Windows Blue Screen: How to Read the Code and Find the Culprit

What a stop code means

A stop code is the name Windows assigns to a type of failure. It is not the name of a faulty part but a pointer to a class of problem: access to unavailable memory, a hung driver, corrupted system structures.

Windows 10 and 11 show three things on the screen:

• The text name of the error, such as KERNEL_SECURITY_CHECK_FAILURE or VIDEO_TDR_FAILURE. This is the main thing to write down or photograph.
• Sometimes the name of the culprit file in the “What failed” line. If it is there, the diagnosis is essentially done: the file name points to the driver.
• A QR code and a link to a general help page. It is of little practical use and is not a personal diagnosis.

The logic matters: in 80 percent of cases the cause is a driver or RAM, not “Windows breaking”. That is why all further diagnostics revolve around which module was active at the moment of the crash.

Where to find the code if the screen flashed by

If the system restarts too quickly to read the code, there are three reliable sources, and all of them keep a history of crashes.

Event Viewer. Press Win+R, type eventvwr.msc, open “Windows Logs” — “System” and filter by the BugCheck source. Each entry contains the stop code and the error parameters.

Dump files. Windows writes a small memory dump to C:\Windows\Minidump and a complete one to C:\Windows\MEMORY.DMP. A fresh file dated to the crash is the main material for analysis.

Disabling automatic restart, so you have time to read the screen: “System Properties” — “Advanced” — “Startup and Recovery” — clear the “Automatically restart” checkbox. In the same place, check that “Small memory dump” is selected under “Write debugging information”. If it is set to “(none)”, no dumps are written, and this setting should be enabled after the very first crash.

If there are crashes but no dumps at all, the cause is usually one of three things: writing debugging information is disabled, the page file on the system drive is turned off or too small, or the drive has no free space.

How to find the faulty driver from a dump

A dump is the only way to get from the “class of error” to the name of a specific file. There are two routes: a quick one and an accurate one.

The quick route: BlueScreenView. This free NirSoft utility reads the contents of the C:\Windows\Minidump folder and shows a table of crashes: the date, the stop code and the list of drivers that were on the call stack at the moment of the crash. Suspects are highlighted in colour. This is enough to spot the same file name recurring across several crashes in a row.

The accurate route: WinDbg. The official Microsoft debugger. You open the dump, run the !analyze -v command and get a detailed breakdown with the likely culprit in the MODULE_NAME and IMAGE_NAME fields. It takes longer, but it is the route that gives an answer in difficult cases where the stack contains only system modules.

How to interpret the file name:

The rule is simple: if the same third-party driver name recurs across several dumps, start with it. If there is only ntoskrnl.exe everywhere, the problem is more likely RAM or power rather than a driver.

Table of common stop codes

Two codes stand apart. WHEA_UNCORRECTABLE_ERROR is a message from the hardware, not from Windows: reinstalling the system will not help here, you need to look for a faulty component, an unstable overclock or a power problem. INACCESSIBLE_BOOT_DEVICE often appears not because of a failure but after storage settings were changed in UEFI.

Diagnostic order: from simple to complex

If the stop code is different every time, that in itself is a diagnosis: this is how faulty RAM, unstable power and overheating behave. Check in this order.

1. Remember what changed before the crashes. A driver update, a new device, a Windows update, enabling an overclock, a clean-up. The cause is almost always the latest change, and rolling it back solves the problem faster than any diagnostics.
2. Remove the overclock. XMP and EXPO memory profiles, any CPU and graphics card overclock. This does not mean the overclock is to blame, but it has to be ruled out before anything else: with it, the results of the other tests are unreliable.
3. Test the RAM. The built-in mdsched.exe test gives a rough check, MemTest86 from a bootable USB drive a thorough one. A single error already means a fault. With several modules, test them one at a time.
4. Check temperatures under load. Throttling by itself does not cause a blue screen, but an overheated graphics card is a common cause of VIDEO_TDR_FAILURE, and an overheated CPU of CLOCK_WATCHDOG_TIMEOUT.
5. Check the storage drive. SMART readings, free space, no errors. The chkdsk C: /f /r command checks the file system but does not replace a drive health check.
6. Repair system files. In a Command Prompt with administrator rights: sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth. This treats the consequences rather than the cause, but it removes corruption that can trigger crashes on its own.
7. Reinstall the driver the dump pointed to. For a graphics card, do a clean install with the previous version fully removed, not over the top of it.
8. Check the power supply. If crashes happen only under load and the code is different every time, power is one of the main suspects, especially with units older than six or seven years.

