just color-coded for Insider preview builds.
Step 1: Identify the Stop Code and Crashing Module
Before applying any fix, you must identify the exact stop code and, if possible, the driver or module that caused the crash.
Method A: Read the BSOD Screen
When a BSOD appears, note:
- Stop Code (e.g.,
SYSTEM_SERVICE_EXCEPTION) - Failed file if shown (e.g.,
nvlddmkm.sys,ntoskrnl.exe)
Method B: Read Minidump Logs with BlueScreenView
- Download BlueScreenView (bluescreenview) from NirSoft — free, no install needed.
- Run it after a crash. It reads
.dmpfiles fromC:\Windows\Minidump\. - The colored row indicates the driver/module that caused the crash.
- Note the Bug Check Code, Caused By Driver, and Caused By Address.
Method C: Read Event Viewer
- Press
Win + X→ Event Viewer. - Navigate to Windows Logs → System.
- Filter for Critical events with source
BugCheckorKernel-Power(Event ID 41). - The details pane shows the bug check code in hex.
Method D: Use WinDbg (Advanced)
For deep analysis, use Microsoft WinDbg Preview from the Microsoft Store to open .dmp files and run !analyze -v for detailed crash analysis.
Step 2: Fix by Stop Code Category
Category 1: Driver-Related BSODs
Stop codes: SYSTEM_SERVICE_EXCEPTION, IRQL_NOT_LESS_OR_EQUAL (0x000000D1), DRIVER_OVERRAN_STACK_BUFFER, APC_INDEX_MISMATCH, ATTEMPTED_WRITE_TO_READONLY_MEMORY, WDF_VIOLATION, BUGCODE_NDIS_DRIVER
Common culprit files: nvlddmkm.sys (NVIDIA GPU), amdkmdag.sys (AMD GPU), netio.sys, ndis.sys, tcpip.sys, fltmgr.sys, cldflt.sys, ntoskrnl.exe, win32kbase.sys, win32kfull.sys, dxgmms2.sys, btha2dp.sys, rtux64w10.sys, vgk.sys (Vanguard anti-cheat), klhk.sys (Kaspersky), qcamain10x64.sys
Fix steps:
- Boot into Safe Mode (hold Shift while clicking Restart → Troubleshoot → Advanced Options → Startup Settings → F4).
- Open Device Manager (
Win + X→ Device Manager). - Find the device associated with the crashing
.sysfile (e.g.,nvlddmkm.sys→ Display Adapters → NVIDIA). - Right-click → Update driver or Roll back driver.
- For GPU drivers: Uninstall completely using DDU (Display Driver Uninstaller) in Safe Mode, then reinstall the latest stable driver from the manufacturer's website.
- For anti-cheat or third-party drivers (
vgk.sys,klhk.sys): Uninstall the associated application.
Category 2: Memory and Pool Corruption BSODs
Stop codes: PFN_LIST_CORRUPT (0x0000004E), MEMORY_MANAGEMENT (blue screen memory management), BAD_POOL_CALLER, 0x0000003B
Fix steps:
- Run Windows Memory Diagnostic:
Win + R→mdsched.exe→ Restart now. - Run MemTest86 from a bootable USB for extended testing (minimum 2 passes).
- If RAM is faulty: reseat memory sticks, test individual sticks, or replace faulty RAM.
- Check XMP/EXPO profile in BIOS — disable it temporarily to test at stock RAM speeds.
- Run
sfc /scannowafter confirming RAM is good.
Category 3: System File and OS Corruption BSODs
Stop codes: CRITICAL_PROCESS_DIED, 0xC000021A (stop code 0xc000021a / 0xc00021a), NTFS_FILE_SYSTEM, INACCESSIBLE_BOOT_DEVICE
Fix steps:
- Boot from Windows 11 installation media if needed.
- Run SFC and DISM (see code block below).
