Fix Blue Screen Errors — Windows 11 BSOD Troubleshooting

Three calls in one afternoon last week. All blue screens. All Windows 11.

The first one — a freelance translator working against a deadline — had been crashing every 45 minutes since the previous evening. IRQL_NOT_LESS_OR_EQUAL, which is Windows-speak for “a driver touched memory it wasn’t supposed to.” The second was worse: a marketing agency’s shared workstation caught in a boot loop, hitting CRITICAL_PROCESS_DIED before it could even display the login screen. And the third guy called because Photoshop specifically triggered a blue screen every time he opened a large PSD file. SYSTEM_SERVICE_EXCEPTION. He’d tried reinstalling Photoshop twice already.

All three machines had one thing in common. They’d all automatically installed the KB5058405 cumulative update the night before.

Rolled back that single update on each machine. All three stabilized. Forty minutes total to fix all of them, including the time I spent on hold waiting for the second client to pick up the phone.

Here’s why I’m starting with this: people see that sad-face emoji on a blue background and immediately assume their computer is dying. Their hard drive is failing. Their motherboard is fried. They need a new machine. Almost never true. Microsoft’s Hardware Dev Center puts the number at 70% of BSOD errors being caused by third-party driver issues. Not hardware. Software. A driver did something dumb, Windows crashed deliberately to protect your files, and undoing whatever the driver did usually fixes it.

The trick, of course, is figuring out which driver. That’s the detective work part.

:(

Your PC ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you.

For more information about this issue and possible fixes, visit
https://www.windows.com/stopcode

Stop code: IRQL_NOT_LESS_OR_EQUAL

What failed: nvlddmkm.sys

67% complete

That STOP Code on the Blue Screen — What It Actually Means

Pull out your phone, snap a picture of the blue screen before the reboot happens. You want the all-caps text near the bottom — stuff like IRQL_NOT_LESS_OR_EQUAL, MEMORY_MANAGEMENT, whatever yours says. There’s sometimes a hex code underneath too (0x0000000A or similar). Don’t worry about the hex part. The English name tells you more.

I’ve got a beat-up sticky note on my second monitor with these codes ranked by how often I see them. Figured I’d just share it here:

IRQL_NOT_LESS_OR_EQUAL. The king of BSOD errors in my experience. Some driver — almost always a network adapter or a GPU driver — tried to read memory it wasn’t supposed to. Roll the driver back or update it. I’d guess this one accounts for a quarter of all the BSOD tickets we close at RebootDoctor. Maybe more.

MEMORY_MANAGEMENT. Ah, the ambiguous one. Could mean your RAM is physically dying. Could also mean a driver is leaking memory like a broken faucet. One client in April had already ordered replacement DDR4 from Crucial ($47 plus shipping) before he contacted us. We poked around for fifteen minutes, discovered his Realtek audio driver was the issue. Free fix. He sent the RAM back.

CRITICAL_PROCESS_DIED. Something critical in Windows itself crashed — a system process, a core service. File corruption is the usual suspect, but twice this year I traced it back to antivirus software. Avast and McAfee both love to interfere with Windows processes they think look suspicious. Sometimes they’re wrong, and then everything breaks.

SYSTEM_SERVICE_EXCEPTION. Close relative of IRQL_NOT_LESS_OR_EQUAL. GPU drivers are behind this one more often than not. Remember my third client from the intro — the Photoshop guy? This was his STOP code.

KERNEL_SECURITY_CHECK_FAILURE. Kernel memory got corrupted somehow. If you overclock your CPU or RAM and you see this error — well, you probably already know what I’m about to say. Reset your XMP profile and BIOS tweaks to defaults. Test from there.

DPC_WATCHDOG_VIOLATION. A driver didn’t respond fast enough and Windows pulled the plug. Certain Samsung 870 EVO and Intel 670p SSDs had buggy firmware that caused this reliably throughout late 2024. Samsung patched theirs relatively quickly. Intel took their sweet time.

