Blue Screen Fix Windows 11: Step-by-Step Guide for 2026

You're in the middle of a video call or opening a work file when your PC crashes and restarts. If you're searching for a blue screen fix Windows 11 users can safely try, start by recording the error, not installing another driver. A useful repair begins with evidence of what changed and what failed.

For an Edmonton home office or small business, the immediate concern is usually the same: get the computer working without losing files. The safest approach is to make controlled changes, test each result, and leave resets until your data is protected.

Windows 11 Blue Screen Fix Order, Step by Step

A blue screen is a bug check: Windows has stopped because it encountered a condition that could make continued operation unsafe. The stop code narrows the investigation, but it doesn't identify a failed component by itself.

Start with the changes that are easiest to undo and work toward the ones that alter more of the system. The checks below cover the same ground as Microsoft's guidance for unexpected restarts and stop code errors, which walks through Safe Mode, device checks, updates and recovery options.

Fix order for a Windows 11 blue screen

Order	Action	Why it sits here
1	Remove hardware added immediately before the problem	Quickest test of a recent change, and easy to reverse
2	Start in Safe Mode if normal startup fails	Loads fewer drivers and helps isolate startup software or driver problems
3	Check Device Manager and update or roll back problem devices	Warning icons identify devices that need investigation
4	Confirm the system drive has enough free space for swap files and updates	Windows needs working room, and a crowded drive can fail in ways that look like hardware faults
5	Install pending Windows 11 updates through Windows Update	Can correct known driver and operating-system faults
6	Use System Restore or another recovery option	Changes more of the system, so it follows the targeted checks

Why the order matters

A newly connected dock, printer or USB adapter is a useful starting point because you can disconnect it without changing Windows. Shut down before removing internal hardware such as a graphics card, and don't open the computer unless you're comfortable doing so.

Safe Mode reduces the drivers and services Windows loads. If the computer stays stable there, investigate software and drivers. That result doesn't prove the hardware is healthy. Safe Mode places less demand on the machine, so a weak component can pass the test.

Device Manager warnings deserve attention, although they aren't a verdict. A warning can describe a device that isn't working without explaining whether it caused the crash.

Keep early changes targeted

Free space and pending updates belong before recovery because they address operating conditions without immediately replacing your Windows setup. Updates still need judgement. If the first crash followed a particular driver update, roll that driver back before installing anything new.

A rollback tells you more than another update does. If the crashes stop, you've isolated the cause. If you install a fresh update instead and the machine keeps crashing, you've added one more variable to the investigation.

The early checks are generally easier to reverse than recovery, and they aren't consequence-free either. Save your work, keep the stop code and your crash notes within reach, and test after each change. Stop when the crashes stop rather than completing every repair out of habit, and run the workload that previously triggered the failure before deciding the computer is stable.

Record the Stop Code and Evidence Before You Restart

Repeatedly restarting and hoping Windows behaves is a common mistake. Recording evidence is the first part of a blue screen fix Windows 11 troubleshooting attempt because the stop code connects the later tests.

Microsoft's stop-error troubleshooting guidance recommends reviewing the specific code in event logs and searching it for known issues, fixes and workarounds. That gives you a better starting point than searching for blue screen alone.

Build a usable evidence file

Use your phone to photograph the screen before restarting. Keep the photo with a short note containing:

• Exact stop code: Capture the spelling, whether it's IRQL_NOT_LESS_OR_EQUAL, MEMORY_MANAGEMENT, CRITICAL_PROCESS_DIED or something else.
• Named driver or file: Record any .sys filename displayed beneath the error.
• Crash time: Note the approximate time so you can match the failure to Windows logs.
• Recent changes: Include Windows updates, driver installations, new software and connected hardware.
• Active task: Describe whether the PC was waking, gaming, copying files or handling a video call.
• Repeatability: Note whether the same task causes another crash or the failures seem unrelated.

A stop code describes the type of failure, not necessarily its origin. For example, memory-related errors can result from defective RAM, unstable settings or a driver writing to the wrong memory location.

Match the photo to Windows records

Open Event Viewer > Windows Logs > System. Filter for Critical and Error entries around the crash time, then save relevant events rather than copying only their titles.

An unexpected-shutdown entry confirms Windows didn't shut down normally. It doesn't, by itself, tell you why the computer crashed.

Search Start for View reliability history to open Reliability Monitor. Its timeline helps you compare failures with application installations and updates, but timing alone doesn't prove causation.

Practical rule: Record what happened before changing what might have caused it.

Avoid repeated forced restarts. They can interrupt writes, complicate the logs and place unnecessary demands on failing storage; continued crashes can also displace older diagnostic files.

