Blue Screen of Death: What the Stop Code Is Telling You, and When to Worry
A blue screen once is a hiccup; every day is a pattern. Photograph the stop code before it restarts. Most repeating blue screens are a driver (fix it), bad memory (a small part), or a failing drive (stop restarting, back up first). Unplug the extras, roll back the last change, run the Windows memory test, and call if the code names the drive.
The blue screen is Windows pulling the emergency brake. Something low in the system, a driver or a piece of hardware, did something Windows cannot trust, so it stops everything rather than risk your files. That sounds dramatic. In practice, it is one of the more honest failures a computer has, because it tells you what happened if you know where to look.
First: once, or over and over?
One blue screen after an update, then weeks of quiet, is a hiccup. Note the code and move on. A blue screen every day, or every time you do one particular thing, is a pattern, and patterns have causes. The rest of this post is about the pattern.
The one thing to do while it is on screen
Take a photo of it with your phone. The line that matters is the stop code, written in capitals with underscores, and sometimes a file name ending in .sys underneath it. That code is the whole diagnosis in one line. By the time it restarts, it is gone, and reconstructing it later is real work.
Three things to try before you call anyone
- Unplug everything but the power. A bad USB hub, a webcam, a printer cable, even a cheap USB stick can crash Windows through its driver. Run for a day with nothing attached. If the crashes stop, plug things back one at a time.
- Roll back the last change. If it started right after a new program, a new device, or an update, undo that first. Windows keeps the previous driver; Device Manager has a Roll Back button for exactly this.
- Run the memory test. Windows has one built in. Search for Windows Memory Diagnostic, let it restart and run. If it reports errors, you have your answer and it is a cheap one.
What it usually turns out to be
Almost every repeating blue screen I see lands in one of three buckets.
- A driver. The most common by far. Graphics drivers lead the list, then wireless, then whatever came with a gadget you plugged in. Codes like DRIVER_IRQL_NOT_LESS_OR_EQUAL, SYSTEM_THREAD_EXCEPTION_NOT_HANDLED, and VIDEO_TDR_FAILURE point here, and the .sys file name under the code usually names the guilty driver outright. I wrote up one of these in the graphics card post.
- The memory. A RAM stick with a bad cell corrupts whatever happens to land on it, so the crashes look random and the codes vary. MEMORY_MANAGEMENT, PAGE_FAULT_IN_NONPAGED_AREA, and IRQL_NOT_LESS_OR_EQUAL show up a lot. The fix is a stick of memory, and on most machines that is a small part. See memory upgrades.
- The drive. This is the one to take seriously. CRITICAL_PROCESS_DIED, UNMOUNTABLE_BOOT_VOLUME, KERNEL_DATA_INPAGE_ERROR, and NTFS_FILE_SYSTEM often mean Windows tried to read a file and the drive could not deliver it. A drive that is starting to fail crashes Windows before it fails completely. That is the warning window.
The case where you stop and call
If the code is one of the drive codes above, or the machine has gotten slower and started making a clicking or grinding sound, or files have started opening as gibberish, stop restarting it. Every restart is another pass over a drive that is losing the fight. The first job is a copy of your files, before any fix is attempted. That is not caution for its own sake. It is the difference between a routine copy and a very expensive one.
What I do in the first ten minutes
Windows keeps a record of every crash. I read the last several to see whether the same code and the same driver keep showing up, which is a driver, or whether it is a different code each time, which is memory or the drive. Then I check the drive's own health report, which most people never see and which usually knows it is failing before Windows does. From those two things I can usually say which bucket it is before touching a screwdriver. The blue screen and crash repair page describes the service; the pricing page shows how the visit works.
Fix it or replace it?
Driver: fix it, always. Memory: fix it, it is a small part. A failing drive: replace the drive, which on an older machine is also the best upgrade it will ever get, since a new solid state drive makes a slow computer feel new. A blue screen is almost never a reason to replace a computer by itself. If the machine is old and slow and also crashing, that is a different conversation, and I have written about where that line is.
What I'd tell a neighbor
Photograph the code. Unplug the extras. Run the memory test. If the code is about the drive, or the machine has started clicking, do not keep restarting it, call. Most blue screens are a driver and a fifteen-minute fix. The ones that are not are the ones that reward acting early.
Questions people ask
What should I do when I see a blue screen?
Take a photo of it with your phone. The stop code in capitals, and any .sys file name under it, is the diagnosis. It disappears when the computer restarts.
What causes most blue screens?
Three things: a driver, most often graphics or wireless; a bad stick of memory; or a drive that is starting to fail. The stop code usually points at one of them.
Is a blue screen a sign my hard drive is dying?
It can be. Codes like CRITICAL_PROCESS_DIED, UNMOUNTABLE_BOOT_VOLUME, and KERNEL_DATA_INPAGE_ERROR often mean the drive could not deliver a file. If you see those, or hear clicking, stop restarting and get the files copied first.
Do I need a new computer if it keeps blue screening?
Almost never. A driver is a quick fix, memory is a small part, and a failing drive gets replaced with a faster one. A blue screen alone is not a reason to replace the machine.