Computer Repair · October 21, 2026 · ComputerKing Team

Windows Blue Screen (BSOD) Troubleshooting: Decoding Stop Codes and Safe Recovery Steps

Sudden blue screen and auto-restart? Decode stop codes, find BugCheck records in Event Viewer, tell driver issues from hardware failures — with tiered recovery steps and 5 common mistakes to avoid.

Key Takeaway

This guide breaks down Windows blue screen troubleshooting: how to read stop codes, find BugCheck records in Event Viewer, tell driver problems apart from hardware failures, with tiered recovery steps and common mistakes to avoid.

Introduction

You're mid-game, or typing the last paragraph of a report, when the whole screen turns blue, covered in English text — and the PC restarts itself. Anything unsaved is gone. That's the Windows blue screen, the Blue Screen of Death (BSOD). Microsoft's official terms are "stop error" or "bug check".

Most people's first reaction is panic: is the machine dead? In fact, the blue screen isn't Windows malfunctioning at random. It means Windows detected an error so serious it couldn't safely continue, so it stopped immediately to protect your data and hardware from further damage. The blue screen itself is a protection mechanism — the real problem is whatever triggered it.

This guide walks you through it step by step: how to read the stop code on the blue screen, how to find every crash record with Event Viewer, how to make an initial call on whether it's a driver or a hardware problem, and how to recover safely. Every step has a clear stopping point — nothing here asks you to do anything beyond a careful user's reach.

Section 1: Why It Happens — Four Common Cause Categories

A blue screen means the Windows kernel (the deepest core layer of the operating system) hit an error it couldn't handle. The causes are many, but they fall into four main groups, ordered from the outside in:

1. Driver problems

Drivers are the translators between hardware and Windows. They run in kernel mode with enormous privileges, so when one fails, the whole system goes down with it. Typical stop codes:

• 0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL: a driver tried to access pageable memory at an interrupt request level (IRQL) that was too high. Microsoft's documentation states this is usually a bug in the driver itself.
• 0xA IRQL_NOT_LESS_OR_EQUAL: kernel-mode code accessed memory at the wrong IRQL — commonly a driver or memory issue.
• 0x1E KMODE_EXCEPTION_NOT_HANDLED: a kernel-mode program generated an exception that no error handler caught.

If the blue screens started right after you updated a graphics driver or installed new hardware, this category is the prime suspect.

2. Hardware problems: memory, drive, overheating

Aging or failing hardware can trigger blue screens too:

• 0x1A MEMORY_MANAGEMENT: a severe memory management error, pointing at RAM or a driver.
• 0x50 PAGE_FAULT_IN_NONPAGED_AREA: the system referenced invalid memory — possibly a driver, RAM, or antivirus software.
• Overheating CPUs/GPUs and drives with bad sectors can also blue-screen a machine under heavy load.

3. Corrupted system files or boot configuration

• 0xEF CRITICAL_PROCESS_DIED: a critical system process terminated — possibly corrupted system files or hardware.
• 0x74 BAD_SYSTEM_CONFIG_INFO: corrupted boot configuration data (including system settings in the registry).
• 0x7B INACCESSIBLE_BOOT_DEVICE: the most common code when a PC won't boot at all — Windows can't find the boot device. It often appears after changing the disk controller mode or cloning the system to another drive.

4. Windows update or software conflicts

• 0x133 DPC_WATCHDOG_VIOLATION: a driver hogged the CPU too long and the watchdog timer gave up, halting the system.
• 0x116 VIDEO_TDR_FAILURE: the graphics driver failed to reset within the time limit — TDR (Timeout Detection and Recovery) failed.

These often show up after a major Windows update, or when two conflicting programs run together (for example, two antivirus products at once).

Driver or hardware? Three clues to tell them apart

You don't need to analyze dump files. These three observations already give you a direction:

1. Timing: blue screens started after a driver update, Windows update, or new hardware → likely a driver or compatibility issue. Started out of nowhere with no changes → leaning toward aging hardware.

2. Pattern: crashes only under heavy load (gaming, video rendering) but fine otherwise → suspect overheating, power, or memory. Completely random, even when idle → could be anything; test one thing at a time.

