How to Fix a Blue Screen of Death on Windows 10 / 11
How to Fix a Blue Screen of Death on Windows 10 / 11
The blue screen of death (BSoD) or Windows stop error can be incredibly frustrating, but it can be fixed. The trick is knowing what went wrong in the first place. There can be a lot of different causes, so in this video I will show you how to troubleshoot it using event logs, the error code, and a memory dump. I will also show you how to use safe mode, msconfig, chkdsk, system restore, and sfc to fix a computer where Windows 10 or Windows 11 won’t start.
➡️ List of Error Codes:
https://www.lifewire.com/blue-screen-…
➡️ WhoCrashed Tool:
https://www.resplendence.com/whocrashed
➡️ WinDbg (Modern Version):
https://www.microsoft.com/store/p/win…
➡️ Windows SDK:
https://developer.microsoft.com/windo…
➡️ Windows 10 Download / Media Creation Tool:
https://www.microsoft.com/software-do…
➡️ Windows 11 Download / Media Creation Tool:
https://www.microsoft.com/software-do…
💬 Follow Me
https://twitter.com/AndrewMRQuinn
The Pro Tech Show provides tech, tips, and advice for IT Pros and decision-makers.
Video timestamps:
0:00 - Introduction and Common Causes
1:53 - Easy Fixes to Try First
3:10 - Stop Code and Event Logs
5:41 - Debugging Memory Dumps
11:42 - Fixing Driver and Hardware Faults
13:31 - When Windows Won’t Start
15:13 - Repairing Filesystem Corruption
17:51 - Repairing System Files and Closing Thoughts
#Windows10 #BlueScreenOfDeath #BSoD # BlueScreen #BlueScreenError
Content
0.4 -> You're happily using your computer when this
happens. Yes, my friends: the Windows stop error;
6.64 -> more commonly known as the blue screen of
death. The good news is a quick Google search
10.88 -> will turn up hundreds of suggested fixes for
it... the bad news is that you've probably tried
15.6 -> them all and they probably didn't work. If
you want to know how to actually fix this,
20.08 -> you need to know how to troubleshoot it; so
it's a good job I made a video to show you!
33.04 -> Welcome back to the Pro Tech Show. This is
one of those videos that's going to be useful
37.12 -> whether you work in IT or not. If you use Windows
you've probably experienced this at some point.
43.44 -> So what is the blue screen of death? It's basically
Windows tapping out. It's Windows' way of saying
49.84 -> "Something has gone horribly wrong and I can't
recover from it. I'm bailing". The actual cause
54.72 -> can be almost anything. It can be a bug in Windows
itself, or third-party software, failing hardware,
60.72 -> data corruption... drivers are a big culprit. In
fact, do you remember Windows Vista? It quickly
65.76 -> gained a reputation for being a crashy, bug-ridden
mess; but was it really Vista's fault? Partly, yes;
72.24 -> but actually, a lot of it wasn't. Microsoft
accounted for nearly 18 percent of crashes, but
76.8 -> what about the other 82 percent? Well, it turns out
NVIDIA drivers accounted for nearly 30 percent
81.92 -> of all crashes in the first year. Quite impressive
considering the large majority of Vista PCs didn't
87.28 -> actually have any NVIDIA hardware! Not exactly team
green's finest moment, but Vista took the blame.
93.84 -> Because the actual cause of these bluescreens can
vary wildly you need to troubleshoot your specific
99.28 -> problem on your specific device. If you try random
fixes you found on the internet your chances of
104.4 -> success aren't that good, because you're basically
hoping to win the crash lottery. That said,
110.08 -> let's get some low-hanging fruit out of the way. I
know a lot of the people who watch this channel
114.32 -> are much more experienced with computers than
the average person, and may be more inclined to
118.72 -> tweaking as a result. If you've tweaked anything
into a non-standard state: if you've overclocked
123.84 -> your hardware or undervolted it; then before you
do anything else return it to stock settings.
129.2 -> You will kick yourself later if you spend hours
troubleshooting Windows only to find out it was
133.44 -> your own unstable overclock that caused it; so
take that out of the equation right from the
138.08 -> start. You might want to try unplugging
any non-essential USB devices as well.
142.8 -> Faulty hardware can cause bluescreens so if
you can easily pull a few cables to rule it out,
147.44 -> go for it. Obviously, if you know you did something
to cause the bluescreen... undo it. If you installed
153.6 -> something just before it crashed, uninstall it. If
you can't do that because Windows crashes before
158 -> you get that far, stick around because I'll
be showing you what to do about that later.
