Fix Windows 11 Blue Screen of Death

A blue screen of death — the full technical name is “stop error” — is Windows hitting a condition where it can’t safely continue running. Rather than risk data corruption or a security compromise, it halts everything. The blue screen itself usually lasts only a few seconds before the machine restarts automatically. For the bigger picture, our Complete Guide to Fixing Windows, Browser, and Software Errors pulls everything together.

The most important thing on the blue screen: the stop code (also called the bug check code). It’s the text in ALL CAPS that reads something like SYSTEM_THREAD_EXCEPTION_NOT_HANDLED or CRITICAL_PROCESS_DIED. This code is your primary diagnostic tool — it identifies which category of problem caused the crash. Write it down or photograph the screen.

Also note: does the blue screen happen once and then never recur? A single isolated BSOD after years of reliable operation is usually not worth deep investigation — it was likely a one-time hardware glitch, a cosmic ray flipping a memory bit, or a temporary power fluctuation. But recurring BSODs — multiple times per day or week — indicate a real, persistent problem that needs addressing.

Read the Stop Code First

Different stop codes point to completely different causes. Working through driver updates and SFC repairs when the BSOD is caused by RAM failure wastes significant time. The stop code narrows it down dramatically:

Fix 1: Check the Minidump File

Every blue screen writes a minidump file to C:WindowsMinidump. These files contain the exact state of the system at the moment of the crash — specifically, which driver was executing, what memory it was accessing, and why Windows halted. Reading the minidump is the single most effective diagnostic step because it often names the exact driver or component responsible.

The free WinDbg Preview from the Microsoft Store can open these files. After installing: File → Open crash dump → navigate to the minidump file → look for the “Probably caused by” line in the analysis output. This directly names the driver file (such as nvlddmkm.sys for NVIDIA, atikmpag.sys for AMD, or a third-party driver .sys file). With a specific driver named, you update, roll back, or reinstall that driver rather than working through everything generically.

If WinDbg is too complex: upload the minidump file to an online analysis tool (search “online minidump analyzer”) for a simpler report. The key output is the same — a probable cause named as a specific file.

Fix 2: Update or Roll Back Drivers

Drivers are the most common cause of recurring BSODs on otherwise healthy hardware. They run in kernel mode — the highest privilege level in Windows — and a bug in any driver can take down the entire system. GPU drivers and network adapter drivers cause BSODs more often than other device drivers because they’re updated frequently and the new versions sometimes introduce bugs.

If the minidump named a specific driver: update or roll back that specific driver. Don’t update everything randomly — targeted driver changes are easier to evaluate and reverse if they make things worse.

If you don’t have minidump data: check Device Manager for any yellow warning triangles (indicating driver problems) and check Windows Update history for recently installed driver updates. Roll back any driver updated around when the BSODs started: Device Manager → right-click the device → Properties → Driver → Roll Back Driver.

For GPU driver crashes (VIDEO_TDR_FAILURE or similar): use DDU (Display Driver Uninstaller) in Safe Mode for a complete driver removal before installing fresh. DDU removes registry remnants that standard uninstallation leaves behind and eliminates a category of driver conflicts that update-over-update creates.

Fix 3: Run Memory Tests

Faulty RAM causes BSODs across a wide range of stop codes — not just MEMORY_MANAGEMENT. The pattern of RAM-caused BSODs is that they appear truly random: different stop codes each time, different activities at the time of crash, no single driver consistently blamed in minidumps. That randomness is a signature of hardware-level memory errors.

Windows Memory Diagnostic: search in Start → Restart now and check for problems. Runs on next boot before Windows loads. Results appear in Event Viewer → Windows Logs → System → MemoryDiagnostics-Results after booting back in.

MemTest86 (more thorough, free): run from a USB drive, completely independent of Windows. Run for at least two complete passes — any errors confirm faulty RAM. Even a single error means the RAM is unreliable.

