Blue Screen After an Update: How to Read the Stop Code and Fix It

29 Jul 2026

You install a Windows update, restart the computer and expect to return to work. Instead, Windows displays a blue or dark recovery screen, reports that the device has encountered a problem and restarts again.

The message may disappear too quickly to read, or the computer may become trapped in a loop where every startup ends with the same Stop error.

A blue screen after an update does not automatically mean that Windows itself is irreparably damaged. The update may have exposed a faulty driver, changed how Windows communicates with existing hardware or completed while system files were already corrupted.

The most useful clue is the Stop code shown on the screen.

Examples include:

IRQL_NOT_LESS_OR_EQUAL
PAGE_FAULT_IN_NONPAGED_AREA
MEMORY_MANAGEMENT
SYSTEM_SERVICE_EXCEPTION
DRIVER_IRQL_NOT_LESS_OR_EQUAL
INACCESSIBLE_BOOT_DEVICE
CRITICAL_PROCESS_DIED
VIDEO_TDR_FAILURE
WHEA_UNCORRECTABLE_ERROR

Windows may also display the name of a driver or module that was running when the crash occurred.

The correct fix depends on that code, when the crash occurs and whether Windows can still start in Safe Mode.

What Is a Windows Stop Code?

A Stop code is generated when Windows encounters a serious condition from which it cannot safely recover.

Microsoft also refers to this as a bug check. Windows stops normal operation to protect the computer and its data, records diagnostic information where possible and then restarts. The screen colour and wording can vary between Windows 11 releases, but the principle remains the same.

The Stop code identifies the general class of failure.

It does not always tell you exactly which physical component or driver is faulty. For example, a memory-related code may be caused by defective RAM, an unstable memory profile or a driver writing to an invalid area of memory.

Treat the Stop code as the beginning of the investigation rather than the complete diagnosis.

First: Record the Exact Error

Before the computer restarts, photograph or write down:

The Stop code
Any hexadecimal code, such as 0x0000000A
Any driver or file name displayed
What the computer was doing
The approximate time
Whether the crash occurred during startup or after signing in
Whether the same code appears every time

A file name may look similar to:

nvlddmkm.sys

amdkmdag.sys

iaStorAC.sys

tcpip.sys

ntfs.sys

Do not immediately delete the named file. The module visible on the screen may have detected the failure rather than caused it.

Stop Windows Restarting Too Quickly

Windows may restart before you have time to read the message.

To disable automatic restart when Windows can still start:

Search for View advanced system settings.
Open the Advanced tab.
Under Startup and Recovery, select Settings.
Untick Automatically restart.
Select OK.

The next Stop error should remain visible long enough to record.

This will not prevent the crash. It only stops Windows immediately rebooting afterwards.

Confirm That the Update Really Preceded the Crash

Open:

Settings > Windows Update > Update history

Look for updates installed immediately before the first blue screen.

Check:

Quality updates
Driver updates
Definition updates
Firmware updates
Other updates

Record the relevant KB number and installation date.

The update may not be the root cause merely because it was installed recently. A graphics, storage or security driver may have been installed at the same time, or the restart may have exposed an unrelated hardware problem.

The timing helps prioritise your checks, but it does not prove causation.

The Safest Troubleshooting Order

Work through the following sequence:

Record the Stop code.
Disconnect newly installed hardware.
Attempt one normal restart.
Enter Windows Recovery Environment if the crash repeats.
Start in Safe Mode.
Roll back or reinstall the likely driver.
Remove the latest Windows update where appropriate.
Repair Windows system files.
Check storage and memory.
Analyse the crash dump.
Use System Restore.
Repair or reinstall Windows only after the safer options fail.

Step 1: Remove New Hardware

If you recently installed or connected new hardware, shut the computer down and remove it temporarily.

This may include:

USB devices
Docking stations
External drives
Graphics cards
Additional RAM
Capture devices
Network adapters
Audio interfaces
Printers

Microsoft recommends removing newly added hardware as one of the first actions when troubleshooting repeated Stop errors.

Restart with only the essential keyboard, mouse, display and power connection.

If the computer starts normally, reconnect devices individually until the problem returns.

Step 2: Enter Windows Recovery Environment

If Windows crashes before you can sign in, use the Windows Recovery Environment.