3. Accompanying symptoms: clicking sounds from the drive, abnormal heat, ever-slower boot times → hardware is likely. A `.sys` filename on the blue screen (e.g., nvlddmkm.sys) → that's the offending driver, identified by name.

Section 2: What To Do — Tiered Troubleshooting Steps

First things first: back up your important data. If the PC still boots into Windows, copy your files and photos to an external drive or the cloud before anything else. Data safety comes before every step below.

Tier 1: Safe to try yourself

Step 1: Photograph the stop code. Next time the blue screen appears, take a phone photo of the whole screen — especially the code (e.g., 0x000000D1) and any `.sys` filename. This is the primary evidence for everything that follows. Don't skip it.

Step 2: Find the crash history in Event Viewer. After the PC restarts:

1. Press the Windows key, type "Event Viewer", and open it.

2. On the left, expand Windows Logs → click System.

3. On the right, click Filter Current Log and select the BugCheck source.

4. You'll see a record of every blue screen, usually Event ID 1001, containing the stop code, its four parameters, and the dump file location (normally C:\Windows\Minidump).

This works even without waiting for the next crash — the full history is right there: when it crashed, how often, and with which codes.

Step 3: Remove recently added hardware. Microsoft's official troubleshooting steps start here: if you added new hardware (RAM, SSD, USB devices) before the crashes began, shut down, remove it, and try booting again. Many cases end right here.

Step 4: Check Device Manager. Right-click the Start button → Device Manager. Look for any device with a yellow exclamation mark. Right-click it and update the driver; if that doesn't help, try disabling or uninstalling the device, then restart.

Step 5: Install Windows updates and free up disk space. Go to Settings → Windows Update and install everything available. Also make sure the system drive has roughly 10% to 15% free space — a nearly full drive affects swap files and stability.

Step 6: Try Safe Mode. If the PC crashes constantly in normal mode but is stable in Safe Mode, a third-party driver or program is almost certainly the cause. To enter Safe Mode: when the Windows logo appears during boot, hold the power button to force a shutdown. Do this twice; on the third boot, Windows enters WinRE (the recovery environment) automatically → Troubleshoot → Advanced options → Startup Settings → Restart → press 4 for Safe Mode.

Tier 2: Proceed with care (back up first, set a restore point)

Step 7: Repair system files. Open Command Prompt as administrator and run `sfc /scannow`. It scans and repairs corrupted system files; restart afterward. If SFC can't fix everything, run `DISM /Online /Cleanup-Image /RestoreHealth`.

Step 8: Check the drive. In Command Prompt, run `chkdsk C: /f`. Note: it may say it needs the next restart to scan — that's normal. Don't force a shutdown during the scan.

Step 9: Roll back or clean-install the driver. If you've narrowed it down to a driver (e.g., graphics), go to Device Manager → the device → Properties → Driver tab → Roll Back Driver. If rollback isn't available, download the latest driver from the official source only (NVIDIA, AMD, Intel, or your PC maker's site) and choose the "clean installation" option. Never use shady "one-click driver updater" tools — they frequently install the wrong versions.

Step 10: Test the memory. Press the Windows key, type `mdsched.exe`, and choose "Restart now and check for problems". If the PC has two RAM sticks, shut down and test them one at a time to see if one is faulty.

If it's still blue-screening after all this, write down each stop code, stop experimenting, and read the next section.

Tier 3: Don't try this yourself (leave it to professionals)

• Driver Verifier: Microsoft's verifier.exe can force a faulty driver to reveal itself — but it deliberately crashes the PC several more times, requires a system restore point beforehand, and is disabled with `verifier /reset`. Don't enable it if you can't interpret the results.
• Analyzing dumps with WinDbg: WinDbg Preview is Microsoft's official debugger and can open the .dmp files in C:\Windows\Minidump to show which driver failed. Interpreting the output needs expertise — a misread sends you in the wrong direction.
• The PC won't boot and the data matters: do not reinstall Windows yourself at this point — reinstalling can overwrite data that's still recoverable. Stop, secure a backup first.
• Opening up a laptop, updating the BIOS: opening a machine risks torn ribbon cables, and a power cut during a BIOS update can brick the board. Leave these to experienced hands.