162.48 -> Another thing that's always worth trying is
installing any available software and driver
166.48 -> updates. You might get lucky and find
a vendor has already issued a fix.
171.36 -> Do not, I repeat do not attempt to update your BIOS
unless you know that is actually the fix. If your
178.4 -> computer crashes part-way through that process you
may not be able to recover it without physically
182.48 -> replacing the hardware. I'm going to assume none of
those suggestions fixed it for you, though; because
187.92 -> otherwise this video is basically over. I'm
also going to make an assumption (for now)
192.48 -> that you can boot into Windows. If your computer
is crashing before you get to Windows I will cover
197.68 -> that later in the video as well. The first thing
we need to do is gather some information. On the
203.04 -> bluescreen itself there should be a stop code, and
it might even tell you what file caused the error.
207.76 -> Make a note of that because it's a clue to the
cause of the problem. If you missed it don't
212.08 -> worry - we can still find out what it said. To do
that we need to take a look in the event log.
217.68 -> An easy way to get to this is to right-click
on your Start menu and select Event Viewer.
223.28 -> From there expand Windows Logs and select System.
There's going to be a lot of information in here
229.68 -> but we're looking for a specific entry. The
event level will be "Error", the source will be
235.92 -> "BugCheck", and the event ID will be "1001". The time
of the event should be just after your computer
242.88 -> started back up. You can filter the log to find it
more easily but it can be useful to see all the
247.76 -> events surrounding it. If you can spot where the
crash occurred you can have a look at events in
252.16 -> the System and Application logs around the time
of the crash to see if they give you any clues.
258.08 -> It is fairly normal to see a number of warnings
and errors in here so don't panic, but if you see
262.8 -> something consistently erroring out immediately
before a crash you might want to take a look
266.96 -> into that particular message a bit more closely.
Whatever application logged it might be the source
271.68 -> your problems. For now, though; back to your
bugcheck event. If you read the detail it will say
276.8 -> "The bugcheck was" followed by a bunch of numbers
and letters starting with "0x". Take that first set
282.32 -> of numbers and letters before the brackets. That is
the hexadecimal error code that matches the error
287.44 -> on the bluescreen. If you pop that into Google you
can find out what the bluescreen said. I'll link a
292.88 -> list of possible values in the video description
to save you Googling them all, though.
297.36 -> That error code might be enough to point you
in the right direction. Most of the time it'll
301.44 -> probably lead you towards a driver issue, which
isn't particularly useful because it can still
305.76 -> be almost anything at that point. You might get
lucky, though; and have a more specific error.
312 -> If it mentions a file system for example,
then it's talking about your hard drive.
316.48 -> A file system error could be caused by a
storage driver, a failing drive, a failing
321.28 -> storage controller (which for most home users would
mean your motherboard), or it could be file system
326.16 -> corruption. If it's a disk you need to back it up
and replace it ASAP. If it's file system corruption...
333.12 -> well a lot of the time file system corruption will
actually prevent Windows from booting so I'm going
336.8 -> to cover that one later in the video when I
talk about what to do if Windows won't boot.
341.04 -> The most likely outcome in my experience, though;
is that your error code will lead you towards a
345.36 -> driver problem. The next step therefore is
to figure out which driver caused the crash
350.32 -> and the event log probably won't be enough to
tell you. For that we're going to need a dump.
356.88 -> A memory dump! Usually this will be created
automatically when Windows bluescreens,
362.48 -> but you might need to enable this first then wait
for it to crash again. To check if memory dumps are
368 -> enabled, right-click on your Start menu and select
System. The interface here has changed a bit in
373.36 -> recent updates for Windows but you're looking
for the "Advanced system settings" option. This
377.68 -> is probably on the right-hand side or the bottom
of the page. If you're running an older version of
382.32 -> Windows you might have already landed straight at
this location. If it says "System Properties" in the
387.2 -> title, you're in the right place. On the Advanced
tab click the Settings button under Start-up and
392.24 -> Recovery. Under the "Write debugging information"
section make sure the drop-down isn't set to "none".
398.88 -> If it is change, it to "Automatic memory dump" and
OK your way back to the desktop. With that set
405.2 -> your computer will generate a memory dump the next
time it bluescreens. Depending on what option you
410.16 -> selected you might get a large dump file located
at C:\Windows\MEMORY.DMP. That will have the most
415.84 -> debugging information. If that file doesn't exist,
the other place you can look is in C:\Windows\Minidump
421.733 -> for a smaller dump file that also gets
created. OK, we've got our dump. How do we use it?