Windows may open it automatically after repeated failed starts.

You can also trigger it by interrupting startup when Windows is genuinely unable to boot:

Turn on the computer.
Wait until Windows begins loading.
Hold the power button to switch it off.
Repeat until Automatic Repair appears.
Select Advanced options.

Windows RE provides access to Startup Settings, Safe Mode, update removal, System Restore and other recovery tools.

An encrypted computer may request its BitLocker recovery key before allowing access to certain recovery tools.

Step 3: Start Windows in Safe Mode

From Windows Recovery Environment, select:

Troubleshoot > Advanced options > Startup Settings > Restart

Then choose:

4 or F4 — Safe Mode
5 or F5 — Safe Mode with Networking
6 or F6 — Safe Mode with Command Prompt

Safe Mode starts Windows with a reduced set of drivers and services. When the blue screen does not occur in Safe Mode, a third-party driver, service or startup component becomes more likely.

Use ordinary Safe Mode first. Networking loads additional components and should only be selected when it is required.

Step 4: Roll Back a Recent Driver

A Windows update can install a newer driver alongside the operating-system update.

In Safe Mode:

Right-click Start.
Open Device Manager.
Locate the suspected device.
Double-click it.
Open the Driver tab.
Select Roll Back Driver, if available.
Restart normally.

Pay particular attention to:

Display adapters
Storage controllers
Network adapters
Audio devices
Chipset components
USB controllers
Security-device drivers

If the rollback option is unavailable, obtain a previous approved driver from the computer or component manufacturer.

Do not download drivers from unofficial websites.

Step 5: Reinstall the Driver

When a driver installation is corrupted, removing and reinstalling it may help.

Before uninstalling the device, download the correct replacement driver where possible.

Then:

Open Device Manager.
Right-click the device.
Select Uninstall device.
Restart Windows.
Install the manufacturer’s approved driver.

For laptops, begin with the laptop manufacturer’s support page. Device-specific packages may include custom power, graphics-switching and firmware integration.

Step 6: Uninstall the Latest Windows Update

When the blue screen began immediately after a cumulative update, uninstalling that update can be a useful diagnostic step.

When Windows starts normally:

Settings > Windows Update > Update history > Uninstall updates

When Windows cannot start:

Windows Recovery Environment > Troubleshoot > Advanced options > Uninstall Updates

You may be offered:

Uninstall latest quality update
Uninstall latest feature update

Microsoft supports removing an update through Windows RE when Windows cannot start.

Try the latest quality update first when the fault followed a monthly cumulative update.

Do not leave a security update removed indefinitely. Once stability is restored, check for a corrected update, driver or vendor advisory.

Step 7: Check for a Newer Corrective Update

A newly released update may contain a compatibility issue that is corrected shortly afterwards.

Once Windows is stable enough to use, check:

Settings > Windows Update > Check for updates

Also review:

Windows Update > Advanced options > Optional updates

Look for:

Graphics-driver updates
Storage-driver updates
Chipset updates
Firmware
Manufacturer components

Do not reinstall the same problematic driver repeatedly without first checking its version and release notes.

Step 8: Repair Windows System Files

Damaged Windows components can contribute to update and startup failures.

Open Terminal as Administrator and run:

DISM.exe /Online /Cleanup-Image /RestoreHealth

When DISM finishes, run:

sfc /scannow

Restart afterwards.

Microsoft includes DISM and related system repair steps in its Windows upgrade and installation troubleshooting guidance.

If Windows only starts in Safe Mode, System File Checker may still be useful there.

Step 9: Run a Disk Check

Storage corruption can cause Stop errors during or after an update.

Open Terminal as Administrator and run:

chkdsk C: /scan

This checks the Windows drive while the system is running.

If Windows reports errors requiring offline repair, it may recommend:

chkdsk C: /f

The repair may require a restart.

Repeated storage errors, bad blocks, disappearing drives or controller timeouts can indicate a failing SSD, hard drive, cable or storage controller.

Back up important data immediately when storage health is in doubt.

Step 10: Check the Crash-Dump Files

When Windows records a Stop error, it may create a crash dump containing information about the system at the time of failure.