- Run
chkdsk C: /f /r /xto check disk integrity. - If
INACCESSIBLE_BOOT_DEVICE: In WinRE, open Command Prompt and runbootrec /fixmbr,bootrec /fixboot,bootrec /rebuildbcd. - For
0xC000021A: This often indicates corrupted Winlogon or CSRSS. Use Startup Repair from WinRE → Troubleshoot → Advanced Options → Startup Repair.
Category 4: Windows Update-Triggered BSODs
Symptoms: Blue screen after Windows 11 update, blue screen windows 11 update 2022, blue screen loop after update.
Fix steps:
- Boot into WinRE → Troubleshoot → Advanced Options → Uninstall Updates → Uninstall latest quality update or feature update.
- Alternatively, in Settings → Windows Update → Update History → Uninstall Updates → remove the latest KB.
- Pause Windows Update temporarily while investigating the root cause.
Category 5: Hardware and BIOS-Related BSODs
Stop codes: ACPI_SYS (acpi sys blue screen), INTERNAL_POWER_ERROR, PDC_WATCHDOG_TIMEOUT, RDR_FILE_SYSTEM, SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD
Associated files: acpi.sys, hswultpep.sys, amifldrv64.sys, stornvme.sys
Fix steps:
- Update BIOS/UEFI firmware from your manufacturer's support page (Acer, Lenovo, ASUS, etc.).
- For Acer blue screen or Lenovo blue screen: Check manufacturer forums for known Windows 11 incompatibility patches.
- Reset BIOS to default settings (load optimized defaults).
- For
stornvme.sys: Update NVMe firmware and NVMe controller drivers from the SSD manufacturer. - Check for overheating: Use HWMonitor or Core Temp to verify CPU/GPU temperatures under load.
Category 6: Installation and VMware BSODs
Symptoms: Blue screen during Windows 11 install, blue screen while installing Windows 11, VMware blue screen Windows 11.
Fix steps:
- Verify TPM 2.0 and Secure Boot are enabled in BIOS (required for Windows 11).
- Disconnect non-essential USB devices during installation.
- Verify installation media integrity (re-download ISO, re-create USB with Rufus or Microsoft's Media Creation Tool).
- For VMware: Ensure virtual machine has TPM 2.0 enabled, and use VMware Workstation 16.2+ or VMware Workstation 17 for full Windows 11 guest support.
- Allocate at least 4 GB RAM to the VM; increase VM disk size to 64 GB+.
Step 3: Advanced Diagnostics
Driver Verifier (Use with Caution)
Driver Verifier stress-tests drivers to expose buggy ones. Only use this if you cannot identify the crashing driver:
- Run
verifierin an elevated command prompt. - Select "Create standard settings" → "Automatically select all drivers installed on this computer."
- Reboot. The system will BSOD faster if a driver is faulty, now with more detail.
- After identifying the driver, run
verifier /resetand reboot.
Check for Overclocking
Overclocking CPU, GPU, or RAM is a frequent hidden cause of random or gaming BSODs. Reset all overclocks to stock settings and test for stability.
Thermal Paste and Cooling
For laptops (Acer blue screen, Lenovo blue screen) experiencing INTERNAL_POWER_ERROR or random shutdown-type BSODs, overheating due to dried thermal paste can be the root cause. Reapply thermal compound if the device is older than 3-4 years.
Frequently Asked Questions
# ============================================================
# Windows 11 BSOD Diagnostic & Repair Script
# Run in an elevated PowerShell (Run as Administrator)
# ============================================================
# --- Step 1: Run System File Checker ---
Write-Host "[1/6] Running System File Checker (SFC)..." -ForegroundColor Cyan
sfc /scannow
# --- Step 2: Run DISM to repair Windows image ---
Write-Host "[2/6] Running DISM Health Restore..." -ForegroundColor Cyan
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
# --- Step 3: Check disk for errors (schedules on next reboot) ---
Write-Host "[3/6] Scheduling Check Disk on C: drive (runs on next reboot)..." -ForegroundColor Cyan