428.72 -> Analysing a memory dump can get quite technical,
but I'm going to show you some simple steps to
433.12 -> get a bit of useful information from it. There are
some websites you can upload these to but I don't
437.6 -> recommend that. A memory dump can contain whatever
was in your computer's memory, and that could mean
442.8 -> sensitive or personal information. To be safe,
do the analysis yourself. If you're a home user
448.96 -> the easiest thing to do is install a tool called
WhoCrashed. I'll link it in the video description.
453.76 -> This is free for home use, but if you're
doing this for a business you have to pay.
457.84 -> Don't worry, I'll show you another tool that's
free for everyone in just a minute. The reason
462.88 -> I'm suggesting this tool is simply because it's
really easy to use without any technical knowledge.
467.92 -> Just open it click the Analyze button. It will
find your memory dump files, do a quick analysis,
473.68 -> and give you a readable enough summary. If you look
at my example here you can see it has found that
478.64 -> IRQ level error code that we saw before ,and it
reckons the file myfault.sys caused the problem.
484.48 -> It goes on to tell you that that file belongs
to your product called Sysinternals Myfault.
489.04 -> If you're wondering what the heck that is, it's
a tool called NotMyFault by Sysinternals that
494.16 -> deliberately crashes your computer by creating an
unrecoverable driver fault. Not a piece of software
499.52 -> you'd normally want to use, but perfect if you want
to deliberately crash a computer so you can record
504.4 -> a video showing people how to troubleshoot it.
Now that WhoCrashed tool is really easy to use,
509.36 -> but it's not free for commercial use. There is a
tool from Microsoft you can use for free anywhere,
514.8 -> and it will give you more information as well. That
tool is called the Windows Debugger, or WinDbg, or
521.12 -> Win Debug. You may have come across this before
and remembered it being a pain to find and use.
526.48 -> You had to find the Windows Software Development
Kit, download it, then untick every single box other
531.52 -> than "Debugging tools for Windows" because you only
actually wanted that tiny piece of a fairly large
536 -> package of tools. Then once you've installed it you
had to configure your symbol path, and you ended up
540.16 -> with this archaic looking thing. Don't do that.
There's a better way. Open the Microsoft Store
546.72 -> and search for WinDbg. You'll find a modern
replacement that's just... better, and still free.
553.04 -> At the time of recording it's still in preview, but
don't mess about with the Software Development Kit -
557.52 -> just install this one. For completeness I'll
put links to both in the video description.
562.24 -> While you're down there, go on and click that
like button, and subscribe if you haven't yet.
566.8 -> When you open WinDbg, remember to run as
administrator. The tool itself doesn't actually
571.76 -> need administrator permissions to function, but
the location your memory dumps are created in is
576.16 -> only accessible to administrators so this will
just make life easier for you. The first nice
581.12 -> feature you'll notice if you're used to the old tool is
that it automatically detects a recent crash and
585.36 -> asks if you want to open the dump. Yes I do! If it
hadn't detected the dump file automatically you'd
592.56 -> load it by clicking on the File menu and selecting
"Open dump file" under "Start debugging". Wait for it
598.16 -> to warm up a bit and when you see this blue text
that says "!analyze -v" you're ready
603.68 -> to go. Click on that text and wait for it to
do its thing. You'll see a progress bar at the
608.56 -> bottom while it's running (another improvement
over the old one). This tool spits out a lot more
613.28 -> technical information the last one I showed, but
you can easily enough pull out some of the same details.
619.04 -> Here we have our IRQ level error from before, and
if you scroll down we're looking for this bit
623.36 -> where it gives you the module name and the image
name. The image name is the file that caused the
627.52 -> crash. We can see the same file name myfault.sys
as before. If we click on the underlined module name
633.12 -> it may spit back a bit more information about the
product it belongs to. In this case it hasn't given
637.84 -> us much new information, but as long as we know
the name of the file we can pop it into Google
641.84 -> and figure out what it is. There we go: it's
a Sysinternals tool called NotMyFault.
647.6 -> A bit more work to get the information that with the
WhoCrashed tool; but not that difficult if you don't
652.48 -> want to pay for it in a business use case, or you
simply don't want to install a third-party tool.
657.04 -> The additional information provided by WinDbg
can also be helpful for trickier issues.
662 -> Let me cause a different type of crash. This
time, running that one through WhoCrashed
666.64 -> points a finger of blame at the NT kernel.
That's Windows itself. Although Windows did
672.24 -> crash, it crashed because I did something bad
to it, so this isn't actually that helpful.