WHEA_UNCORRECTABLE_ERROR. I don’t like seeing this one. It’s a hardware-level error report — the CPU or chipset told Windows “something went wrong and I couldn’t fix it on my own.” Could be overheating (check that first, it’s the easiest to rule out), could be a genuinely failing processor or motherboard. More about this one later in the article.

Not everyone catches the STOP code in time. The machine reboots too fast, or you were grabbing lunch when it happened. Doesn’t matter — Windows logs every crash automatically.

Reading Your Crash Dumps (This Is Where You Actually Solve It)

Most people don’t know this, but Windows keeps a record of every single crash. A small file gets written to C:\Windows\Minidump\ each time — basically a photograph of what was happening in memory at the exact moment everything went wrong. Which driver was active. Which memory address it touched. Why the system gave up.

Reading those files used to require a computer science degree and a copy of Microsoft’s WinDbg. Not anymore.

BlueScreenView by NirSoft made the whole process trivial. Download it (the zip is like 80KB — barely anything), extract it anywhere, double-click. No installer. It finds your crash dumps automatically and shows you, in a nice table with red highlights, which driver was responsible for each crash.

Open it up, and the “Caused By Driver” column is where you look. If you see nvlddmkm.sys showing up across three different crash dumps from the last week — that’s NVIDIA’s display driver, and it’s your problem. If it says Rt640x64.sys, that’s Realtek’s network adapter driver. tcpip.sys is Windows networking. ntfs.sys is the file system driver and usually points at disk problems rather than driver bugs.

Google the .sys filename if you don’t recognize it. First result will tell you what hardware or software owns that file. Then either update that driver or roll it back to the version before things broke.

Why not WinDbg, Microsoft’s official debugger? Because WinDbg was built for kernel developers who already know what !analyze -v means and can read stack traces in their sleep. BlueScreenView just shows you the driver name in a table. For figuring out “what crashed my PC,” that’s all you need. I’ve been doing this professionally for years and I open WinDbg maybe once a month. BlueScreenView handles the rest.

Getting Into Safe Mode When the Machine Won’t Stop Crashing

So your PC is stuck in a crash loop. Can’t get to the desktop. Can’t log in. Can’t do anything except watch that sad face appear, reboot, and repeat.

You need Safe Mode, but here’s the annoying part — Windows 11 boots so fast on an NVMe SSD that the old “mash F8 during startup” trick is basically impossible. The boot process is measured in milliseconds now. You physically cannot press the key fast enough.

What actually works: force Windows into recovery mode by causing three consecutive failed boots. Sounds reckless. I promise it isn’t.

Power on, wait until you see the Dell/HP/ASUS logo or the spinning dots, then hold the power button down for a solid five count. Machine dies mid-boot. Do it again — power on, wait for logo, hold power. One more time. By the fourth attempt, Windows catches on and throws you into Automatic Repair instead of the normal boot sequence. Microsoft engineered this exact behavior on purpose — WinRE (the recovery partition) kicks in after three consecutive boot failures.

From Automatic Repair, you need to drill through a slightly annoying menu chain: Advanced Options → Troubleshoot → Advanced Options (yes they labeled two different menus the same thing, don’t ask me why) → Startup Settings → Restart. Then press 4 on the numbered list for Safe Mode, or 5 if you’ll need to download drivers.

I know it feels wrong to deliberately crash your PC three times. Every client I’ve walked through this over the phone hesitates at step two. But WinRE lives on a completely separate partition from your Windows installation — it doesn’t care what’s broken on C:.

Now, if the machine isn’t even reaching the Windows logo — no display output at all, or it just won’t turn on — that’s hardware, not a driver problem, and you’re in different territory entirely.

Hunting Down the Bad Driver

At this point you’ve either made it into Safe Mode, or your PC boots normally most days and just crashes every few hours. Either way, we’re going driver hunting.

Device Manager Is Your Starting Point

Open it by right-clicking the Start button. Scroll through the device list looking for yellow warning triangles — those are devices where Windows already knows the driver is busted. Found one? Right-click, Properties, Driver tab.

If the crashing started right after you installed a driver update, there’s a Roll Back Driver button sitting right there. One click reverts to whatever version was working before. Restart. That’s potentially your entire fix.

