Back up important files and create a restore point (search for "Create a restore point" in the Start menu). Photograph the blue screen, especially any file name shown next to "What failed". If Windows cannot start, see the startup guide.
Work through these checks
0 of 7 complete01Find the driver named in the crash
When Windows can identify it, it prints the name of the driver that tried to run the blocked code. That name tells you which software or device to fix.
- Look at your photo of the blue screen for a line such as "What failed: example.sys".
- If you did not catch it, open Event Viewer (Win + R, eventvwr.msc), go to Windows Logs > System and look for an Error event from BugCheck at the time of the crash. It shows the stop code and where the memory dump was saved.
- Search the .sys file name online to find which program or device it belongs to (for example a graphics, network, audio or antivirus driver).
You know which driver, and therefore which program or device, triggered the crash.
If it does not helpIf no driver is named, or the name is a core Windows file such as ntoskrnl.exe, the real cause is hidden. Continue with steps 3 to 7.
02Update, roll back or remove that driver
Most 0xFC crashes are fixed by replacing the driver that caused them.
- If the driver belongs to a device, download the latest driver from the device or PC manufacturer's website and install it.
- If the crashes started right after a driver update, open Device Manager (Win + R, devmgmt.msc), right-click the device, choose Properties > Driver > Roll Back Driver.
- If the driver belongs to a program, update the program or uninstall it from Settings > Apps > Installed apps.
Do not download drivers from driver-updater tools or unofficial download sites.
The PC runs normally through the activity that used to crash it.
If it does not helpIf the crash returns with the same driver name, contact that program's or device's support with the stop code and driver name.
03Remove recently installed system software
Antivirus suites, anti-cheat systems, VPN clients, RGB and fan-control tools and overclocking utilities all load their own kernel drivers, and conflicts between them are a common cause of this stop code.
- Open Settings > Apps > Installed apps and sort by install date.
- Uninstall security, VPN, anti-cheat or hardware-control software installed shortly before the crashes began, one program at a time.
- If you use two antivirus products, keep only one. Microsoft Defender turns on automatically when third-party antivirus is removed.
The crashes stop after a particular program is removed.
If it does not helpReinstall the latest version of that program later, or look for an alternative. If nothing changes, continue.
04Scan for malware
Malware that injects code into system memory can trigger the same No-Execute protection.
- Open Windows Security > Virus & threat protection > Scan options.
- Choose Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and scans before Windows loads.
Save your work first; the offline scan restarts the PC immediately.
The scan finds no threats, or removes what it finds.
If it does not helpIf threats were removed, change your important passwords from a different, clean device.
05Test the memory
Faulty RAM can corrupt driver code in memory, so a healthy driver ends up running from the wrong place.
- Press Win + R, type mdsched.exe and choose Restart now and check for problems.
- If you use a memory overclock profile (XMP or EXPO), turn it off in the BIOS before testing.
- For a more thorough test, run MemTest86 from a USB stick for at least four passes.
The test finishes without errors.
If it does not helpIf the test reports errors, see the memory test errors guide on this site before changing anything else.
06Repair Windows system files
Damaged Windows files can make a driver load incorrectly.
- Right-click Start and open Terminal (Admin).
- Run DISM /Online /Cleanup-Image /RestoreHealth and wait for it to finish.
- Then run sfc /scannow and restart the PC.
SFC reports that it found no integrity violations, or that it repaired them.
If it does not helpIf SFC cannot repair some files, run both commands once more after a restart.
07Use Driver Verifier to catch the driver
When the crash does not name a driver, Driver Verifier stresses third-party drivers so that the faulty one crashes the system in a way that names it.
- Create a restore point first and make sure you can start Windows in Safe Mode.
- Right-click Start, open Terminal (Admin) and run verifier. Choose Create standard settings, then Automatically select unsigned drivers or Select driver names from a list, selecting only drivers not provided by Microsoft.
- Restart and use the PC normally. When it crashes, note the driver name on the blue screen.
- Turn Driver Verifier off as soon as you have the name: run verifier /reset in Terminal (Admin), or from Safe Mode if Windows no longer starts, and restart.
Driver Verifier is a developer tool. It can make Windows crash at every startup until it is reset. Never leave it running.
A crash names the faulty driver, which you can then update or remove as in step 2.
If it does not helpIf you are not comfortable with repeated crashes, skip this step and give the crash details to the PC manufacturer or a technician.
Possible causes
- A faulty, outdated or incompatible driver
- Security, anti-cheat, VPN or hardware-monitoring software that installs its own drivers
- Faulty RAM corrupting driver code
- Malware tampering with system memory
Useful Windows tools
These commands open Windows tools. Review changes before applying them.
eventvwr.mscdevmgmt.mscmdsched.exeWas this helpful?
Your progress is saved on this device.