Error Medic

Windows 11 Blue Screen of Death (BSOD) Fix: Stop Codes, Causes & Step-by-Step Solutions

Fix Windows 11 blue screen errors including KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT, CRITICAL_PROCESS_DIED & more. Step-by-step BSOD troubleshooting gui

Last updated:
Last verified:
2,364 words
Key Takeaways
  • Most Windows 11 BSODs are caused by faulty or incompatible drivers (e.g., nvlddmkm.sys, amdkmdag.sys, ntoskrnl.exe), corrupted system files, or failing hardware (RAM, SSD/NVMe).
  • Common stop codes include KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT, CRITICAL_PROCESS_DIED, SYSTEM_SERVICE_EXCEPTION, BAD_POOL_CALLER, IRQL_NOT_LESS_OR_EQUAL, and 0xC000021A.
  • Quick fixes: run 'sfc /scannow' and 'DISM /Online /Cleanup-Image /RestoreHealth' in an elevated PowerShell, update or roll back problematic drivers, run Windows Memory Diagnostic for RAM issues, and use BlueScreenView to identify the crashing module from minidump logs.
Windows 11 BSOD Fix Approaches Compared
MethodWhen to UseTimeRisk
SFC + DISM System File RepairCorrupted system files, ntfs.sys, ntoskrnl.exe BSODs15-30 minLow
Driver Rollback / UpdateAfter Windows 11 update, GPU/NIC driver BSODs (nvlddmkm.sys, amdkmdag.sys, netio.sys)10-20 minLow
Windows Memory Diagnostic / MemTest86PFN_LIST_CORRUPT, MEMORY_MANAGEMENT, BAD_POOL_CALLER1-8 hoursLow
Startup Repair (WinRE)Blue screen loop, BSOD on startup, 0xC000021A, INACCESSIBLE_BOOT_DEVICE10-20 minLow
Check Disk (chkdsk)NTFS_FILE_SYSTEM, stornvme.sys, disk-related BSODs20-60 minLow-Medium
Uninstall Recent Windows UpdateBlue screen after Windows 11 update (blue screen windows 11 update)10 minLow
System RestoreSudden BSODs after software or driver install20-40 minLow-Medium
Clean Boot / Safe Mode DiagnosisRandom, intermittent, or gaming BSODs30-60 minLow
BIOS/UEFI Firmware UpdateACPI_SYS, internal_power_error, hswultpep.sys, amifldrv64.sys BSODs15-30 minMedium
Windows 11 Repair Install (In-Place Upgrade)Persistent BSODs not fixed by other methods60-120 minMedium
Full Windows 11 ReinstallHardware verified good but all else fails120+ minHigh (data loss risk)

Understanding Windows 11 Blue Screen Errors

A Blue Screen of Death (BSOD) — formally called a Stop Error or Bug Check — occurs when Windows 11 detects a fatal condition from which it cannot safely recover. The system halts completely, displays a blue screen with a stop code (e.g., KERNEL_SECURITY_CHECK_FAILURE, PFN_LIST_CORRUPT), and either restarts automatically or waits for user input.

In Windows 11, the BSOD screen displays:

  • A sad face emoji (:()
  • A brief description: e.g., Your PC ran into a problem and needs to restart.
  • A stop code: e.g., CRITICAL_PROCESS_DIED
  • A reference URL: www.windows.com/stopcode or windows.com/stopcode
  • A QR code linking to Microsoft support

Note: Windows 11 Insider builds may show a Green Screen of Death instead of blue — this is functionally identical, just color-coded for Insider preview builds.


Step 1: Identify the Stop Code and Crashing Module

Before applying any fix, you must identify the exact stop code and, if possible, the driver or module that caused the crash.

Method A: Read the BSOD Screen

When a BSOD appears, note:

  • Stop Code (e.g., SYSTEM_SERVICE_EXCEPTION)
  • Failed file if shown (e.g., nvlddmkm.sys, ntoskrnl.exe)

Method B: Read Minidump Logs with BlueScreenView

  1. Download BlueScreenView (bluescreenview) from NirSoft — free, no install needed.
  2. Run it after a crash. It reads .dmp files from C:\Windows\Minidump\.
  3. The colored row indicates the driver/module that caused the crash.
  4. Note the Bug Check Code, Caused By Driver, and Caused By Address.

Method C: Read Event Viewer

  1. Press Win + XEvent Viewer.
  2. Navigate to Windows Logs → System.
  3. Filter for Critical events with source BugCheck or Kernel-Power (Event ID 41).
  4. The details pane shows the bug check code in hex.

Method D: Use WinDbg (Advanced)

For deep analysis, use Microsoft WinDbg Preview from the Microsoft Store to open .dmp files and run !analyze -v for detailed crash analysis.