If the driver hasn’t been updated in ages and you suspect it’s just old and crusty, you need a newer version. But please, please do not use the “Search automatically for drivers” button inside Device Manager. I know it’s right there and it seems like the obvious thing to click. Microsoft’s catalog is perpetually behind what actual hardware companies ship — in January 2026 I watched it suggest a Realtek driver from March 2025 when Realtek had already pushed two critical patches since then. Worthless.

Go to the manufacturer’s own site instead. For NVIDIA GPUs, nvidia.com/drivers — you pick your exact card model and OS version. AMD has amd.com/support with a similar setup. Intel’s Driver & Support Assistant auto-detects your Intel hardware and finds the right package, which is actually pretty good. Now, Realtek — and this is a personal gripe I’ll rant about for a second — Realtek’s own website is a mess. Their generic audio and network drivers frequently conflict with OEM customizations. You’re better off going to your laptop manufacturer’s support page (Dell, HP, Lenovo, ASUS, whatever brand built your machine) and downloading the Realtek driver that was tested specifically for your model.

GPU Drivers — The Single Biggest BSOD Source for Anyone Who Games

If you play games on your PC, pay extra attention here. Our internal numbers at RebootDoctor show GPU drivers behind somewhere around 40% of gaming-related BSODs — and that’s a conservative estimate because I stopped tracking the exact percentage a while back. Graphics drivers are uniquely dangerous because they operate in kernel mode (the same privilege level as the OS itself), and a single NVIDIA display driver package contains millions of lines of code managing texture memory, shader compilation, display output, and hardware acceleration simultaneously. When something goes wrong in any of that, your entire computer crashes. Not just the game. Everything.

My go-to fix when GPU drivers are involved: DDU, short for Display Driver Uninstaller. Boot into Safe Mode (important — doing this in normal Windows can leave fragments behind), run DDU, and let it scorched-earth the old GPU driver. Registry entries, stray DLLs, configuration leftovers — all of it goes. Then reinstall from scratch using either the previous stable version or whatever’s newest on NVIDIA’s or AMD’s download page.

A client back in March — I remember because the session went long and I almost missed dinner — had a 4070 Ti that exclusively crashed during Helldivers 2. Every other game was fine. Valorant, fine. Cyberpunk, fine. Helldivers 2, instant SYSTEM_SERVICE_EXCEPTION within ten minutes. Turned out GeForce Experience had botched a driver update to version 560.94. Half the driver files were from the new version, half from the old one — a Frankenstein installation that somehow worked well enough for most games but choked on Helldivers 2’s specific rendering pipeline. DDU wipe, clean 560.94 install from NVIDIA’s site, problem gone. Exact same driver version. The installation process itself was broken.

When System Files Get Corrupted — SFC and DISM

Not every BSOD is a driver’s fault. Windows has hundreds of protected system files — DLLs, executables, configuration stores — and any of them can get corrupted. Power cuts during updates are a classic cause. So are malware infections that deliberately modify system components. I even saw one case where a single bad sector on a Kingston A400 SSD corrupted ci.dll and caused constant CRITICAL_PROCESS_DIED crashes.

Right-click the Start button, pick Terminal (Admin), and run this:

sfc /scannow

SFC (System File Checker) goes through every protected file on your Windows installation comparing it to what the factory original should look like. Anything modified or corrupted gets replaced from a local backup store. Takes around ten minutes depending on your drive speed — go scroll your phone for a bit.

Best case, it fixes what it finds and your BSODs stop after a restart. But about a third of the time in my experience, you’ll see a message that says the scan found problems it couldn’t fix. There’s a reason for this: SFC’s backup copies live in a folder called WinSxS, and if whatever damaged your system files also damaged WinSxS, then SFC has nothing clean to restore from. It’s trying to fix a broken window using another broken window as a template.