Common locations include:

C:\Windows\Minidump

and:

C:\Windows\MEMORY.DMP

A small memory dump can contain the bug-check code, parameters, loaded drivers and other information needed to investigate the crash.

If the Minidump folder does not exist, Windows may not have created a dump.

Possible reasons include:

The page file is disabled
The C: drive lacks free space
Windows lost access to the drive during the crash
The failure was caused by instant power loss
Dump settings are not configured
The crash occurred before Windows could write the file

Configure Crash Dumps

Open:

View advanced system settings > Startup and Recovery > Settings

Under Write debugging information, select:

Automatic memory dump
Kernel memory dump
Small memory dump

For many systems, Automatic memory dump is a sensible default.

Make sure the page file remains enabled on the Windows drive and that sufficient free space is available.

Analyse the Dump With WinDbg

Microsoft’s WinDbg tool can open Windows crash dumps and help identify the bug-check code, stack and potentially involved drivers.

After opening the dump, a common first command is:

!analyze -v

The output may include:

Bug-check name
Bug-check parameters
Suspected module
Call stack
Failure bucket
Process active during the crash

Do not automatically remove a driver merely because WinDbg lists it as “probably caused by.” The named module may be the last component involved rather than the original source of memory corruption.

Repeated dumps showing the same third-party driver provide much stronger evidence than a single crash.

How to Interpret Common Stop Codes

IRQL_NOT_LESS_OR_EQUAL

This may appear as:

IRQL_NOT_LESS_OR_EQUAL

or code:

0x0000000A

Microsoft states that this error typically occurs when a device driver or system memory accesses an invalid memory location at an elevated interrupt level.

Likely areas include:

Faulty or incompatible drivers
Unstable RAM
Overclocking
Security software
Chipset or network drivers

Recommended checks:

Start in Safe Mode.
Roll back recently changed drivers.
Update chipset and device drivers.
Return memory and CPU settings to default.
Test the RAM.

DRIVER_IRQL_NOT_LESS_OR_EQUAL

This is similar to the previous code but more directly suggests driver involvement.

The blue screen may display the name of a .sys file.

Investigate:

The device associated with the file
Its driver version
Whether it updated recently
Whether a rollback is available
Whether the manufacturer has a corrected release

Do not delete the .sys file manually.

PAGE_FAULT_IN_NONPAGED_AREA

This indicates that Windows or a driver attempted to access memory that should have been available but was not valid.

Possible causes include:

RAM problems
Driver corruption
Antivirus or endpoint filters
Storage faults
Page-file or file-system problems
Unstable overclocking

Test memory and storage rather than assuming the physical RAM is automatically faulty.

MEMORY_MANAGEMENT

This code suggests that Windows detected serious memory-management corruption.

Potential causes include:

Faulty RAM
An unstable XMP or EXPO profile
A faulty driver
CPU memory-controller instability
Storage corruption
BIOS compatibility

Disable memory overclocking temporarily and run a proper memory test.

SYSTEM_SERVICE_EXCEPTION

This can occur when a system service or driver performs an invalid operation.

Possible sources include:

Graphics drivers
Security software
Virtualisation tools
System-file corruption
Memory instability
Recently installed low-level utilities

Check the accompanying driver name and analyse the dump.

CRITICAL_PROCESS_DIED

This means a process considered essential to Windows stopped unexpectedly.

Possible causes include:

Corrupted system files
Storage problems
Failed updates
Security software
Driver faults
Malware

Run DISM, System File Checker and storage diagnostics. Use System Restore or update removal when the timing clearly matches a recent change.

INACCESSIBLE_BOOT_DEVICE

This code means Windows has lost access to the drive or controller used to start the operating system.

Possible causes include:

Storage-driver changes
BIOS storage-mode changes
SSD or hard-drive failure
Storage-controller faults
Corrupted boot files
A failed update
Changes involving RAID or AHCI

Check that the drive appears in BIOS or UEFI.

Do not randomly switch between AHCI, RAID and other controller modes. Windows may have been installed for one specific mode, and changing it can itself cause this Stop error.

VIDEO_TDR_FAILURE

This is usually associated with the graphics subsystem.

TDR stands for Timeout Detection and Recovery. Windows detected that the GPU or its driver stopped responding and could not recover successfully.