echo Y | chkdsk C: /f /r /x
# NOTE: You will be prompted to schedule; the check runs at next restart.
# --- Step 4: List recent crash dump files ---
Write-Host "[4/6] Recent Minidump Files (BSOD logs):" -ForegroundColor Cyan
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
Get-ChildItem -Path $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, @{Name="Size(KB)";Expression={[math]::Round($_.Length/1KB,1)}} | Format-Table -AutoSize
} else {
Write-Host "No minidump folder found. Ensure small memory dumps are enabled." -ForegroundColor Yellow
}
# --- Step 5: Check and enable small memory dumps for future BSODs ---
Write-Host "[5/6] Verifying crash dump settings..." -ForegroundColor Cyan
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"
$crashDumpValue = (Get-ItemProperty -Path $regPath).CrashDumpEnabled
Write-Host "Current CrashDumpEnabled value: $crashDumpValue (3 = Small memory dump / Minidump)"
if ($crashDumpValue -ne 3) {
Set-ItemProperty -Path $regPath -Name CrashDumpEnabled -Value 3
Set-ItemProperty -Path $regPath -Name MinidumpDir -Value "C:\Windows\Minidump"
Write-Host "Crash dump set to Small Memory Dump (Minidump). Restart required." -ForegroundColor Green
}
# --- Step 6: List recently installed drivers (potential BSOD culprits) ---
Write-Host "[6/6] Recently installed drivers (last 30 days):" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DriverDate -ne $null } | ForEach-Object {
try {
$driverDate = [Management.ManagementDateTimeConverter]::ToDateTime($_.DriverDate)
if ($driverDate -gt $cutoff) {
[PSCustomObject]@{
DeviceName = $_.DeviceName
DriverFile = $_.InfName
Version = $_.DriverVersion
InstalledOn = $driverDate.ToString("yyyy-MM-dd")
}
}
} catch {}
} | Sort-Object InstalledOn -Descending | Format-Table -AutoSize
# --- Bonus: Run Windows Memory Diagnostic (schedules reboot test) ---
# Uncomment the line below to schedule a RAM test on next reboot:
# mdsched.exe
# --- Bonus: Export System Event Log errors to Desktop ---
$exportPath = "$env:USERPROFILE\Desktop\SystemErrors_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
Get-EventLog -LogName System -EntryType Error -Newest 50 | Select-Object TimeGenerated, Source, EventID, Message | Export-Csv -Path $exportPath -NoTypeInformation
Write-Host "System error log exported to: $exportPath" -ForegroundColor Green
Write-Host "
=== BSOD Diagnosis Complete ===" -ForegroundColor Green
Write-Host "Next steps:"
Write-Host " 1. Review minidump files with BlueScreenView (https://www.nirsoft.net/utils/blue_screen_view.html)"
Write-Host " 2. If RAM issues found, run MemTest86 from bootable USB"
Write-Host " 3. Update or rollback drivers flagged by BlueScreenView"
Write-Host " 4. If BSODs persist after driver fixes, run an in-place Windows 11 repair install"
Error Medic Editorial
The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows system administrators with 10+ years of hands-on experience diagnosing and resolving OS-level failures across enterprise and consumer environments. Our guides are tested against real hardware and virtual machines running production Windows 11 builds. We specialize in translating cryptic stop codes and crash dumps into clear, actionable remediation steps.
Sources
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
- https://support.microsoft.com/en-us/windows/troubleshoot-blue-screen-errors-5c62a79a-5e67-a04a-5b63-3764e71f8c28
- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/driver-verifier
- https://www.nirsoft.net/utils/blue_screen_view.html
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sfc
- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image
- https://answers.microsoft.com/en-us/windows/forum/all/windows-11-blue-screen-stop-codes/
- https://learn.microsoft.com/en-us/windows/client-management/troubleshoot-stop-errors