That’s where DISM comes in. Instead of relying on local backups, DISM reaches out to Microsoft’s update servers and downloads pristine copies of everything:

DISM /Online /Cleanup-Image /RestoreHealth

Fair warning — this one needs internet and takes significantly longer. Twenty minutes, sometimes thirty. But after DISM refills your local backup store with uncorrupted files, running sfc /scannow a second time will actually work because now it has good source material.

I don’t even bother testing SFC alone on machines showing CRITICAL_PROCESS_DIED anymore — I just run the DISM-then-SFC pair as a combo every time, because that STOP code turns out to be file corruption in about nine out of ten cases. If SFC says “no integrity violations” after the scan, though — great news, your system files are healthy. The crash is coming from something else entirely.

Test Your RAM — Nobody Does This and It Drives Me Nuts

I’ve lost track of how many clients came to us after spending weeks — weeks! — reinstalling Windows, swapping drivers, running every scan in existence, when the problem the entire time was a $20 RAM stick with a bad chip on it. What makes failing memory so maddening to diagnose is that it doesn’t produce one consistent error. It’ll throw MEMORY_MANAGEMENT one day, IRQL_NOT_LESS_OR_EQUAL the next, KERNEL_DATA_INPAGE_ERROR the day after that. When a bit randomly flips in memory, whatever code was stored at that address breaks in completely unpredictable ways.

Windows ships with its own memory tester — search “Windows Memory Diagnostic” in Start. Your machine reboots, runs some patterns across the RAM, comes back with a result. And… look. It catches obvious dead-stick failures. But subtle faults? The kind where one address out of 8 billion flips a bit under specific temperature conditions? Misses them all the time. I’ve lost count of how many machines passed Windows Memory Diagnostic and then blew up within 30 minutes on MemTest86.

MemTest86 is the real test. Download it free, put it on a USB drive, boot from the USB. Let it run at least two full passes — three is better. Each pass takes 45 minutes to an hour depending on how much RAM you have. I know that’s slow. But I’ve found sticks that didn’t show a single error until pass 3, because the specific faulty address only gets tested in later passes with different patterns.

Found errors? Pull one stick out, test with just the other one. Swap. Whichever stick produces errors is the dead one. Order a replacement — DDR4 is $15-30 on Amazon depending on size, DDR5 runs $30-50. Swapping desktop RAM takes about 90 seconds. Two clips, one slot, push until it clicks. Laptops usually have a little door on the bottom held in by one or two Phillips screws.

Heat — The Sneaky One

This next one wasted more of my diagnostic time than I’d like to admit before I learned to spot the pattern. The PC runs fine for somewhere between fifteen minutes and an hour, then crashes. Next boot, same thing — works for a while, then dies. And every single crash dump points at a completely different driver. One time it’s ntoskrnl.exe, next time it’s dxgkrnl.sys, then ntfs.sys, then something you’ve never heard of. None of the usual fixes work because none of the usual suspects are actually guilty.

Nine times out of ten, that pattern means one thing: heat.

An overheating CPU or GPU throws wildly inconsistent STOP codes because the thermal shutdown happens at arbitrary points in whatever code happens to be running at that microsecond. The chip hits 100°C, the system panics, and whatever instruction was mid-execution takes the blame.

Install HWiNFO (it’s free). Run the sensor monitoring panel while you do whatever normally triggers the crash. Watch the number labeled “CPU Package” in the temperature section. Under 85°C? Normal. Between 90-95°C? Not great but not necessarily the cause. Consistently slamming into 95°C or above? Stop everything else and deal with the heat first. Clean out the dust, make sure the cooler is seated flush against the CPU, and maybe replace the thermal paste if this machine has been running for three-plus years without maintenance.

Here’s a story that still embarrasses me. A client’s gaming desktop was blue-screening every 30-40 minutes of Fortnite. I spent 45 minutes on the remote session going through crash dumps, updating drivers, running file integrity scans. Nothing made sense. Different culprit driver flagged in every dump. Then I had a thought I should’ve had right at the beginning: “hey, can you install HWiNFO real quick and read me your CPU temp?” 104°C. Turns out one of the four mounting screws on his Noctua NH-D15 had worked its way loose — the entire cooler was tilted, barely making contact. He grabbed a Phillips head, tightened the screw, CPU dropped to 72°C immediately. No more blue screens, ever. The lesson? Always ask about temps early. I burned 45 minutes of both our time because I assumed it was software.

