Guide to Investigating Blue Screen Errors on Windows

Blue screen errors (BSODs) can be frustrating, but with the right tools and steps, you can diagnose and fix them. This guide briefly walks you through from collecting logs to analysing crash dumps.
 

Step 1: Check System Event Logs

Useful Event IDs

You can use PowerShell on your computer to view the above events to get an indication of if these events are occurring. To do this, open PowerShell on your computer and enter the below command:

Get-WinEvent -FilterHashtable @{
    LogName='System';
    ID=@(41, 1074, 6005, 6006, 6008, 162);
    StartTime=(Get-Date).AddDays(-7)
} | Sort-Object TimeCreated | ft TimeCreated, Id, LevelDisplayName, ProviderName, Message

This will show a list of events (if any) that have occurred on your computer in the last 7 days. There will be an ID number for each event. Reference the ID with the table above to determine if matches what has been occurring with your Windows device.
 

Step 2: Locate Dump Files

Windows stores crash dumps in:

• Mini dumps: C:\Windows\Minidump\
• Full dumps: C:\Windows\MEMORY.DMP

They get created any time your computer displays a Blue Screen crash error screen. If you have some at these locations, you can load them into Windows Debugging Tools to find out more about why Windows has crashed.
 

Step 3: Install Windows Debugging Tools

How to Download

1. Open the Microsoft Store.
2. Search for “Windows Debugging Tools”.
3. WinDbg from Microsoft is the app you want to install.
    

Step 4: Analyse the Dump File

Open WinDbg and Load the Dump

1. Launch WinDbg (x64).
2. Go to File > Open Crash Dump.
3. Select the .dmp file.

4. In the command window, type:
    

   !analyze -v

(It might take a while to both load the dmp file and display the output of running the analyze command).


 

Step 5: Understand the Output

Common Bugcheck Codes

Key Fields to Look For

• Bugcheck Code: Tells you the type of crash.
• Process Name: Which app or service was running.
• Failure Bucket ID: Helps identify recurring issues.
• Module Name: Often the driver or system file that caused the crash.
   

Step 6: Take Action Based on Error Type

Driver Issues (0xA, 0x7E, 0x9F)

• Update or uninstall problematic drivers.

• Use Driver Verifier:
   

  verifier /standard /all

Memory/Pagefile Errors (0x1A, 0x50)

• Run memory diagnostics:
   

  mdsched.exe

   

• Run disk check:
   

  chkdsk C: /f /r

   

Power Issues (0x9F)

• Update BIOS/UEFI and chipset drivers.
• Check Windows Update and apply any outstanding updates.

Still having issues? Contact Support for further troubleshooting or a computer reset.