A separate tool for difficult cases is Driver Verifier (verifier.exe). It deliberately stresses drivers and makes the system crash on the culprit straight away. The tool works but is risky: once it is enabled, the system may stop booting, so use it only if you know how to disable it from Safe Mode.

How to tell a driver problem from faulty hardware

This is the key question, because the answer determines whether you spend time or money. The signs differ quite clearly.

More likely a driver or the system:

• The stop code is always the same, and the dumps repeat the name of one third-party driver.
• Crashes are tied to a specific action: launching a game, connecting a device, watching a video.
• It all started after a driver or system update.
• There are no crashes in Safe Mode, where third-party drivers are not loaded.

More likely hardware:

• The stop code is different every time.
• The dumps contain only ntoskrnl.exe or hal.dll, with no third-party modules.
• There is a WHEA_UNCORRECTABLE_ERROR.
• Crashes happen in Safe Mode as well as during system installation.
• MemTest86 reports errors.
• Crashes began after the machine was moved, cleaned or hit by a power surge.
• Other symptoms have appeared alongside: image artefacts, clicking from the drive, unusual noises from the power supply.

If the signs point to hardware, further DIY diagnostics run into the lack of spare components to swap in. This is where it makes sense to book a service appointment: swapping the memory, power supply and graphics card for known-good parts settles the question in one visit rather than a week of experiments.

What to do if Windows will not boot at all

When the blue screen appears before the desktop loads, the order is different.

• Boot into Safe Mode. If the system works there, the cause lies in third-party drivers or services, and it can be fixed from inside.
• Use a restore point, if you have one. It is the fastest way to roll back to the state before the crash.
• Roll back the latest update through the recovery environment if the crashes started right after it.
• Check the storage settings in UEFI if you see INACCESSIBLE_BOOT_DEVICE: the controller mode may have changed after a settings reset or a battery replacement.
• Repair the bootloader with the bootrec /fixmbr, bootrec /fixboot and bootrec /rebuildbcd commands from the recovery environment.
• Physically disconnect everything non-essential: additional drives, expansion cards, peripherals. Leave one memory module. This is the classic way to isolate a faulty component without instruments.

What does not help

Three actions that are widely recommended but usually do not solve the problem.

• Reinstalling Windows “just in case”. If the hardware is faulty, the crashes will return, and the time and data will be lost. Diagnose first, reinstall later.
• Cleaning the registry with utilities. It has nothing to do with blue screens but adds risks of its own.
• Installing “driver packs”. Drivers should come from the component or motherboard manufacturer. Bundled installers are a common cause of exactly the crashes they are installed to fix.

When to take the machine to a service centre

There are situations where DIY diagnostics statistically do not pay off:

• A WHEA_UNCORRECTABLE_ERROR code and similar hardware errors.
• MemTest86 has found memory errors, but there are several modules and the faulty one needs to be isolated.
• Crashes occur only under load, and the power supply is suspected.
• The machine is under warranty: taking it apart yourself may void it.
• Image artefacts together with blue screens, which means the graphics card is suspected.

At technical service, diagnostics include testing the memory, storage and stability under sustained load, with suspect components swapped for known-good ones. If it turns out the hardware is fine and the machine simply lacks the resources for new tasks, see the calculation in our article upgrade or new PC.

Recommended