Windows Update — Honestly the Number One Cause Right Now

I put this section near the end but really it should be near the top, because in terms of pure volume of tickets, Windows Update causes more of our BSOD calls in 2025-2026 than drivers, RAM, and heat combined. Microsoft pushes cumulative updates monthly, and every few months one of them breaks something. The 24H2 feature update was catastrophic — a 340% spike in BSOD reports in the first two weeks, per analysis of Microsoft’s own support forums by Neowin.

Think about when your blue screens started. Was it right after you saw “Updating… don’t turn off your PC” and came back to a freshly restarted machine? Because that’s the tell.

Check your update history: Settings, then Windows Update, then Update history. See what installed recently. If the timing lines up — the BSODs started within 24-48 hours of a specific KB update — uninstall that update. Click Uninstall updates right from that same settings page, find the matching KB number, remove it.

Windows will try to reinstall it. It always does. By the time it does, Microsoft has usually fixed whatever broke in a revised version. But if you want to be sure it stays gone, look up the “wushowhide” tool — it’s a small Microsoft utility (officially called “Show or Hide Updates”) that lets you permanently block specific KB numbers from reinstalling.

Can’t boot into Windows at all? You can uninstall updates from the recovery environment too. Same Automatic Repair screen I described earlier — Advanced Options, Troubleshoot, Advanced Options, Uninstall Updates. Saved me more than once when a client’s machine was stuck in a reboot loop after a bad Patch Tuesday push.

When It’s Not Software Anymore

You’ve done the crash dump analysis. Updated or rolled back every suspicious driver. Run SFC and DISM. Tested your RAM. Checked your temperatures. Uninstalled the latest Windows update. And the machine is still blue-screening.

At this point, you’re probably looking at actual hardware failure. A few possibilities:

Your SSD or hard drive is dying. Grab CrystalDiskInfo and look at the SMART health status. Yellow or red warnings mean the drive is on its way out. I had a client last fall whose Crucial MX500 was reporting 47 bad sectors and increasing. Her BSODs stopped completely after she cloned to a new Samsung 870 EVO ($55 for 500GB at the time).

You’ve overclocked something. Maybe the overclock was stable for six months. Doesn’t matter — silicon degrades, thermal paste dries out, what was stable at 22°C room temperature might not be stable at 28°C during summer. Set your CPU, GPU, and RAM back to stock clocks in BIOS. If the blue screens stop, you have your answer.

Motherboard problems. Swollen capacitors (you can literally see them bulging if you look at the board), failing voltage regulators, chipset issues. These are hard to catch remotely. Sometimes the machine will run fine at idle and only crash under load when the VRMs can’t deliver enough power. That’s a board replacement.

Power supply. A PSU that can’t hold stable voltage under heavy load will cause crashes that look exactly like driver problems. Random, seemingly unconnected STOP codes, no pattern in the crash dumps, everything points at a different driver each time. If nothing else makes sense, the power supply is worth suspecting. Borrowed a friend’s known-good PSU and tested it once — that’s how I confirmed a failing Corsair CX550 on a client’s build.

This is where remote troubleshooting hits a wall. We can narrow down what category of failure you’re dealing with by reading crash patterns and checking sensor logs, but actually testing individual components requires someone physically touching the machine.

That said — roughly 80% of the BSODs we handle at RebootDoctor are software issues. Driver problems, file corruption, bad updates. Things we fix remotely in a single session. Our BSOD diagnostic runs $29.90, and most sessions take about 25 minutes. We pull your crash dumps, analyze them, identify the root cause, and if it’s fixable remotely, we fix it right there. If it’s hardware, we tell you exactly what’s failing so you can make an informed decision about repair vs. replacement. No guesswork, no “try this and call me back.”

Message us on WhatsApp — send us a photo of the blue screen or your crash dump files and we’ll tell you what’s going on.

Last verified: May 2026