Step 2: Fix by Stop Code Category

Category 1: Driver-Related BSODs

Stop codes: SYSTEM_SERVICE_EXCEPTION, IRQL_NOT_LESS_OR_EQUAL (0x000000D1), DRIVER_OVERRAN_STACK_BUFFER, APC_INDEX_MISMATCH, ATTEMPTED_WRITE_TO_READONLY_MEMORY, WDF_VIOLATION, BUGCODE_NDIS_DRIVER

Common culprit files: nvlddmkm.sys (NVIDIA GPU), amdkmdag.sys (AMD GPU), netio.sys, ndis.sys, tcpip.sys, fltmgr.sys, cldflt.sys, ntoskrnl.exe, win32kbase.sys, win32kfull.sys, dxgmms2.sys, btha2dp.sys, rtux64w10.sys, vgk.sys (Vanguard anti-cheat), klhk.sys (Kaspersky), qcamain10x64.sys

Fix steps:

  1. Boot into Safe Mode (hold Shift while clicking Restart → Troubleshoot → Advanced Options → Startup Settings → F4).
  2. Open Device Manager (Win + X → Device Manager).
  3. Find the device associated with the crashing .sys file (e.g., nvlddmkm.sys → Display Adapters → NVIDIA).
  4. Right-click → Update driver or Roll back driver.
  5. For GPU drivers: Uninstall completely using DDU (Display Driver Uninstaller) in Safe Mode, then reinstall the latest stable driver from the manufacturer's website.
  6. For anti-cheat or third-party drivers (vgk.sys, klhk.sys): Uninstall the associated application.

Category 2: Memory and Pool Corruption BSODs

Stop codes: PFN_LIST_CORRUPT (0x0000004E), MEMORY_MANAGEMENT (blue screen memory management), BAD_POOL_CALLER, 0x0000003B

Fix steps:

  1. Run Windows Memory Diagnostic: Win + Rmdsched.exe → Restart now.
  2. Run MemTest86 from a bootable USB for extended testing (minimum 2 passes).
  3. If RAM is faulty: reseat memory sticks, test individual sticks, or replace faulty RAM.
  4. Check XMP/EXPO profile in BIOS — disable it temporarily to test at stock RAM speeds.
  5. Run sfc /scannow after confirming RAM is good.

Category 3: System File and OS Corruption BSODs

Stop codes: CRITICAL_PROCESS_DIED, 0xC000021A (stop code 0xc000021a / 0xc00021a), NTFS_FILE_SYSTEM, INACCESSIBLE_BOOT_DEVICE

Fix steps:

  1. Boot from Windows 11 installation media if needed.
  2. Run SFC and DISM (see code block below).
  3. Run chkdsk C: /f /r /x to check disk integrity.
  4. If INACCESSIBLE_BOOT_DEVICE: In WinRE, open Command Prompt and run bootrec /fixmbr, bootrec /fixboot, bootrec /rebuildbcd.
  5. For 0xC000021A: This often indicates corrupted Winlogon or CSRSS. Use Startup Repair from WinRE → Troubleshoot → Advanced Options → Startup Repair.

Category 4: Windows Update-Triggered BSODs

Symptoms: Blue screen after Windows 11 update, blue screen windows 11 update 2022, blue screen loop after update.

Fix steps:

  1. Boot into WinRE → Troubleshoot → Advanced Options → Uninstall Updates → Uninstall latest quality update or feature update.
  2. Alternatively, in Settings → Windows Update → Update History → Uninstall Updates → remove the latest KB.
  3. Pause Windows Update temporarily while investigating the root cause.

Category 5: Hardware and BIOS-Related BSODs

Stop codes: ACPI_SYS (acpi sys blue screen), INTERNAL_POWER_ERROR, PDC_WATCHDOG_TIMEOUT, RDR_FILE_SYSTEM, SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD

Associated files: acpi.sys, hswultpep.sys, amifldrv64.sys, stornvme.sys

Fix steps:

  1. Update BIOS/UEFI firmware from your manufacturer's support page (Acer, Lenovo, ASUS, etc.).
  2. For Acer blue screen or Lenovo blue screen: Check manufacturer forums for known Windows 11 incompatibility patches.
  3. Reset BIOS to default settings (load optimized defaults).
  4. For stornvme.sys: Update NVMe firmware and NVMe controller drivers from the SSD manufacturer.
  5. Check for overheating: Use HWMonitor or Core Temp to verify CPU/GPU temperatures under load.

Category 6: Installation and VMware BSODs

Symptoms: Blue screen during Windows 11 install, blue screen while installing Windows 11, VMware blue screen Windows 11.

Fix steps:

  1. Verify TPM 2.0 and Secure Boot are enabled in BIOS (required for Windows 11).
  2. Disconnect non-essential USB devices during installation.
  3. Verify installation media integrity (re-download ISO, re-create USB with Rufus or Microsoft's Media Creation Tool).
  4. For VMware: Ensure virtual machine has TPM 2.0 enabled, and use VMware Workstation 16.2+ or VMware Workstation 17 for full Windows 11 guest support.
  5. Allocate at least 4 GB RAM to the VM; increase VM disk size to 64 GB+.

