Home Back

What really causes a Blue Screen of Death (BSOD)?

xda-developers.com 2 days ago

Having issues with your PC is never fun, and when those issues result in Blue Screens of Death (known as BSODs), it's all the worse. Having a computer crash repeatedly when you try to do something is just infuriating. But to fix it, you need to look into what's causing it. So how do you determine what's causing a BSOD on your Windows 11 (or older) PC? Here are some steps to help you determine that.

A Windows 11 laptop showing a Blue Screen of Death
Related

Is your Windows 11 PC crashing with Blue Screens of Death (BSOD)? Here are some reasons why and how you can fix your problems.

Use BlueScreenView to see the error details

When you get a Blue Screen of Death, the error code is displayed on screen, but you're probably not ready to write it down in the few seconds that the message is displayed. You could use the Windows Event Viewer to look into error information, but if you want a much simpler way to do it, you should use BlueScreenView.

This third-party app shows the logs saved in the MiniDump folder, which is specifically used for crashes, and it lets you see what driver or module on your PC likely caused the BSOD. BlueScreenView shows you the error message and it surfaces the file that's most likely responsible for the crash, which can help you diagnose and fix the issue. For example, if it's a driver, installing a newer version of that driver might help.

Here's how to use BlueScreenView to view error details:

  1. Download and install BlueScreenView from the official website
  2. Run the program and wait for it to load your logs.
    Screenshot of BlueScreenView running in Windows 11
  3. Click the log you want to view information for (use the timestamps to see what error you're looking for).
  4. Note the Bug check string, and check the highlighted files on the bottom pane.
    Screenshot of BlueScreenView with the bug check string and relevant files selected
  5. Scroll horizontally to see a more user-readable name for the process.
    Screenshot of BlueScreenView in Windows 11 showing the name of the process responsible for a crash

Look specifically for the process that's shown in red. When Windows encounters a critical error it can't recover from, Windows creates a memory dump of what the state of the system was when it crashed, including the call stack. The call stack is a list of functions that were active at the time of the crash, and the driver responsible for the most recent call at the top of the call stack is what is displayed when your computer encounters a BSoD.

The other fields shown are important too, with the bug check string and parameters giving you more information about what the exact error was.

It's not always straightforward

While BlueScreenView, and Windows itself will show you the driver that was active when the machine crashed, there's often more than meets the eye. Microsoft says that only 5% of BSoDs are caused by faulty Microsoft code. In other words, 95% of the time, you'll need to do some work to find out the cause. Often, blue screen events will list ntoskrnl.dll as the top process, which is the kernel process for Windows.

If another driver makes calls that pass through the Windows kernel, a crash could look like it was caused by the Windows kernel, even if it wasn't in actuality. For example, the Windows kernel is responsible for managing system memory, and bug check strings like IRQL_NOT_LESS_OR_EQUAL and PAGE_FAULT_IN_NONPAGED_AREA can be indicative of faulty RAM or some other problem, especially if they're attributed to ntoskrnl.dll. That doesn't mean the Windows kernel is the cause, it just means that the Windows kernel failed first because it's what's managing the faulty hardware.

On top of that, drivers running at a kernel level in order to have higher privileges can interface directly with the Windows kernel and also cause blue screen events that are attributed to ntoskrnl rather than the actual cause. This could happen with anti-cheat software for example, as a lot of anti-cheat software runs at a kernel level nowadays via a driver that runs at boot time.

Common BSOD error codes

A photo of a blue screen of death

Image from Unsplash

BSODs can be caused a a very large number of things, and Microsoft provides a full list of error codes you might see during a BSOD (also known as a bugcheck). However, the actual issues you're more likely to see are a bit more limtied than that. Here are some of the common error codes you'll get:

  • CRITICAL_PROCESS_DIED: This error happens when a core Windows process stops running for one reason or another. It's possible to do this by terminating the wrong Windows process in Task manager, but if you didn't do anything like that, then there might be something wrong with your PC.
  • SYSTEM_THREAD_EXCEPTION_NOT_HANDLED: This problem means there was an error that Windows' error handler wasn't able to catch, and it's often related to device drivers. Using BlueScreenView, you should be able to see which driver caused the issue, and then you can try to update or reinstall that driver to see if the problem is solved.
  • IRQL_NOT_LESS_OR_EQUAL: This error typically occurs because a process or driver has attempted to access a memory address that it has no access rights to. Memory addresses for each process have an upper limit, and sometimes, these processes can try to exceed it. This can indicate issues with the driver itself, which you should try to update, but it could also be caused by corrupted system files, at which point using DISM and SFC commands could help. It could also be caused by faulty hardware.
  • VIDEO_TDR_TIMEOUT_DETECTED or VIDEO_TDR_FAILURE: These errors can appear when the graphics driver on your PC fails to respond when it should, preventing the display of graphics. This is a fairly specific issue that points to your graphics driver, so updating (or rolling back) said driver should fix the issue. If not, it could be that your graphics card has some hardware fault.
  • PAGE_FAULT_IN_NONPAGED_AREA: This error means a system process or driver has referred to a memory address that doesn't exist. One potential cause is a faulty driver, so updating your drivers might help. You should refer to BlueScreenView to see what driver is potentially at the root of the issue. It may also be because of corrupted system files, in which case updating or repairing your Windows install may help. It's also possible there's some issue with the memory on your computer, such as the RAM, so if you recently upgraded your RAM, check to make sure it's installed properly and there are no compatibility issues.
  • SYSTEM_SERVICE_EXCEPTION: This error by itself doesn't say a lot, but it's usually tied to a specific process, which lets you identify the cause of the problem. If a driver is mentioned, that's likely the problem, so as usual, updating that driver is a good start. If the error mentions a Windows system process, then it's most likely that some WIndows files have been corrupted. In this case, DISM and SFC are the best option for repairing the problem (we've linked steps for these commands above).
  • DPC_WATCHDOG_VIOLATION: This error is commonly shown in relation to network-related crashes, often when transferring large amounts of data. A very common culprit for this error code are outdated Wi-Fi drivers, so make sure to try to update those first. However there are a few possible causes in other drivers, including graphics and storage drivers. BlueScreenView should help point you in the diection of the right driver to update.
  • NTFS_FILE_SYSTEM: This means there's an error with the file system on your computer. If you can access Windows, running a chkdsk command for your Windows drive, followed by sfc /scannow should help fix the issue. If you can't boot into Windows, you may need to use Safe Mode or the Windows Recovery Environment.
  • DATA_BUS_ERROR: This error is one that most likely points to a hardware issue, with a common cause being the RAM. You'll want to make sure all the RAM sticks in your system are identical, as stability issues are very common otherwise. If you have new hardware, installing an updated driver or BIOS may also help.
  • KERNEL_SECURITY_CHECK_FAILURE: If you're a gamer, particularly playing online games, this is one you may have seen before. This error is often caused by anti-cheat systems in online games, such as Easy Anti Cheat, and it can be hard to fix. You can try to disable the anti-cheat software, but that means the game may not work properly. Your best bet is ensuring that both the anti-cheat driver and your operating system are up to date.

Whenever you see these errors, it's just as important to note the highlighted files when you use BlueScreenView to read the logs. This is what really tells you the root of the problem most of the time. From there, troubleshooting becomes much easier.

Troubleshooting BSODs doesn't have to be a nightmare

While BSODs are always frustrating, fixing them doesn't have to be as hard as it seems. By keeping this information in mind, you can easily identify the source of your problems, and from there, fixing those problems becomes a lot easier.

People are also reading