By Andrew Armstrong 
Windows shows you a stop code on a blue screen and then restarts before most people can write it down. That code is genuinely useful. It narrows a vague “it keeps crashing” to a category, and some codes point almost directly at a cause.
These are the ten you’ll actually meet, in rough order of frequency.
Quick Facts
- Write the stop code down. Reliability Monitor keeps it if you miss it.
- Codes mentioning PAGE or MEMORY point at RAM or storage.
- Codes mentioning DRIVER or IRQL point at a driver, usually a recently updated one.
- The faulting module in the dump matters more than the code itself.
- Random codes varying between crashes suggests hardware, not software.
The ten
| Stop code | Usually means |
CRITICAL_PROCESS_DIED | An essential Windows process stopped. Often system file corruption. Run SFC and DISM. |
IRQL_NOT_LESS_OR_EQUAL | A driver accessed memory it shouldn’t. Nearly always a driver, sometimes bad RAM. |
PAGE_FAULT_IN_NONPAGED_AREA | Requested data wasn’t in memory. RAM, or a driver referencing freed memory. |
SYSTEM_SERVICE_EXCEPTION | A system call failed. Graphics drivers are a common source. |
DPC_WATCHDOG_VIOLATION | A driver took too long. Classically old storage drivers or SSD firmware. |
KERNEL_SECURITY_CHECK_FAILURE | A data structure was corrupted. Driver, or failing memory. |
MEMORY_MANAGEMENT | Memory management error. Test RAM first. |
UNEXPECTED_KERNEL_MODE_TRAP | Hardware-level fault. Often overclocking or genuine CPU/RAM failure. |
VIDEO_TDR_FAILURE | Graphics driver stopped responding and couldn’t recover. |
INACCESSIBLE_BOOT_DEVICE | Windows can’t reach the boot drive. Storage controller driver, or a failing drive. |
Grouping them by what to do
- Driver-shaped (IRQL, SYSTEM_SERVICE_EXCEPTION, DPC_WATCHDOG, VIDEO_TDR): update or roll back the relevant driver, starting with graphics and storage.
- Memory-shaped (MEMORY_MANAGEMENT, PAGE_FAULT, KERNEL_SECURITY_CHECK): run MemTest86 overnight before anything else.
- Storage-shaped (INACCESSIBLE_BOOT_DEVICE, some CRITICAL_PROCESS_DIED): check SMART data and the storage controller driver.
- System-shaped (CRITICAL_PROCESS_DIED after an update): run DISM then SFC.
Reading the dump without being a kernel developer
The stop code tells you the category. The dump tells you which driver. You don’t need WinDbg for this. BlueScreenView reads minidumps and shows the faulting driver in a plain list.
# Confirm minidumps are being written
Get-ChildItem C:\Windows\Minidump -ErrorAction SilentlyContinue |
Select-Object Name, LastWriteTime, Length
# If empty, enable small memory dumps
wmic recoveros set DebugInfoType = 3Open the most recent minidump in BlueScreenView and look at the driver highlighted in the lower pane. A third-party .sys file there is your answer. If it’s consistently a Windows driver like ntoskrnl.exe, that usually means hardware rather than that Windows itself is at fault.
A method that works
Quick Steps
- Note the stop code, or find it in Reliability Monitor.
- Check what changed. Reliability Monitor’s Information row. New driver, new update, new hardware?
- If it’s driver-shaped, roll back the most recently updated driver.
- If it’s memory-shaped, run MemTest86 overnight before touching anything else.
- If codes vary between crashes, treat it as hardware and start with RAM and power.
- Run DISM then SFC if corruption is plausible.
- Boot into Safe Mode to test. If it’s stable there, it’s a third-party driver.
The pattern that means hardware
One consistent stop code usually means one specific cause. A driver, a corrupted file. Different codes on different crashes is the signature of failing hardware, because the fault lands in whatever happened to be running.
If you’re seeing MEMORY_MANAGEMENT one day and IRQL the next and KERNEL_SECURITY_CHECK the day after, stop chasing drivers and test RAM, then power.
Glossary
| Term | What it means |
| Stop code | The identifier shown on a blue screen, e.g. CRITICAL_PROCESS_DIED. |
| IRQL | Interrupt Request Level. A kernel priority. Violations mean a driver misbehaved. |
| Minidump | A small crash file in C:\Windows\Minidump naming the faulting driver. |
| DPC | Deferred Procedure Call. The watchdog fires when one takes too long. |
| TDR | Timeout Detection and Recovery. Windows resetting an unresponsive GPU driver. |
ntoskrnl.exe | The Windows kernel. Named as faulting module usually means hardware. |
Frequently asked questions
Where do I find the stop code if the PC restarts too fast?
Reliability Monitor (perfmon /rel) records it, as does Event Viewer under System, event ID 41 and BugCheck entries. You can also disable automatic restart in System Properties, Advanced, Startup and Recovery.
Does a blue screen mean my hardware is failing?
Not necessarily. Most are driver-related. Hardware becomes the likely explanation when the codes vary between crashes, or when it happens in Safe Mode too.
Should I use WinDbg?
Only if you’re comfortable with it. BlueScreenView gives you the faulting driver in seconds, which is the piece of information that actually changes what you do next.
Why do I get blue screens only when gaming?
Load-related, so look at temperatures, power supply capacity and graphics drivers. Sustained load exposes marginal hardware that idles perfectly happily.
Can Windows Update cause blue screens?
Yes, usually by installing a driver that doesn’t suit your hardware. If they started right after an update, roll back the driver and block that specific update from reinstalling.
Gear We Recommend
Chasing crashes? Here’s the diagnostic kit and spares we keep to hand.
Browse our General Tech Accessories picks on AmazonAs an Amazon Associate, TechyGeeksHome earns from qualifying purchases
Disclosure: this post may contain affiliate links. If you buy through one of them, we may earn a small commission at no extra cost to you. We only recommend products we’ve tested or genuinely rate.
Discover more from TechyGeeksHome
Subscribe to get the latest posts sent to your email.