Step 3: Advanced Diagnostics

Driver Verifier (Use with Caution)

Driver Verifier stress-tests drivers to expose buggy ones. Only use this if you cannot identify the crashing driver:

  1. Run verifier in an elevated command prompt.
  2. Select "Create standard settings" → "Automatically select all drivers installed on this computer."
  3. Reboot. The system will BSOD faster if a driver is faulty, now with more detail.
  4. After identifying the driver, run verifier /reset and reboot.

Check for Overclocking

Overclocking CPU, GPU, or RAM is a frequent hidden cause of random or gaming BSODs. Reset all overclocks to stock settings and test for stability.

Thermal Paste and Cooling

For laptops (Acer blue screen, Lenovo blue screen) experiencing INTERNAL_POWER_ERROR or random shutdown-type BSODs, overheating due to dried thermal paste can be the root cause. Reapply thermal compound if the device is older than 3-4 years.

Frequently Asked Questions

powershell
# ============================================================
# Windows 11 BSOD Diagnostic & Repair Script
# Run in an elevated PowerShell (Run as Administrator)
# ============================================================

# --- Step 1: Run System File Checker ---
Write-Host "[1/6] Running System File Checker (SFC)..." -ForegroundColor Cyan
sfc /scannow

# --- Step 2: Run DISM to repair Windows image ---
Write-Host "[2/6] Running DISM Health Restore..." -ForegroundColor Cyan
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

# --- Step 3: Check disk for errors (schedules on next reboot) ---
Write-Host "[3/6] Scheduling Check Disk on C: drive (runs on next reboot)..." -ForegroundColor Cyan
echo Y | chkdsk C: /f /r /x
# NOTE: You will be prompted to schedule; the check runs at next restart.

# --- Step 4: List recent crash dump files ---
Write-Host "[4/6] Recent Minidump Files (BSOD logs):" -ForegroundColor Cyan
$dumpPath = "C:\Windows\Minidump"
if (Test-Path $dumpPath) {
    Get-ChildItem -Path $dumpPath -Filter "*.dmp" | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime, @{Name="Size(KB)";Expression={[math]::Round($_.Length/1KB,1)}} | Format-Table -AutoSize
} else {
    Write-Host "No minidump folder found. Ensure small memory dumps are enabled." -ForegroundColor Yellow
}

# --- Step 5: Check and enable small memory dumps for future BSODs ---
Write-Host "[5/6] Verifying crash dump settings..." -ForegroundColor Cyan
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl"
$crashDumpValue = (Get-ItemProperty -Path $regPath).CrashDumpEnabled
Write-Host "Current CrashDumpEnabled value: $crashDumpValue (3 = Small memory dump / Minidump)"
if ($crashDumpValue -ne 3) {
    Set-ItemProperty -Path $regPath -Name CrashDumpEnabled -Value 3
    Set-ItemProperty -Path $regPath -Name MinidumpDir -Value "C:\Windows\Minidump"
    Write-Host "Crash dump set to Small Memory Dump (Minidump). Restart required." -ForegroundColor Green
}

# --- Step 6: List recently installed drivers (potential BSOD culprits) ---
Write-Host "[6/6] Recently installed drivers (last 30 days):" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-30)
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DriverDate -ne $null } | ForEach-Object {
    try {
        $driverDate = [Management.ManagementDateTimeConverter]::ToDateTime($_.DriverDate)
        if ($driverDate -gt $cutoff) {
            [PSCustomObject]@{
                DeviceName  = $_.DeviceName
                DriverFile  = $_.InfName
                Version     = $_.DriverVersion
                InstalledOn = $driverDate.ToString("yyyy-MM-dd")
            }
        }
    } catch {}
} | Sort-Object InstalledOn -Descending | Format-Table -AutoSize

# --- Bonus: Run Windows Memory Diagnostic (schedules reboot test) ---
# Uncomment the line below to schedule a RAM test on next reboot:
# mdsched.exe

# --- Bonus: Export System Event Log errors to Desktop ---
$exportPath = "$env:USERPROFILE\Desktop\SystemErrors_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
Get-EventLog -LogName System -EntryType Error -Newest 50 | Select-Object TimeGenerated, Source, EventID, Message | Export-Csv -Path $exportPath -NoTypeInformation
Write-Host "System error log exported to: $exportPath" -ForegroundColor Green

Write-Host "
=== BSOD Diagnosis Complete ==="  -ForegroundColor Green
Write-Host "Next steps:"
Write-Host "  1. Review minidump files with BlueScreenView (https://www.nirsoft.net/utils/blue_screen_view.html)"
Write-Host "  2. If RAM issues found, run MemTest86 from bootable USB"
Write-Host "  3. Update or rollback drivers flagged by BlueScreenView"
Write-Host "  4. If BSODs persist after driver fixes, run an in-place Windows 11 repair install"
E

Error Medic Editorial

The Error Medic Editorial team is composed of senior DevOps engineers, SREs, and Windows system administrators with 10+ years of hands-on experience diagnosing and resolving OS-level failures across enterprise and consumer environments. Our guides are tested against real hardware and virtual machines running production Windows 11 builds. We specialize in translating cryptic stop codes and crash dumps into clear, actionable remediation steps.

Sources

Related Articles in Windows 11

Explore More windows Guides