Windows - Troubleshooting Blue Screen Errors
This document explains how to troubleshoot Windows problems that result in Blue screens errors and system crashes in Windows 7, Vista, XP, and 2000.
The Windows Blue Screen, occasionally referred to as "The Blue Screen of Death", is a general category of error message that accompanies severe system crashes in Windows operating systems. The potential causes are numerous, but careful analysis of the circumstances of the crash and a review of the diagnostic information in the blue screen itself can help identify the cause. See Anatomy of a Blue Screen for more information on analyzing blue screens.
In Windows 2000 and above, there is no way to recover from a blue screen and resume normal operation: the user can only take note of the information that appears on the screen in the hopes of diagnosing the problems and preventing recurrences. Unfortunately, most Windows XP, Vista, and 7 machines are configured to automatically reboot when a kernel failure occurs, and the actual blue screen, including diagnostic information, flashes by too quickly for study. In these cases, the user can disable this feature and wait for future blue screens (see Disabling Autorestart for details). Alternatively, a technician can use special debugger tools to parse the stored logs.
In all other cases, however, the system will perform a complete memory dump when the system fault occurs, and then wait for the user to restart the computer.
Taken in isolation, the appearance of a blue screen is not very informative: it merely indicates that the operating system has crashed. Therefore, it is critical to obtain the specifics of the blue screen itself, as well as any logical background information before proceeding. Take a look at the following blue screens (from Windows XP and Windows 8, respectively). For Windows XP, notice that the most important information is underlined with red.
As you can see, the most important elements are:
- Error Message: This is simply a text version of some of the information contained within the error code. Some error messages indicate a very specific cause, such as DRIVER_IRQ_NOT_LESS_THAN_OR_EQUAL. Others, such as PAGE_FAULT_IN_NON_PAGE_AREA, are more generic and can indicate a wide array of potential causes. Google can help you interpret these errors, and a few are discussed under the Common Error Messages section of this document. There is a more complete index of errors available under External Resources.
- Error Code: The error code is simply a base 16 numerical value used to indicate the type of failure. Again, searching for the error code will often yield potential resolutions. There is a link to an index of potential error codes under External Resources.
- Responsible System File: When present, the system file will tell you what file caused the error. Google can help you identify what program, driver or service the file is associated with, and sometimes removing or updating these items can prevent further crashes.
Different Types of Blue Screens
The contents of a blue screen are variable depending on the version of Windows and the source of the error. Most commonly, all three of the above pieces of information will be present. Sometimes, however, depending on the type of error and the point at which it occurs in machine operation, only a subset of the above information appears.
Sometimes the blue screen provides enough information to diagnose a specific cause and resolve the issue. Some of the most common Blue Screens and potential resolutions are listed below:
- UNMOUNTABLE_BOOT_DEVICE: This error occurs when one or more of the very low level system files are corrupt or missing. It can indicate physical failure or purely virtual damage to information. When you encounter this error, the next step is to have the customer run Check Disk. See Running Check Disk for instructions. Note that if Check Disk completes successfully but fails to address the problem, you may wish to boot from the Operating System media again and run the command FIXMBR, hitting "y" and enter when prompted to approve the action.
- DRIVER_IRQ_NOT_LESS_THAN_OR_EQUAL_TO: This error indicates a failure caused by a device driver. The responsible system file should always be present when you encounter this error, so search for the name of the file online. Oftentimes this is caused by buggy driver files, and you may be able to solve the problem by booting into safe mode, removing the driver, and then downloading the most recent version of the driver from the device's manufacturer's website.
- PAGE_FAULT_IN_NON_PAGE_AREA: This is a very general category of error and can indicate just about any sort of failure. For errors such as this, contextual information will be essential. The full error code might also narrow down the problem, but be aware that this error is so general any search results might be red herrings.
Other times, however, the blue screen is ambiguous or otherwise uninformative.
ResourcesTroubleshooting Windows STOP errors
MSDN Index of STOP errors