FIX · CRASHES AND BLUE SCREENS
ntoskrnl.exe blue screen: why it is rarely the real cause
A crash tool names ntoskrnl.exe and it looks like Windows itself is broken. Usually it is not. ntoskrnl.exe is the Windows kernel, every stop error passes through it, and Microsoft's own analysis puts most of them on third-party drivers and hardware. The useful question is what was running when the kernel stopped, and the crash data can tell you.
Updated .
TECHNICAL SUMMARY
| What it is | The Windows kernel, in System32, signed by Microsoft |
|---|---|
| Third-party driver code | 70% of crashes, by Microsoft's analysis |
| Hardware issues | 10% |
| Microsoft code | 5% |
| Unknown (memory too corrupted) | 15% |
| PC Tweaker plan | No control fixes a blue screen; Tweaky Driver lists your drivers |
What ntoskrnl.exe is
On Windows 11 its file description is NT Kernel & System, it sits in C:\Windows\System32 and it is signed by Microsoft Windows. Microsoft's driver documentation says Ntoskrnl.exe contains the actual implementations of the native system services that kernel-mode drivers call. It is not a program you can close or swap out, so do not download a replacement copy from a file site: System File Checker is the supported way to repair a damaged Windows file.
Why it gets the blame
A stop error is the moment Windows halts because continuing could compromise security or corrupt data, and the kernel is the code that performs that halt. In the crash analyses Microsoft publishes, the stack begins with nt!KeBugCheckEx whichever component was at fault. In one of its examples the kernel routines fill the top of the stack while the line that matters reads IMAGE_NAME: WwanUsbMp.sys, a third-party driver. Simple crash viewers can stop at the kernel and name it. Microsoft's figures for root causes are 70% third-party driver code, 10% hardware, 5% Microsoft code and 15% unknown because the memory was too corrupted to analyse. Elsewhere in the same article it estimates that about 75% of all stop errors are caused by faulty drivers.
Work through it in this order
These are Microsoft's general steps for stop errors, with the cheapest first. If the crashes started after a change, begin with that change.
- Write down the stop code and search for it, since many codes have a known cause
- Install the latest Windows updates
- Update the BIOS and firmware
- Run hardware and memory tests
- Scan for malware, including the master boot record
- Keep 10 to 15 percent of the disk free
- Update or roll back any driver the error names, and undo recent hardware or software changes
Find the driver in the dump file
Windows saves crash data as a memory dump: small dumps go to the Minidump folder under the Windows folder, and kernel, complete and automatic dumps to MEMORY.DMP. Open one in WinDbg, set the Microsoft public symbol server and run !analyze -v. Read IMAGE_NAME and MODULE_NAME before anything else. If they name a non-Microsoft driver, you have your suspect. If several crashes name different modules, Microsoft's analysis points to hardware as a harder case, because hardware problems can show up as erratic and unpredictable symptoms.
Driver Verifier: useful, and rough
When dumps do not name anything, Driver Verifier makes a bad driver fail in the open. Microsoft warns that it uses a lot of CPU, can slow the PC significantly and can cause additional crashes. Do not verify every driver at once: test recently updated or suspicious drivers, or groups of 10 to 20. If Windows will not reach the desktop, start in Safe mode, where the tool cannot run, and turn it off there.
Do it by hand
List your recent stop errors (read-only)
The message gives the bug check code and its four parameters. An error saying no events were found means Windows has not logged one.
PowerShellGet-WinEvent -FilterHashtable @{LogName='System'; Id=1001; ProviderName='Microsoft-Windows-WER-SystemErrorReporting'} -MaxEvents 5 | Format-List TimeCreated, MessageSee the saved dump files
Run as administrator if access is denied.
cmddir %SystemRoot%\Minidump dir %SystemRoot%\MEMORY.DMPRead the dump in WinDbg
Install WinDbg, open the dump with File, Open Crash Dump, then enter this at the prompt. Look for IMAGE_NAME and MODULE_NAME.
!analyze -vRepair Windows files (as administrator)
Microsoft's System File Checker scans for corrupted Windows system files and restores them.
cmdsfc /scannowTest the memory
Opens Windows Memory Diagnostic, which restarts the PC to run. Save your work first.
cmdmdsched.exe
With PC Tweaker
PC Tweaker does not read crash dumps, and none of its controls fixes a blue screen. Once you know which driver is at fault, Tweaky Driver, our free driver update checker, shows each device's driver version, the updates available and where the package comes from before you install anything.
Rather not edit the registry by hand?
PC Tweaker shows the exact change before it runs, records the value it replaces and puts it back with Restore. The Free plan needs no account. If a payment fails or a plan ends, Pro tools lock; changes already applied stay as they are and Restore still undoes them.
Common questions
Is ntoskrnl.exe a virus?
The genuine file is the Windows kernel, in C:\Windows\System32, signed by Microsoft Windows. A crash report that names it does not suggest malware. Run a scan if the file is anywhere else or the signature is not Microsoft's.
Why does my blue screen say ntoskrnl.exe?
The kernel is the code that halts Windows, so it appears in every crash. Microsoft's analysis attributes 70% of crashes to third-party driver code, 10% to hardware and 5% to Microsoft code, with 15% unknown.
How do I fix an ntoskrnl.exe blue screen?
Note the stop code, install Windows updates, update the BIOS and firmware, test the hardware and memory, keep 10 to 15 percent of the disk free, and update or roll back any driver the error names. A dump file read with !analyze -v can name the driver.
Should I download a new ntoskrnl.exe?
No. Run sfc /scannow as administrator, which is Microsoft's tool for restoring corrupted Windows system files.
Try PC Tweaker
Free download for Windows 10 and Windows 11.