Windows blue screen stop codes: how to read and what to try

A blue screen is Windows stopping itself on purpose. When the system hits a condition it cannot safely recover from, it halts to protect your files and the operating system. Microsoft calls this a bug check or stop error. The screen looks alarming, but it carries one useful clue: the stop code.

What the blue screen tells you

Microsoft's support page describes the message as something like "Your device ran into a problem and needs to restart." The color and wording vary by Windows version. The parts worth writing down are:

• The stop code: a name in capitals with underscores, shown near the bottom, such as PAGE_FAULT_IN_NONPAGED_AREA or MEMORY_MANAGEMENT.

• What failed: when Windows can tell, it also shows the name of the module that was running, often a driver file ending in .sys.

A sample of what you might see (synthetic):

Your device ran into a problem and needs to restart.

Stop code: DRIVER_IRQL_NOT_LESS_OR_EQUAL

What failed: northgatenet.sys

Take a photo of the screen with your phone if you can. It may restart before you finish reading.

Stop code names and numbers

Each stop code has a name and a hexadecimal number. Microsoft's Bug Check Code Reference lists both. A few that people search for often:

• 0x0000000A: IRQL_NOT_LESS_OR_EQUAL

• 0x0000001A: MEMORY_MANAGEMENT

• 0x0000003B: SYSTEM_SERVICE_EXCEPTION

• 0x00000050: PAGE_FAULT_IN_NONPAGED_AREA

• 0x0000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

• 0x000000D1: DRIVER_IRQL_NOT_LESS_OR_EQUAL

• 0x000000EF: CRITICAL_PROCESS_DIED

• 0x00000124: WHEA_UNCORRECTABLE_ERROR

• 0x00000133: DPC_WATCHDOG_VIOLATION

• 0x00000139: KERNEL_SECURITY_CHECK_FAILURE

The reference pages behind each code are written for programmers, as Microsoft points out. They are still worth a glance: the remarks section often has a plain list of things to check. For 0xD1, for example, Microsoft says the error is usually caused by drivers that used improper memory addresses, and suggests checking the System log in Event Viewer and updating or disabling the driver named on the screen.

What usually causes it

Microsoft's own analysis of crash root causes, published in its stop error troubleshooting article, found that:

• 70% are caused by third-party driver code.

• 10% are caused by hardware issues.

• 5% are caused by Microsoft code.

• 15% have unknown causes, because the memory is too corrupted to analyze.

The same article notes that an ordinary app can trigger a stop error but is rarely the root cause; it usually exposes a problem in a driver, hardware or the system itself. So the first question is: what changed recently? A new graphics card, a docking station, a VPN, antivirus software or a driver update are common suspects.

What to try, in order

Microsoft's support page says many one-time restarts are not repeated. If the same stop code keeps coming back, it suggests these steps for Windows 10 and 11:

1. Remove recent hardware. Disconnect anything you added shortly before the problem started, then restart.

2. Use Safe Mode if needed. If the PC will not start normally, start it in Safe Mode and continue from there.

3. Check Device Manager. Look for devices with a warning icon, update their drivers, and disable or uninstall the device if that does not help.

4. Free up space. Microsoft recommends roughly 10 to 15 percent free space on the drive.

5. Install Windows updates through Windows Update.

6. Restore Windows from a restore point or another recovery option if nothing else works.

If the screen names a driver file, the hardware or software maker that supplies it is usually the place to get an update. If you are not sure who makes it, search the file name on the vendor's own support site rather than on download sites.

Finding the stop code after the restart

If you missed the screen, Windows keeps records:

• Event Viewer: the System log usually records the bug check after the restart. Our guide to reading Windows Event Viewer logs shows how to filter for it.

• Dump files: Microsoft's article lists where Windows saves memory dumps. Small dumps go in the Minidump folder inside your Windows folder (%SystemRoot%\Minidump), and larger ones are saved as MEMORY.DMP in the Windows folder itself.

Dump files are for deeper analysis with Microsoft's WinDbg debugger, where the !analyze -v command summarizes the crash and often names the module involved. That is advanced territory, and Microsoft itself warns it can be very challenging without programming experience. Note too that dump files hold a snapshot of memory, which can include personal information, so think before sending one to anyone.

When to get hands-on help

If crashes continue after the steps above, especially with different stop codes each time, the cause may be hardware such as memory or storage. A qualified repair technician, your device maker's support line or your workplace IT team can run hardware diagnostics. Bring the photo of the screen, the dates of the crashes and a list of recent changes.

Get a second pair of eyes on the crash details

EasyToDecode is launching soon. You will be able to upload a photo of the blue screen or paste the Event Viewer entry, and it will quote the stop code and module, explain them in plain English, flag what is missing, and suggest what to try first and what to ask your device maker or IT team. See how it works or join the waitlist to hear when it opens.