dxgkrnl.sys: Windows' Graphics Kernel on a Blue Screen

Why a blue screen names dxgkrnl.sys

• The graphics card's own driver, which Microsoft says is implemented by the hardware vendor and is called by dxgkrnl.sys.
• Microsoft's analysis of the root causes of crashes: 70% third-party driver code, 10% hardware, 5% Microsoft code and 15% unknown.
• A damaged Windows file, which the System File Checker repairs.

What to do when a blue screen names dxgkrnl.sys

The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.

1. 01

   Write down the stop code and the file the screen names

   Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.

   To undo: Nothing to undo: this only reads information.

2. 02

   Before you change anything: note the driver and make a restore point

   Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.

   To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.

3. 03

   Install the current graphics driver

   dxgkrnl.sys works with the display driver from the card's maker, and Microsoft's remedy for the graphics stop codes is an updated display driver. Get the driver for your exact graphics card from its maker, or from the PC maker's support page for a laptop, and install it.

   To undo: Open the display adapter's Properties > Driver tab in Device Manager and choose Roll Back Driver, or apply the restore point.

4. 04

   If it started after a driver update, roll the driver back

   In Device Manager, right-click the device, choose Properties, open the Driver tab and select Roll Back Driver, then give a reason and confirm. Microsoft notes that you need administrator rights, and that going back to the previous driver often fixes a problem that appeared after an update. The button is greyed out when Windows kept no earlier driver for the device.

   To undo: Rolling back is the undo for the update. To return to the newer driver, install it again with Update driver or from the manufacturer's package.

5. 05

   Install the latest Windows updates

   Select Start > Settings > Windows Update and choose Check for updates. It is one of Microsoft's basic steps for a stop code that keeps returning, and it is how new versions of Windows' own drivers arrive.

   To undo: If the crashes get worse after an update, apply the restore point from the earlier step.

6. 06

   Check Windows' own files

   dxgkrnl.sys is part of Windows, so there is no separate download for it. Open Command Prompt as administrator and run DISM.exe /Online /Cleanup-image /Restorehealth, then sfc /scannow. Microsoft says to run DISM first, and that sfc scans all protected system files and replaces corrupted ones with a cached copy.

   To undo: No undo is needed: the tools only put back Microsoft's version of a damaged Windows file.

7. 07

   If nothing helps, go back to a restore point

   Microsoft's last basic step is to restore Windows from a system restore point made before the crashes began, or to use one of its other recovery options.

   To undo: System Restore leaves personal files alone; programs and drivers installed after that restore point have to be installed again.

Check it yourself

1. 01

   See whether a driver on your PC is running from this file (PowerShell)

   Shows the driver service that loads the file, whether it is running and its exact path. No output means no driver service on your PC points at this file. Nothing is changed.

   Get-CimInstance Win32_SystemDriver | Where-Object PathName -like '*\dxgkrnl.sys' |
     Format-List Name, State, StartMode, PathName

   PowerShellCopy
2. 02

   Read the company and version from the file itself

   Every copy on the PC is listed, including copies waiting in the driver store.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter dxgkrnl.sys -ErrorAction SilentlyContinue |
     ForEach-Object { $_.VersionInfo } | Format-List FileName, CompanyName, FileDescription, FileVersion

   PowerShellCopy
3. 03

   Check the signature

   Status should be Valid. The table above shows who signed the file on the test PC.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter dxgkrnl.sys -ErrorAction SilentlyContinue |
     Get-AuthenticodeSignature | Format-List Path, Status, SignerCertificate

   PowerShellCopy