Blue screens · Windows 11

Fix a blue screen error: read the stop code and find the cause

Written November 14, 2026

A blue screen means Windows hit a fault it could not recover from and stopped to protect your files. The screen itself carries the most useful clue: the stop code. Write that code down, match it against what changed just before the crashes started, and the fix is usually undoing that one change — a driver, an update, or a piece of hardware starting to fail.

What you need

• A phone or a notebook. The blue screen may only stay up for seconds. A photo of it is enough.
• Your sign-in details and, if the drive is encrypted, your BitLocker recovery key. The recovery tools can ask for the key before they open.
• Time to let the PC crash or not crash. One blue screen is an incident. A pattern of them, tied to one action or one program, is a diagnosis.

Capture the stop code

1. Photograph the blue screen. Near the bottom it names a stop code in capital letters, such as CRITICAL_PROCESS_DIED, MEMORY_MANAGEMENT, IRQL_NOT_LESS_OR_EQUAL, or PAGE_FAULT_IN_NONPAGED_AREA. It may also name a file, often ending in .sys — that file name points at a driver, and it is worth as much as the code itself.
2. Let the PC restart and note the time. The exact time matters later, when you look the crash up in the event log.
3. If the screen flashes past too fast, find the record later instead. Windows logs every blue screen. The Event Viewer section below shows where. Do not chase a code by provoking more crashes.

Match the code to what changed

Most blue screens that start suddenly follow a change. Before you change anything else, list what is new:

• A driver update, especially for the graphics card, network adapter, or storage.
• A Windows update in the last few days.
• A new program, above all security software, tuning tools, or anything that installs a driver of its own.
• New or moved hardware: a memory stick, a drive, a USB device that is always plugged in.
• A settings change such as turning on overclocking or a memory speed profile in the BIOS.

If the crashes line up with one item on that list, that item is your first suspect. Work the next section on it before you touch anything else — changing three things at once leaves you not knowing which one fixed it, and the fault comes back as a mystery.

Test in Safe Mode and undo the change

Safe Mode starts Windows with a minimal set of drivers and services. If the blue screens stop there, Windows itself is sound and the fault sits in something that normally loads on top of it.

1. Get to Safe Mode. If the PC reaches the desktop, open Settings > System > Recovery and select Restart now beside Advanced startup. On the blue screen that follows, choose Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode or 5 for Safe Mode with Networking. Microsoft sets out the same route in its Windows startup settings guide. If the PC will not reach the desktop at all, work from the won't-boot guide first — it reaches the same recovery screen from a dead start.
2. Undo the suspect change. For a driver, open Device Manager, open the device, and use Roll Back Driver on the Driver tab if it is offered; if it is not, uninstall the device and restart, and let Windows load its standard driver. For a program, uninstall it under Settings > Apps. For a Windows update, remove the latest one under Settings > Windows Update > Update history > Uninstall updates.
3. Restart normally and use the PC. Do the thing that used to trigger the crash, more than once. A fix that survives the trigger is a fix. A crash with a new stop code is new information — note it and keep going in order.

Check memory and disk

If no change explains the crashes, or Safe Mode crashes too, test the two parts whose faults most often look like software: memory and the system drive.

1. Run Windows Memory Diagnostic. Search the Start menu for Windows Memory Diagnostic, choose Restart now and check for problems, and let the test run. The PC restarts, tests, then restarts into Windows and shows the result. Any error reported is serious: memory that fails this test needs replacing, and on a desktop with more than one stick, test one stick at a time to find the faulty one.
2. Check the drive and the system files. Open Terminal or Command Prompt as administrator. Run chkdsk C: /f and agree to run it at the next restart if asked. Then run sfc /scannow, which checks protected system files against known-good copies and repairs what it can — Microsoft describes the tool in Use SFC to repair missing or corrupt system files. If SFC reports it found damage it could not fix, run DISM /Online /Cleanup-Image /RestoreHealth first, then run SFC again.
3. Read the results plainly. Clean memory, a clean drive check, and repaired system files, followed by no more crashes, closes the case. A drive that reports bad sectors or keeps generating new file errors is a drive to replace, after copying your files off it.

Read the crash in Event Viewer

1. Open Event Viewer and go to Windows Logs > System. Look at the time you noted for the crash.
2. Find the BugCheck entry. An event with source BugCheck records the stop code in numbers, and a nearby Kernel-Power entry marks the unexpected shutdown. The numbers in the BugCheck entry match the code names in Microsoft's bug check reference.
3. Look for a warning that repeats just before each crash. A driver or service that logs an error minutes before every blue screen is naming itself. One crash with no pattern around it, on a PC that then runs for weeks, can be left alone and watched.

End state

• The PC runs through the action that used to trigger the crash, repeatedly, with no blue screen.
• You know the stop code, and which change, repair, or part accounted for it.
• Memory and drive checks are clean, or a failing part has been replaced.
• Windows Update has been run once by hand, so a removed update is replaced by a current one rather than returning half-applied.

When it goes wrong

• The blue screens happen in Safe Mode too. That moves the fault below the drivers Safe Mode skips: memory, drive, heat, or power. Work the hardware checks above, and if the PC also shuts down without a blue screen, work the restart and shutdown diagnosis.
• A different stop code every time. Rotating codes with no pattern usually mean memory or drive trouble rather than one bad driver — a single driver tends to fail the same way each time.
• The crash started right after a BIOS or firmware change. Undo that change first, or load the BIOS defaults, before testing anything else. A memory speed profile that is slightly too fast produces exactly this fault.
• Nothing above stops it. The remaining built-in option is Reset this PC under Settings > System > Recovery, keeping your files — Microsoft lists it among the recovery options in Windows. If a clean Windows still blue-screens, the fault is hardware, and the evidence you have gathered — codes, times, test results — is what a repair shop needs.