Possible causes include:

Graphics-driver problems
GPU overheating
GPU overclocking
Faulty video memory
Insufficient or unstable power
A failing graphics card

Try:

Rolling back or cleanly reinstalling the graphics driver.
Removing GPU overclocks and undervolts.
Checking temperatures.
Updating chipset and BIOS firmware.
Testing the GPU under controlled load.

WHEA_UNCORRECTABLE_ERROR

This indicates that Windows received an uncorrectable hardware error through the Windows Hardware Error Architecture.

Microsoft recommends Windows Update, driver and firmware updates, system recovery and hardware investigation for this error.

Possible causes include:

CPU instability
RAM
Motherboard
PCI Express devices
Graphics card
NVMe storage
Power delivery
Overclocking or undervolting

Return the BIOS and performance settings to their defaults before replacing hardware.

DPC_WATCHDOG_VIOLATION

This suggests that a driver or hardware operation exceeded the permitted execution time.

Possible causes include:

Storage drivers
NVMe or SATA firmware
Graphics drivers
USB devices
Security software
Faulty hardware

Microsoft’s Stop-code guidance recommends collecting the dump and using Windows debugging tools where a driver is suspected.

NTFS_FILE_SYSTEM

This points towards the Windows file system or storage path.

Check:

SSD or hard-drive health
Storage drivers
File-system errors
Available disk space
Backup and security software
Recent storage changes

Back up important data before running repeated repairs.

KMODE_EXCEPTION_NOT_HANDLED

This generally means a kernel-mode component generated an exception that Windows did not handle.

Likely causes include:

Device drivers
Security software
Memory corruption
BIOS or firmware
System utilities

The named module and dump stack are important.

Different Stop Codes Every Time

When the computer displays a different code on each crash, suspect a broader stability problem rather than several unrelated Windows faults.

Possible causes include:

Unstable RAM
CPU overclocking or undervolting
Failing power supply
Motherboard problems
Severe driver-based memory corruption
Storage corruption

Return the hardware to default settings and begin with memory, storage and power diagnostics.

Test the Memory

Windows includes a basic memory diagnostic.

Press Windows key + R and enter:

mdsched.exe

Choose:

Restart now and check for problems

The computer will restart and test the memory.

A passed short test does not completely rule out intermittent memory instability.

Also test with:

XMP disabled
EXPO disabled
Memory running at standard settings
CPU overclocking disabled
Undervolting removed

For persistent business-critical failures, longer hardware diagnostics may be required.

Check Temperatures and Power

An update may change driver behaviour or workload enough to expose an existing hardware weakness.

Monitor:

CPU temperature
GPU temperature
GPU hotspot
SSD temperature
Clock speeds
Fan speed
Power consumption

Hardware becomes a stronger suspect when the blue screen occurs:

During gaming
During rendering
Under heavy CPU or GPU load
After the device becomes hot
When waking from sleep
When connected to a dock
After a graphics-card upgrade

A Stop code does not guarantee that Windows Update itself is responsible.

Return Overclocks to Default

Temporarily disable:

CPU overclocking
GPU overclocking
GPU undervolting
CPU undervolting
XMP
EXPO
PBO
Automatic motherboard enhancement
Aggressive performance profiles

A setting that was previously stable may become unreliable after changes to firmware, drivers, scheduling or power management.

Test at default settings before replacing components.

Use System Restore

If restore points are available, System Restore can return Windows system files, drivers, registry settings and installed applications to an earlier state.

From Windows RE:

Troubleshoot > Advanced options > System Restore

Choose a restore point created before the blue screens began.

System Restore normally leaves personal files intact, but applications and drivers installed after the selected point may be removed. Microsoft includes it among Windows recovery options.

Review the affected-programs list before proceeding.

Perform a Clean Boot

If Windows starts but still crashes during normal use, a third-party service may be involved.

A clean boot starts Windows with Microsoft services and a reduced set of third-party components.

In System Configuration:

Open the Services tab.
Select Hide all Microsoft services.
Disable the remaining third-party services.
Disable non-essential startup applications.
Restart.

Microsoft’s clean-boot process specifically instructs users to hide Microsoft services before disabling the remaining services.