If RAM errors are found: try reseating the RAM sticks (remove, clean contacts, firmly reseat). If errors persist after reseating, try running with only one stick at a time — if errors disappear with one specific stick removed, that stick is faulty. Also try disabling XMP/EXPO in BIOS (RAM overclock profiles) and running at rated spec — XMP instability causes BSODs in exactly the random-pattern way described.

Fix 4: SFC and DISM for System File Corruption

Corrupted Windows system files cause BSODs when Windows tries to execute a damaged component during normal operation. This is more likely after interrupted updates, disk errors, or sudden power loss during a write operation. SFC and DISM repair the damage:

DISM /Online /Cleanup-Image /RestoreHealth

Run first (needs internet, 15–20 minutes). Then:

sfc /scannow

Run from an administrator Command Prompt. Restart after both complete. If SFC reports “found corrupt files and repaired them,” system file corruption was contributing to the crashes. Combined with a driver update, this pair of repairs resolves a significant proportion of BSODs on machines that have been running for a year or more.

Fix 5: Check Disk Health

A failing storage drive causes BSODs — particularly INACCESSIBLE_BOOT_DEVICE, PAGE_FAULT_IN_NONPAGED_AREA, and generic CRITICAL_PROCESS_DIED crashes that occur when Windows tries to read system files that the failing drive can’t deliver.

CrystalDiskInfo reads S.M.A.R.T. data from the drive: look for “Reallocated Sectors Count” (non-zero = sectors have failed and been replaced — indicates physical drive problems), “Pending Sectors” (read errors waiting to be reallocated), and overall health status showing “Caution” or “Bad.” Any of these indicate the drive needs attention — either immediate data backup and replacement, or at minimum close monitoring.

Fix 6: Temperature and Overclocking

WHEA_UNCORRECTABLE_ERROR specifically points at hardware-level faults that can include CPU overheating, power delivery instability, or CPU/RAM overclocking beyond stable limits. HWiNFO64 during a workload that triggers the BSOD shows temperatures at the moment of crash (indirectly — the machine restarts, but the maximum logged temperatures are informative).

If the machine is overclocked: disable all overclocking in BIOS (Load Optimized Defaults) and test for stability. If BSODs stop, the overclock was causing instability. Re-enabling and reducing the overclock incrementally finds the stable ceiling. Also disable XMP if RAM is running above spec — even XMP profiles from the RAM manufacturer sometimes push specific hardware configurations beyond their stable limits.

Fix 7: Safe Mode for Software Isolation

If BSODs happen during normal operation but not in Safe Mode (which loads minimal drivers and no third-party services), the cause is definitely a non-essential driver or service rather than Windows itself or hardware. Safe Mode access: hold Shift + Restart → Troubleshoot → Advanced options → Startup Settings → press 4 for Safe Mode.

After confirming stability in Safe Mode: boot normally and systematically disable startup programs (Task Manager → Startup apps) and third-party services (msconfig → Services → Hide all Microsoft services → disable non-Microsoft services one by one). Each change requires a restart and stability test. The service or startup program that — when disabled — eliminates the BSODs is the cause.

Using Reliability Monitor

Reliability Monitor (search “reliability history” or “view reliability history” in Start) plots crashes on a calendar, making it easy to see exactly when BSODs started and what software changes happened around the same time. Each crash shows the stop code, and each software installation or Windows Update appears on the same timeline — allowing you to visually correlate “first BSOD appears two days after [driver X] was installed.”

This timeline correlation is often more valuable than minidump analysis for identifying the cause, because it shows the sequence of changes that preceded the instability even when multiple changes happened around the same time.

Our guide on Windows 11 keeps freezing covers the freezes and hangs that share many causes with blue screens — RAM instability, driver crashes, and thermal issues produce both. For the boot-time BSODs where Windows blue screens during startup, our Windows 11 not booting guide covers the recovery environment approach for when Safe Mode is also inaccessible. Microsoft’s BSOD troubleshooting documentation covers the online analysis tool at microsoft.com/en-us/security/blog that can interpret stop codes and minidump data with more context than WinDbg alone provides.