If Windows won't stay open, photograph each visible error and disconnect nonessential printers, docks and external drives before another controlled attempt. Don't repeatedly force a failing machine through the same unsuccessful startup.

Your handover note can be simple: Stop code; named file; crash time; recent change; triggering task; tests attempted; result. That gives anyone helping next a clear starting point instead of a list of guesses.

How to Fix Blue Screens Caused by Drivers and Updates

Updating every driver at once is a poor diagnostic method. Even if it works, you won't know which change mattered, and if the computer gets worse, you'll have several changes to unwind.

A better Windows 11 blue screen fix tests the strongest suspect. If the crashes began immediately after a driver update, rollback provides a direct comparison with the previously working configuration.

Roll back before adding more changes

Create a restore point if Windows is stable enough and System Protection is available. A restore point helps reverse system changes, but it isn't a backup of your documents.

1. Identify the suspect. Open Device Manager and record warning icons, device names and driver versions. Compare those details with the file shown on the crash screen.
2. Open the device's Properties > Driver tab. Choose Roll Back Driver if available, restart, and repeat the task that caused the crash.
3. If rollback isn't available, prepare before uninstalling. Download the correct replacement first, especially for a network adapter. Then uninstall the device and select Attempt to remove the driver for this device if offered. Restart and allow Windows to redetect it.
4. Obtain replacements from the computer or component manufacturer's Canadian support page. Record the exact model, BIOS version, Windows build and driver version.
5. Review Windows Update history. Compare driver and cumulative update installations with the first failure. Install pending updates deliberately, rather than stacking them onto an unresolved driver test.
6. If crash analysis repeatedly identifies a component, change that component's driver and retest the original workload.

Don't uninstall a storage-controller driver casually. Losing the driver Windows needs to access its boot drive can turn an intermittent crash into a startup failure.

The guide to updating Windows drivers can help you work through driver replacement without relying on automatic driver-update utilities.

Change one driver at a time. Otherwise, you're changing the experiment instead of testing the suspect.

Use crash dumps when the filename isn't enough

For intermittent crashes, preserve at least three separate dumps and configure Small memory dump (256 KB) under System Properties > Advanced > Startup and Recovery > Settings, following the controlled workflow described in this Microsoft-hosted troubleshooting discussion.

Use %SystemRoot%Minidump as the dump directory. After a crash, copy the .dmp files somewhere safe before further repairs.

Open a copy in WinDbg and run !analyze -v. Examine the bug-check code, named module, stack trace and driver timestamp together.

A named graphics, Wi-Fi, antivirus or VPN driver is a lead, not a conviction. Memory corruption can make an innocent module appear responsible, so repeated patterns carry more weight than a single filename.

Keep dumps private because diagnostic files can contain sensitive information. Share them only with someone you trust to analyse the fault.

The useful result isn't just that Windows boots after an update. It's that the triggering task works again and the same crash no longer returns.

Checking System Files, Memory and Storage

System-file repairs make sense when Windows files may be damaged. They won't repair defective RAM or restore a physically failing SSD, so check storage warning signs before running write-intensive repairs.

Record each command's result, including whether it found corruption, repaired it or couldn't finish. A screenshot of the final message is more useful than a note saying scan completed.

Built-in checks for system files, disk and memory

Check	Command or tool	Use it when
Component store repair	DISM /Online /Cleanup-Image /RestoreHealth	Run before SFC when SFC reports it cannot repair files
System file scan	sfc /scannow	Corrupted or modified Windows system files are suspected
Disk and file system check	chkdsk C: /f	Drive errors are suspected; the system-drive check normally runs at the next restart
Memory test	Windows Memory Diagnostic (mdsched.exe)	Random crashes or a suspected RAM fault
Manufacturer diagnostics	Dell, HP, Lenovo or SSD vendor utility	Storage health, memory or overheating needs confirming

Repair Windows files and interpret disk errors

Open Windows Terminal as administrator and run:

DISM /Online /Cleanup-Image /RestoreHealth

Let it finish, restart, then run sfc /scannow in an administrator terminal. Restart after repairs and test your normal workload.

Clean results with no further crashes point away from continuing system-file damage. If SFC repeatedly repairs the same corruption, investigate why the files keep becoming damaged.

For a healthy, backed-up drive with suspected file-system errors, run chkdsk C: /f, accept scheduling and restart. File-system errors alone don't prove physical drive failure; an interrupted write can cause logical damage too.

Repeated errors, disappearing drives or failed manufacturer health tests require a different response. Review the signs of hard drive failure before continuing.

If the drive disconnects, makes abnormal sounds or contains irreplaceable files, stop repair attempts. MDrepairs' explanation of damaged hard drive recovery provides context for why recovery may need to come before file-system repair.