Section 3: What Never To Do

These are real mistakes seen in repair shops, each paid for in data or money:

Mistake 1: Reinstalling Windows immediately without noting the stop code

Why it's wrong: the stop code is the only first-hand evidence in the whole investigation, and reinstalling wipes all logs and dump files. If the root cause is hardware, it'll blue-screen again after the reinstall — all that work for nothing, plus the risk of losing data during the process.

Do this instead: photograph the code first and work through the steps in Section 2. Reinstalling is the last resort, and only after a backup.

Mistake 2: Downloading "one-click BSOD fixer" or registry cleaner tools

Why it's wrong: blue screens have dozens of possible causes — no single button can fix them all. Registry cleaners that delete the wrong keys can turn a small problem into a PC that won't boot. Microsoft has never recommended these third-party tools.

Do this instead: use Windows' built-in tools (SFC, DISM, chkdsk, Memory Diagnostic) — they're the proper repair utilities for system files.

Mistake 3: Running any repair without a backup

Why it's wrong: chkdsk repairing bad sectors, reinstalling the OS, even a BIOS update — all carry some data risk. A blue-screening system is already unstable; doing major surgery on it without a backup is like skydiving without checking the parachute.

Do this instead: before any Tier 2 operation, copy your important files elsewhere. If Windows boots, copy directly; if it doesn't, deal with the backup before the repair.

Mistake 4: Ignoring overheating, strange noises, or a slowing boot

Why it's wrong: fans screaming at full speed, a burning-hot chassis, clicking from the drive, ever-longer boots — these are a dying machine's distress signals. They don't fix themselves; they only fail completely at the worst possible moment.

Do this instead: while the PC still boots, back up first, then check cooling (dust the vents) and run a drive health check. A clicking drive shouldn't be tortured with repeated restarts.

Mistake 5: Downloading random .sys files or drivers from unknown sources

Why it's wrong: single .sys files floating around the internet are often the wrong version and can make the system more unstable; driver installers from unknown sources may bundle malware.

Do this instead: drivers come from exactly three places — Windows Update, the hardware maker's official site (NVIDIA/AMD/Intel), or your PC brand's support site. There is no fourth.

Section 4: Prevention — Never See That Blue Screen Again

Do right now

• Back up your important files — today, not someday. An external drive or the cloud; two copies is better.
• Update drivers only through official channels — never through third-party one-click tools.
• Keep 10% to 15% of the system drive free — don't fill it to the brim.
• Mind the thermals: don't game or render video for hours with a laptop sitting on a bed or sofa that blocks the vents; clear dust from the fan area periodically.

Do regularly

• Check Event Viewer once a quarter: any BugCheck records? How many, and is it the same code repeating? A repeating code is a warning sign.
• Run Windows Memory Diagnostic once a year, especially on machines over three years old.
• Watch drive health: use the maker's tool to read S.M.A.R.T. data — growing bad sectors mean it's time to replace the drive.
• Back up before major Windows updates, and keep an eye out for odd behavior in the first few days after updating. Don't update every machine you own on day one.

FAQ

Q: It blue-screened once and hasn't happened again for ages. Should I worry?

A: A one-off blue screen can be a fluke — a driver hitting an extreme edge case, for example. Note the date and what you were doing; if months pass with no repeat, there's usually nothing to act on. If it happens again, investigate properly using the steps above.

Q: How can I initially tell whether it's a driver or a hardware problem?

A: Look at timing and pattern. Crashes that started after a driver update, Windows update, or new hardware point to drivers or compatibility. Crashes out of nowhere, crashes only under heavy load, or a rotating cast of different stop codes point more toward hardware (memory, cooling, drive). A .sys filename on the blue screen names the driver directly.

Q: Can a blue screen delete my files?

A: The blue screen isn't designed to delete anything, but unsaved work (the document you're typing, the half-finished image) is lost in the abrupt restart. And if the underlying cause is a failing drive, your files are genuinely at risk. That's why backup always comes before repair.

