wdf01000.sys: The Windows Driver Framework on a Blue Screen

Why a blue screen names wdf01000.sys

• A device driver built on the framework: Microsoft describes such a driver and wdf01000.sys as a pair that forms one driver.
• Microsoft's analysis of the root causes of crashes: 70% third-party driver code, 10% hardware, 5% Microsoft code and 15% unknown.
• A damaged Windows file, which the System File Checker repairs.

What to do when a blue screen names wdf01000.sys

The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.

1. 01

   Write down the stop code and the file the screen names

   Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.

   To undo: Nothing to undo: this only reads information.

2. 02

   Before you change anything: note the driver and make a restore point

   Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.

   To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.

3. 03

   Find the device involved

   The stop code and what you were doing narrow it down: a crash on sleep or wake, when plugging in a USB device, or when a particular device is in use points at that device's driver. Microsoft also suggests the System log in Event Viewer for errors around the time of the crash, and Device Manager for devices marked with an exclamation point.

   To undo: Nothing to undo: this only reads information.

4. 04

   Update the driver the screen names

   Microsoft's advice when a driver is identified in the bug check message is to disable the driver or check with the manufacturer for driver updates. In Device Manager, right-click the device and choose Update driver, or install the current package from the manufacturer's support page for your exact model. Here that means the driver of the device you identified, not wdf01000.sys itself.

   To undo: Open the device's Properties > Driver tab and choose Roll Back Driver, or apply the restore point.

5. 05

   If it started after a driver update, roll the driver back

   In Device Manager, right-click the device, choose Properties, open the Driver tab and select Roll Back Driver, then give a reason and confirm. Microsoft notes that you need administrator rights, and that going back to the previous driver often fixes a problem that appeared after an update. The button is greyed out when Windows kept no earlier driver for the device.

   To undo: Rolling back is the undo for the update. To return to the newer driver, install it again with Update driver or from the manufacturer's package.

6. 06

   Take out what you added just before it started

   Microsoft's first basic step for a stop code that keeps coming back is to remove new hardware: shut the PC down, disconnect the device and start again. Its bug check pages say the same about drivers and system services added recently: remove or update them, and work out what changed just before the first crash.

   To undo: Reconnect the hardware, or install the program or driver again.

7. 07

   Install the latest Windows updates

   Select Start > Settings > Windows Update and choose Check for updates. It is one of Microsoft's basic steps for a stop code that keeps returning, and it is how new versions of Windows' own drivers arrive.

   To undo: If the crashes get worse after an update, apply the restore point from the earlier step.

8. 08

   Check Windows' own files

   wdf01000.sys is part of Windows, so there is no separate download for it. Open Command Prompt as administrator and run DISM.exe /Online /Cleanup-image /Restorehealth, then sfc /scannow. Microsoft says to run DISM first, and that sfc scans all protected system files and replaces corrupted ones with a cached copy.

   To undo: No undo is needed: the tools only put back Microsoft's version of a damaged Windows file.

Check it yourself

1. 01

   See whether a driver on your PC is running from this file (PowerShell)

   Shows the driver service that loads the file, whether it is running and its exact path. No output means no driver service on your PC points at this file. Nothing is changed.

   Get-CimInstance Win32_SystemDriver | Where-Object PathName -like '*\wdf01000.sys' |
     Format-List Name, State, StartMode, PathName

   PowerShellCopy
2. 02

   Read the company and version from the file itself

   Every copy on the PC is listed, including copies waiting in the driver store.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter wdf01000.sys -ErrorAction SilentlyContinue |
     ForEach-Object { $_.VersionInfo } | Format-List FileName, CompanyName, FileDescription, FileVersion

   PowerShellCopy
3. 03

   Check the signature

   Status should be Valid. The table above shows who signed the file on the test PC.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter wdf01000.sys -ErrorAction SilentlyContinue |
     Get-AuthenticodeSignature | Format-List Path, Status, SignerCertificate

   PowerShellCopy