If the blue screens stop, restore services in groups until the conflict returns.

Do not permanently leave business security software disabled.

Check Endpoint Security and VPN Software

Security and VPN products often install kernel-level drivers.

After a Windows update, an outdated component may become incompatible.

Review:

Endpoint-security logs
VPN-client version
Web-filtering drivers
Disk-encryption components
Device-control software
Network-filtering drivers

Do not simply remove business protection without consulting IT.

The vendor may already provide an updated agent or compatibility advisory.

Use the Manufacturer’s Diagnostics

Business laptops and desktops often include built-in diagnostics accessible during startup or through an official support utility.

Test:

Memory
SSD or hard drive
Processor
Graphics
Battery
Fans
Motherboard
Power adapter

Record any error or validation code.

A confirmed hardware error should be addressed before reinstalling Windows.

Reinstall the Current Windows Version Without Removing Apps

When Windows starts but remains unstable because system components are damaged, Windows 11 may offer:

Settings > System > Recovery > Fix problems using Windows Update > Reinstall now

Microsoft states that this reinstalls the current version of Windows to repair system files and components.

Back up important data before proceeding.

The option may be unavailable on devices managed by an organisation or on some Windows configurations.

Consider Reset or Reinstallation Last

A reset or clean installation should not be the first response to a blue screen after an update.

Before resetting:

Back up important files
Obtain the BitLocker recovery key
Record application licences
Download essential drivers
Check whether specialist applications can be reinstalled
Confirm OneDrive and cloud synchronisation
Test the hardware

Reinstalling Windows may fix operating-system corruption.

It will not fix:

Faulty RAM
A failing SSD
An unstable GPU
A weak power supply
Motherboard problems
Overheating

What Not to Do

Avoid:

Deleting a .sys file named on the blue screen
Downloading random DLL or driver files
Running registry cleaners
Enabling Driver Verifier casually on a production computer
Changing several BIOS settings simultaneously
Clearing the TPM without the BitLocker key
Reinstalling Windows before checking the dump
Assuming every Stop code is caused by the latest update
Leaving important security updates removed permanently
Continuing to use a machine that is corrupting files
Sharing full memory dumps publicly without reviewing sensitive-data risks

Driver Verifier is an advanced diagnostic tool that deliberately stresses drivers and can make a system crash more frequently. It should only be used when the recovery method is understood and the device is appropriately backed up.

A Practical Blue-Screen Checklist

When Windows blue-screens after an update:

Photograph the Stop code and any driver name.
Note the time and activity.
Check Windows Update history.
Disconnect newly added hardware.
Attempt Safe Mode.
Roll back recently updated drivers.
Uninstall the latest quality update where the timing matches.
Install corrected manufacturer drivers.
Run DISM and System File Checker.
Check storage health.
Test memory at default settings.
Review temperatures and power.
Locate and analyse crash dumps.
Use System Restore.
Perform a clean boot.
Run manufacturer diagnostics.
Repair or reinstall Windows only after ruling out hardware.

How Hamilton Group Can Help

A blue screen after an update may be caused by Windows, but it may also expose a deeper problem involving drivers, memory, storage, firmware or hardware.

Hamilton Group can help with:

Windows 11 Stop-code investigations
Crash-dump and WinDbg analysis
Faulty-driver identification
Update rollback and recovery
Safe Mode and Windows Recovery Environment
RAM and storage diagnostics
Graphics and chipset-driver problems
BIOS and firmware updates
Endpoint-security compatibility
Microsoft Intune update investigations
Hardware repair and replacement planning
Windows recovery and reinstallation

We can correlate the Stop code, dump file, update history and hardware symptoms to identify the real cause rather than repeatedly reinstalling Windows or replacing components at random.

Read the Stop Code Before Applying the Fix

A blue screen is Windows reporting that something failed seriously enough that continuing was unsafe.

The Stop code tells you which area to investigate, while the crash dump can reveal the driver or component involved. Begin with Safe Mode, driver rollback, update removal and Windows system repairs. Then test memory, storage and hardware when the evidence points beyond Windows.

For help diagnosing a Windows blue screen, recovering a failed update or identifying unstable hardware, call Hamilton Group on 0330 043 0069 or book a call with one of our experts today.