677.12 -> If I run WinDbg against it; it
shows the same faulting image name,
680.88 -> but if I scroll back up and look at the
process name I can see what really caused it.
685.6 -> WinDbg doesn't try to give you the answer quite
as clearly, but the additional information can be
690 -> helpful if you don't get anywhere with WhoCrashed.
That said, sometimes WinDbg will output a line
695.6 -> that says "Probably caused by". If you see that in
the text that spits out, definitely pay attention
701.12 -> to it. So now we know what driver caused the crash,
what's next? Well, it depends what the driver is for.
707.68 -> If it's not actually something you need you
might simply uninstall the driver software or
711.52 -> remove the offending device and the problem goes
away. Assuming it is something you need you should
717.36 -> check on the manufacturer's website for a newer
version. It might be that you've updated Windows
721.92 -> and the driver you had is no longer compatible, but
downloading the latest version might fix it. That's
727.52 -> actually quite common. You might need to do a bit
of research here. It could be that this driver has
732.72 -> a conflict with something else in your computer.
Your best bet is to stuff a few search terms into
736.96 -> Google like "crash" and the name of the driver, to
see if anyone else is reporting similar problems...
741.76 -> and hopefully a fix. The final thing you should
bear in mind with drivers is that they're usually
746.4 -> written to provide an interface between Windows
and a physical hardware component. A driver that
751.44 -> keeps crashing is often a software problem,
but it can also indicate a hardware failure.
757.36 -> The software might be crashing because the
hardware it's talking to has malfunctioned.
761.36 -> If your graphics driver crashes, for example;
it could mean that your graphics card is dying.
766.48 -> Once you get into the realm of physical hardware
you can go down a rabbit hole. Your graphics
770.56 -> driver could be crashing because your graphics
card malfunctioned, but your graphics card might
774.08 -> have malfunctioned because your power supply is
undersized and couldn't supply it with enough
777.36 -> power under load. If it was right on the edge
before then simple aging might have pushed it over.
783.04 -> When it gets to troubleshooting hardware you
generally end up using a process of elimination
787.12 -> by removing or replacing components one at a time,
until you find the problem; but at least the crash
792.24 -> dump will have given you a place to start rather
than going in blind and hoping for the best.
796.56 -> Honestly, though; for the ones I've dealt with,
going onto the manufacturer's website and
800.56 -> installing the latest version of the driver
found in the crash dump fixes the problem more
804.88 -> often than not. Hardware failures definitely
happen, but software bugs are more common. But
811.36 -> what if your computer won't actually boot? These
tools I've showed you rely on you actually getting
816.24 -> into Windows to run them, right? The first
thing you can try is booting into safe mode.
821.44 -> You used to be able to mash F8 during start-up to get there, but that doesn't work on a modern system. After Windows
827.04 -> has repeatedly tried to load and fail, though; it
should present you with the option automatically.
831.52 -> You might be able to force this as well by holding
the power button to do an instant power-off whilst
835.44 -> it's booting a couple of times; but if you're at
the point where Windows won't boot you should
839.12 -> get the option automatically. Here's how it came up
for me. From here I'll hit F8 for start-up settings,
845.6 -> and four or five to enable safe mode with or
without networking. Safe mode loads Windows with
850.8 -> a minimal set of drivers and services so if something
is crashing so badly that Windows can't even start,
855.52 -> this might get you around it and let you continue
your troubleshooting. Safe mode without networking
860.4 -> is safer as it doesn't load your network drivers.
This can be handy if the network drivers are the
865.52 -> ones causing the crash, but it also means you have
no network... so no internet to download updated
871.52 -> drivers. You'll have to do that on another computer
and put them on a USB drive. If safe mode lets you
876.96 -> boot up, you've probably got a driver issue or some
dodgy software loading automatically at start-up.
882.32 -> If you type "msconfig" into the Start menu you can
selectively disable different components from
887.28 -> starting automatically. You can use a trial and
error approach to try starting up with different
891.76 -> components enabled until you figure out which one
caused the crash. This can take a while I'm afraid.
898.48 -> But what if you're bluescreening before you
even get into safe mode? It may just be properly
905.28 -> broken at this point, but a lot of the time
this is a symptom of file system corruption.
910.24 -> I told you be getting back to this one, remember? If
you can't boot into safe mode then you're going to
915.2 -> need to boot into something to fix this. Go to
another computer and use the Windows 10 Media
920 -> Creation Tool to create a Windows 10 USB install
drive or DVD. Link in the description, of course.