Q: How long does professional diagnosis take, and what does it cost?

A: It depends. Software or driver issues can usually be diagnosed and fixed within one working day; hardware replacement depends on parts availability. As for cost, it depends on the findings — check the manufacturer's documentation or ask for an individual quote, and don't trust fixed-price promises found online.

Q: How do I enter Safe Mode?

A: During boot, when the Windows logo appears, hold the power button to force a shutdown. Do this twice; the third boot enters the WinRE recovery environment automatically. Then choose Troubleshoot → Advanced options → Startup Settings → Restart, and press 4 for Safe Mode. Safe Mode loads only essential drivers, which makes it ideal for troubleshooting.

Q: Why does it blue-screen right after a Windows or driver update?

A: A new driver or system update can clash with older hardware or other software on your machine. Roll the driver back to the previous version in Device Manager, or uninstall the problematic update in Windows Update, then wait for the maker to release a fixed version before updating again.

Q: My PC is many years old and blue-screens constantly. Time for a new one?

A: Consider two things. First, are the stop codes different every time, and do hardware tests (memory, drive) fail? If so, multiple components are aging out together and repair may cost more than the machine is worth. Second, does the machine still keep up with your daily needs? If both answers are yes, replacing it is likely the better deal. Either way, back up your data first.

Summary

1. The stop code is clue number one: when the blue screen appears, photograph the code and any .sys filename. Everything downstream depends on it.

2. Work outside-in, change one thing at a time: software and drivers first (Event Viewer, Safe Mode, driver rollback), then hardware (memory test, thermals, drive). One variable per change, so you know what actually worked.

3. Data always comes first: back up before any repair; when in doubt, stop.

Stopping point: if the same PC blue-screens more than two or three times in a week, or you notice strange noises, abnormal heat, or it won't boot — stop experimenting, secure your important data, and have it checked thoroughly by someone experienced.

Common Stop Code Reference

The codes below come from Microsoft's Bug Check Code Reference (official English names in parentheses):

Sources

1. Microsoft Learn — Bug Check 0xD1: DRIVER_IRQL_NOT_LESS_OR_EQUAL — https://learn.microsoft.com/cs-cz/windows-hardware/drivers/debugger/bug-check-0xd1--driver-irql-not-less-or-equal — Referenced for the 0xD1 definition (kernel-mode driver accessing pageable memory at too-high IRQL) and the explanation that a blue screen is an immediate halt to protect data. Accessed: 2026-10-21.

2. Microsoft Learn Q&A — Bugcheck code: 0x1E — https://learn.microsoft.com/en-us/answers/questions/2655297/bugcheck-code-0x1e-(0xffffffffc0000005-0xfffff8000?forum=windows-all&referrer=answers — Referenced for the 0x1E definition (an exception generated by a kernel-mode program that the error handler did not catch). Accessed: 2026-10-21.

3. Microsoft Support — Troubleshooting Windows unexpected restarts and stop code errors — https://support.microsoft.com/en-US/Windows/Experience/Performance-Optimization/troubleshooting-windows-unexpected-restarts-and-stop-code-errors — Referenced for the six basic steps (remove new hardware, Safe Mode, Device Manager exclamation marks, 10%–15% disk space, install Windows updates, system restore). Accessed: 2026-10-21.

4. Microsoft Learn Q&A — Recently started getting BugCheck Event ID 1001 errors — https://learn.microsoft.com/en-us/answers/questions/3752183/recently-started-getting-bugcheck-event-id-1001-er — Referenced for the minidump location C:\Windows\Minidump and Driver Verifier usage (create a restore point first; `verifier /reset` to disable). Accessed: 2026-10-21.

5. UMA Technology — How to Check Blue Screen Log Windows 11 — https://umatechnology.org/how-to-check-blue-screen-log-windows-11-2/ — Referenced for the Event Viewer walkthrough (Windows Logs → System, filter by the BugCheck source, Event ID 1001). Accessed: 2026-10-21.

Related articles

• Hard Drive Making Clicking Sounds? 5 Things To Do Immediately
• Swollen Laptop Battery Safety Guide