How do you find the cause of a Windows blue screen error?
Track down the real cause of a Windows 10 or 11 blue screen in about 30 minutes using dump files, Event Viewer and WhoCrashed.
Short answer
Write down the stop code shown on the blue screen (for example DRIVER_IRQL_NOT_LESS_OR_EQUAL). Keep dump logging enabled, then open the .dmp file in C:\Windows\Minidump with WhoCrashed or BlueScreenView. The driver file named in the report (for example nvlddmkm.sys) points to the culprit. If no driver is named, run a RAM test and check the drive.
What you need
Step by step
Record the stop code
Photograph the screen with your phone as soon as the blue screen appears. Note the "Stop code" line at the bottom and any file name shown, such as ntoskrnl.exe or atikmdag.sys. This code is the fastest way to tell whether the fault sits with a driver, with memory, or with other hardware.
Turn on dump logging
Type "View advanced system settings" in Start and open it, then on the Advanced tab click Settings under "Startup and Recovery". Under "Write debugging information" choose "Small memory dump (256 KB)" and clear the "Automatically restart" checkbox. That way the file gets created and you also get time to read the screen.
Locate the minidump file
In File Explorer type C:\Windows\Minidump in the address bar and press Enter. Find the .dmp file whose date and time match the crash; it is usually 100-800 KB. An empty folder means dump logging was off, so wait for the next crash.
Read the dump file
Download BlueScreenView from nirsoft.net and run the portable file, no install needed; it scans the Minidump folder automatically. Look at the "Caused By Driver" column and the entries highlighted in red in the lower pane. For a plain-language report, install WhoCrashed Home Edition from resplendence.com and press Analyze.
Confirm it in Event Viewer
Type "Event Viewer" in Start and open it, then go to Windows Logs > System. Use "Filter Current Log" on the right to select the Error and Critical levels, and look for BugCheck or Kernel-Power 41 in the Source column. Errors logged just before the crash usually reveal the real trigger.
Update or roll back the suspect driver
Search the web for the .sys file from the report to learn which device it belongs to. In Device Manager right-click that device, open Properties > Driver and use "Roll Back Driver", or install a fresh driver from the manufacturer's site. For graphics drivers, a clean removal with DDU is the safest route.
Test memory and the drive
If the report only names ntoskrnl.exe, move on to hardware testing. Type "Windows Memory Diagnostic" in Start and run it; the PC restarts and tests for 15-30 minutes. Then open Command Prompt as administrator and run chkdsk C: /f /r followed by sfc /scannow; together they take 40-90 minutes.
Narrow it down with Driver Verifier
If the cause is still unclear, type verifier in an administrator Command Prompt, choose "Create custom settings" > "Select individual settings from a full list", tick the standard tests and select non-Microsoft drivers. The PC will crash more often on purpose and write the guilty driver into the dump. Run verifier /reset when you are done.
Tips
Watch out
After you enable Driver Verifier the PC may crash on every boot. If that happens, the system will not start normally until you enter Safe Mode and run verifier /reset. Also, do not run chkdsk /r while the cause is still unknown unless you have backed up important files to an external drive; on a failing drive the scan can accelerate data loss.
Frequently asked questions
+The Minidump folder is empty, what should I do?
That means dump logging is off or the C drive is out of space. Enable "Small memory dump" in advanced system settings, leave the page file on system-managed, keep at least 5 GB free and wait for the next crash.
+BlueScreenView only shows ntoskrnl.exe, is that the cause?
No, ntoskrnl.exe is the Windows kernel and shows up in almost every crash. In that case the problem is usually RAM, the drive or the power supply, so move on to memory diagnostics and chkdsk.
+How often is a blue screen considered normal?
There is no normal frequency, but a one-off crash roughly once a month is usually a transient driver fault. More than one crash a week means you should investigate a hardware or driver problem.
+Will resetting Windows fix the problem?
It fixes software and driver causes but not hardware failures. Analyse the dump before resetting; if it points to a RAM or drive fault, a clean install is wasted effort.
+Do I need a repair shop, and what does it cost?
If memory diagnostics report errors or the PC crashes even in Safe Mode, a repair shop makes sense. Independent shops typically charge a diagnostic fee in the range of a modest hourly rate, parts not included.
Sources and verification
Last verified: September 15, 2026. tell us. Menu names follow the English Windows 10/11 interface; the source repair-cost figure was specific to Turkey and has been generalised.
This content is for information only; for official procedures the relevant institution’s current announcements take precedence. Details: disclaimer.