926.96 -> Take this back to your knackered computer and
boot from the USB or DVD you created. You may need
931.76 -> to change some settings in your BIOS to do this,
but usually there'll be a message that pops up
935.28 -> briefly when you start your computer telling you
to press a specific key to get to the boot menu. It
940.24 -> will usually be one of the function keys like F12,
or it could be the escape key or the delete key.
945.76 -> Once the Windows setup loads, select your language
and click "Repair your computer" over in the bottom-left.
951.353 -> Click "Troubleshoot"... now if I just interrupt my
own train of thought for a moment here...
955.082 -> If you know that you changed some software and that caused
the bluescreen you can use the "System restore" option
960.08 -> on this page to revert your system settings to
before that change. Assuming the necessary option
965.28 -> was enabled before you made the change. Let's
continue fixing our file system corruption, though.
970.4 -> Click "Troubleshoot" then "Command Prompt". If Windows
is booting fine at this point then you don't need
976.88 -> a special boot drive - you can open a command prompt
by typing "cmd" into the Start menu and running as
982.72 -> administrator. The command you need to run file
system repairs is chkdsk, spelt "chkdsk",
989.619 -> "C:", assuming windows is on the C drive.
Sometimes when you boot from another drive your
994.48 -> drive letters get messed around and Windows might
be on something other than C. An easy way to check
999.12 -> is to type "bcdedit" and hit Enter. Have a look
under "Windows Boot Loader" and if it says "partition="
1005.209 -> something other than "C:" then replace
C in these commands with that letter instead.
1011.04 -> Just running chkdsk by itself won't fix
anything - it will just check for corruption.
1015.28 -> To fix it you need to run "chkdsk C: /f".
If you've booted from a USB or DVD
1020.96 -> this will run now. If you've actually booted
Windows it can't run this repair now because
1025.28 -> the drive is in use, so it will schedule
the repair to run when you next reboot.
1029.44 -> If you have a mechanical hard drive rather than an
SSD I recommend running "chkdsk C: /r"
1035.52 -> instead of "/f". This will run a more extensive
repair that will attempt to recover bad sectors.
1040.72 -> It will take a lot longer, but I've seen this
fix bluescreens that the standard "/f" repair
1045.52 -> won't. If the act of running chkdsk causes the
computer to crash then I'm afraid the most likely
1050.88 -> explanation is that your hard drive is failing. Get
any data off it ASAP because it's only a matter of
1056 -> time before you lose it. A good way to do this is
to create a Linux live USB or live CD to boot from
1061.68 -> and use it to read the drive from outside
of Windows and copy the data somewhere else.
1065.68 -> How to do that is outside the scope of this
video, but if it's something you'd like to
1068.72 -> see then drop me a message in the comments.
One final thing you might try here, and I
1074.32 -> hesitate to suggest this because if you go on
a support forum you will see this suggested as
1078.8 -> the fix for almost every problem imaginable. I
swear there's some person who just copy-pastes
1084.24 -> the same suggestion onto every single post because
they've got nothing better to do! From the command
1089.92 -> prompt you can try running "sfc /scannow". That will scan
for and repair some system files. I have literally
1097.2 -> never seen that command fix anything, ever; but
it presumably worked for somebody, somewhere, once
1102.48 -> that they feel the need to post it as a suggested
answer to every single question that has ever
1106.64 -> been asked. If you're running this having booted
from USB or DVD it's a bit more complicated of
1111.76 -> a command that's needed, but the information
is in BCDEdit that I showed you before.
1116.96 -> The full command you'll need is
"sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows"
1128.216 -> replace "C" with the partition letter from BCDEdit and
"\Windows" with the system root from BCDEdit if they're different.
1135.12 -> And with that last act of desperation I'm going
to wrap this one up. If you follow these steps it
1140.08 -> should help you fix most blue screens of death, but
ultimately you may come to a point that needs some
1144.72 -> hands-on expertise rather than a YouTube video.
If you're still stuck, go get some help. Take it
1150 -> to a shop or someone you trust. Bluescreens can
have some really weird causes, so why don't you
1154.72 -> let me know in the comments: what is the weirdest
cause of a blue screen of death you've ever seen?
1159.68 -> I'm honestly a bit scared of what I might see
in the comments now, but come on... surprise me!
1164.48 -> If you found this video useful, give it a like
and consider subscribing if you haven't already
1168.32 -> done so. Also, click on one of these because I
know you're not ready to just let me go yet.
1174.88 -> I'm going to leave it there for now.
Thanks for watching, guys. See you next time!
Source: https://www.youtube.com/watch?v=odZsRBMBXB0