Windows blue screen: read the stop code, find the cause

The blue screen often reveals the cause. You just have to read the stop code.

“My computer just crashed – blue screen, then restart.” Often the stop code is gone before anyone could write it down. And after the restart everything works again – until the next time.

Here is how to find the crash after the fact, read the stop code and narrow down the cause. The steps apply to Windows 10 and 11; by the way, newer Windows 11 versions show a black screen instead of the blue one – the causes are the same.

Step 1: Find the stop code

The stop code is the most important clue. If it was on the screen, take a photo if you can. Otherwise:

1. Open Event Viewer (right-click Start › Event Viewer).
2. Windows Logs › System.
3. On the right, Filter Current Log › select BugCheck under event sources.
4. The entry contains the stop code (as a hex value, e.g. 0x000000ef).

Also helpful: Kernel-Power, event ID 41 – the computer was not shut down properly.

With PowerShell:

Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'} -MaxEvents 5 |
  Select-Object TimeCreated, Message

Crash dumps are stored in C:\Windows\Minidump – IT can analyze them with WinDbg.

Common stop codes and what they mean

• CRITICAL_PROCESS_DIED – important system process terminated – corrupted system files, drivers, SSD
• IRQL_NOT_LESS_OR_EQUAL – faulty driver, less often memory
• PAGE_FAULT_IN_NONPAGED_AREA – memory, drivers, antivirus
• MEMORY_MANAGEMENT – memory, drivers
• DRIVER_POWER_STATE_FAILURE – driver during power saving – often docking station, Wi-Fi, graphics
• SYSTEM_THREAD_EXCEPTION_NOT_HANDLED – driver, often graphics
• INACCESSIBLE_BOOT_DEVICE – boot drive not reachable – SSD, controller driver, BIOS setting
• WHEA_UNCORRECTABLE_ERROR – hardware error – CPU, memory, overheating

Step 2: What has changed?

If the blue screen came after a change, that change is the first suspect.

• Windows update: Settings › Windows Update › Update history – what was installed shortly before? A faulty update can be removed there under Uninstall updates.
• New driver: graphics, docking station, network. In Device Manager, open the device's Properties › Driver › Roll Back Driver.
• New software: especially antivirus, VPN clients, driver tools.
• New hardware: docking station, USB devices. Unplug them as a test.
• BIOS update – see External monitor: no signal after BIOS update.

Step 3: Update drivers

Drivers are the most common cause. Best from the device manufacturer (Dell, HP, Lenovo …) – their support tools know the right drivers for the model. In particular:

• Graphics drivers
• Drivers for the docking station (DisplayLink, Thunderbolt)
• Network and Wi-Fi drivers
• Chipset and storage controller

Step 4: Check system files

In a Command Prompt as administrator:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial

DISM repairs the component store, sfc checks and replaces corrupted system files.

Step 5: Check memory and SSD

• Memory: Windows+R › mdsched.exe › Restart now and check for problems.
• SSD: check its health with the manufacturer's tool or with PowerShell:

Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus, OperationalStatus

If the drive reports problems: back up your data immediately and have the device replaced.

Step 6: Rule out overheating

Blue screens under load – for example during video calls or with large Excel files – can point to overheating. See Laptop slow during use.

When IT needs to step in

• Repeated blue screens despite current drivers and updates.
• Hardware errors (SSD, memory, WHEA_UNCORRECTABLE_ERROR).
• Windows no longer starts – recovery environment, possibly the BitLocker recovery key.
• Several devices at once – then it is usually down to an update or centrally deployed software.

How does SuperSupport help with blue screens?

After a crash, the SuperSupport agent on the Windows device reads Event Viewer, finds the stop code, and checks the update history, recently installed drivers and the state of the drive. It can start harmless things like system file checks; driver and update uninstalls it submits to IT for approval – with all findings in the log. What that looks like for internal IT teams and MSPs is described on the respective pages.

Frequently asked questions

What is a blue screen?

A blue screen (stop error) means Windows ran into a serious error and has to restart to protect the system. The screen shows a stop code such as CRITICAL_PROCESS_DIED or IRQL_NOT_LESS_OR_EQUAL that points to the cause. Newer Windows 11 versions show a black screen instead of a blue one.

How do I find the stop code after the restart?

In Event Viewer, go to Windows Logs › System and look for the source BugCheck – the stop code is listed there. A Kernel-Power entry with event ID 41 shows that the computer restarted unexpectedly. Crash dumps are stored in the folder C:\Windows\Minidump.

What are the most common causes of blue screens?

Faulty or outdated drivers (graphics, network, docking station), a recently installed update or program, defective memory, problems with the SSD, overheating, and corrupted system files. If the blue screen appears after a change, that change is the first suspect.

Is a blue screen dangerous?

A single blue screen is usually nothing to worry about. If they pile up, the cause should be found – unsaved work is lost, and with hardware defects such as the SSD or memory, data loss and further failures are possible.

How do I check the memory?

With Windows Memory Diagnostic: press Windows+R, enter mdsched.exe and choose “Restart now and check for problems”. After the test, Windows shows the result or stores it in Event Viewer under MemoryDiagnostics-Results.

14 days free

IT support that fixes itself.

SuperSupport fixes IT problems right on the device, before they turn into tickets. Try it free for 14 days.

Start free trial