Windows 11 Specific BSOD Causes

Windows 11 introduced several hardware requirements (TPM 2.0, Secure Boot, specific CPU generations) and architectural changes that create BSOD scenarios not present on Windows 10:

Virtualization-Based Security (VBS) and Memory Integrity: Windows 11 enables VBS by default, which runs Windows in a hypervisor. Some older drivers are incompatible with this virtualization layer and cause BSODs when loaded. Check Settings → Privacy and security → Windows Security → Device Security → Core isolation → Memory integrity. If Memory integrity is enabled and BSODs started after Windows 11 installation or upgrade, try disabling it. Windows will warn about drivers that can’t run with Memory integrity enabled — those drivers need updating before re-enabling the feature.

Secure Boot and BitLocker interactions: After BIOS updates or hardware changes, Secure Boot may prevent Windows from loading, producing a BSOD that looks like a driver or system corruption issue but is actually a secure boot measurement failure. If BitLocker is active, check whether a recovery key is being requested — this is a security feature, not a crash.

BSOD During Sleep and Wake

Blue screens specifically during sleep entry or wake from sleep are almost always driver-related. The GPU driver, network adapter driver, and USB controller drivers must handle power state transitions correctly — saving their state when entering sleep and restoring it on wake. Drivers with bugs in their power management code produce BSODs specifically at these transition moments.

The stop codes most common during sleep/wake: DPC_WATCHDOG_VIOLATION, DRIVER_POWER_STATE_FAILURE, and SYSTEM_THREAD_EXCEPTION_NOT_HANDLED. For DRIVER_POWER_STATE_FAILURE specifically: the minidump almost always names the driver that failed to transition correctly. Update that specific driver from the manufacturer’s website. For machines where sleep BSODs are frequent and the driver update doesn’t resolve them: disabling sleep entirely (Settings → System → Power → Screen and sleep → change to “Never” for sleep) prevents the crashes while the driver issue is investigated.

Automatic Repair and BSOD Loop

When BSODs occur during or immediately after startup — creating a loop where Windows blue screens, attempts repair, blue screens again — the machine is inaccessible through normal means. WinRE (Windows Recovery Environment) provides access to repair tools without requiring Windows to fully load.

Trigger WinRE: interrupt startup three times in a row (press the power button during the startup animation). On the third failure, Windows presents the recovery environment. From there: Troubleshoot → Advanced options → Command Prompt allows SFC and DISM offline, System Restore to a pre-BSOD date, or Startup Repair. If WinRE itself isn’t accessible, booting from a Windows 11 USB installation media and selecting “Repair your computer” provides the same tools.

Third-Party Security Software BSODs

Antivirus software, endpoint detection and response (EDR) tools, and VPN clients all install kernel-mode drivers to intercept system activity for protection. These kernel-mode drivers are a common BSOD source — particularly when the security software hasn’t been updated to match a recent Windows kernel version. The stop codes typically seen: SYSTEM_SERVICE_EXCEPTION, KERNEL_SECURITY_CHECK_FAILURE, or any code with the security software’s driver file named in the minidump.

After a major Windows update: check whether your antivirus or security software has released an update compatible with the new Windows kernel version. This is a well-known compatibility issue that antivirus vendors track closely, and updates typically arrive within days of a major Windows release. If a compatible update isn’t yet available, uninstalling the security software temporarily and reverting to Windows Defender prevents the BSODs while waiting for the vendor’s update.

When BSODs Correlate with Hardware Age

Machines that are 5–7+ years old and developing more frequent BSODs may be experiencing hardware that is reaching end of life. RAM errors increase with age (capacitors and memory cells degrade), storage drives accumulate bad sectors, and power supplies develop voltage stability issues that cause crashes under load. The BSODs aren’t software-fixable in these cases — they’re hardware symptoms.

The diagnostic approach: run MemTest86 for RAM health, CrystalDiskInfo for storage health, and a power supply stress test (utilities like OCCT include power supply tests that monitor voltage stability). Hardware that’s failing produces specific, identifiable results in these tests. Replacing the failing component — often just RAM sticks or the storage drive — resolves the BSODs without reinstalling Windows or replacing the entire machine. You might also run into Windows 11 Black Screen.