Test memory and check operating conditions

Run mdsched.exe and choose the restart-and-test option after saving your work. Intermittent faults may require another pass or more extensive testing.

A memory error requires investigation of RAM, memory settings and the memory controller. Defective RAM needs replacement, but unstable overclocking or incompatible settings can also produce errors.

Use the computer maker's diagnostics and the SSD manufacturer's utility to check hardware health. Monitor temperatures during the workload that triggers the crash, without continuing a stress test on a machine that's overheating.

A Microsoft troubleshooting response also identifies crash dumps and Event Viewer's System log as useful diagnostic milestones. Keep those records alongside a result for each test; clean scans don't rule out a driver fault.

Diagnosing the Crash From Its Symptoms

Blue screen symptoms, likely causes and next steps

Symptom	Likely cause	Next step
Crash starts right after a Windows or driver update	Faulty new driver or update	Roll back the driver or uninstall the suspect update, then temporarily pause further updates
Stop code names a graphics driver file such as nvlddmkm.sys	Graphics driver conflict or corruption	Clean reinstall from the GPU maker's Canadian support page
Stop code names wdfilter.sys	Possible conflict with third-party security software or a stale filter driver	Investigate leftover security or VPN software, remove confirmed conflicts, then update Microsoft Defender
Hardware-error code during gaming or heavy load	Overheating, unstable power, or CPU and RAM instability	Check temperatures, clean vents, review BIOS defaults, then run the memory test
Crashes after sleep or wake	Power-management issue or network and chipset driver	Update the relevant chipset and network drivers, then test sleep settings
Random crashes with no named driver	Possible failing RAM or storage	Run memory and drive checks
Crashes continue after earlier checks	Hard-to-trace driver fault remains possible	Consider Driver Verifier on selected non-Microsoft drivers after creating a restore point

Pick the row that matches your evidence, not every row. These are working hypotheses: a graphics filename doesn't prove a failed GPU, and WdFilter.sys is a Microsoft Defender filter driver, not proof that Defender itself is defective.

Hardware-error crashes under load justify checking cooling, power and stability before reinstalling software. Before resetting BIOS settings, record storage and security settings and confirm that you can access the BitLocker recovery key.

Leave Driver Verifier until last

Microsoft's blue-screen diagnostic documentation describes Driver Verifier as an advanced option for persistent crashes that can't be analysed normally. It deliberately stresses or monitors drivers to expose faults and can cause additional crashes or a boot loop.

Use it only with verified backups and a recovery plan:

1. Prepare recovery. Create a restore point and confirm you can enter Windows Recovery Environment.
2. Run verifier, choose Create custom settings, and select appropriate verification checks.
3. Limit the target. Select only suspected non-Microsoft drivers, not every installed driver.
4. Restart and reproduce the triggering task, then preserve the resulting dump.

If Windows won't boot, enter Troubleshoot > Advanced options > Startup Settings > Safe Mode through recovery. Open Command Prompt as administrator, run verifier /reset, then restart.

Switch Verifier off after diagnosis, even if Windows still boots. This isn't a maintenance tool to leave running.

A display that goes dark without a stop error may need the separate laptop black-screen troubleshooting approach. Random crashes without a consistent module warrant renewed attention to RAM and storage, not another indiscriminate software update.

Deciding Between Self-Repair and an On-Site Technician

If a targeted change ends the crashes, keep the evidence file and watch the computer through a normal working week. That observation period gives you time to test everyday tasks, peripherals and sleep behaviour before calling the fault closed.

If crashes return after the software checks, or the PC cannot reach Safe Mode, change priorities. Protecting files matters more than making Windows boot at any cost, and a driver rollback that stops the crash tells you more than installing another update ever will.

Microsoft's blue-screen recovery guidance includes Safe Mode and recovery options when basic troubleshooting does not resolve the failure. A reset remains disruptive, so use it after hardware checks and backups, not as a way to avoid them.

Protect files before recovery

Use this order before Reset this PC or a clean installation:

1. Check encryption. Find out whether BitLocker or Device Encryption is enabled, and save the recovery key somewhere accessible without the affected computer.
2. If Safe Mode works and storage appears healthy, copy critical documents, browser profiles, email archives and business files to an external drive or cloud storage.
3. Verify the copies. Open documents and check that important folders contain their files. A successful copy message is not enough.
4. Confirm how you will restore applications, licences and account access before resetting Windows.

If Safe Mode does not work, separate data recovery from operating-system repair. Do not format or initialise a drive because another computer says it cannot read it.

Key takeaway: Back up before any reset, and record the evidence before any repair.

When an on-site diagnosis makes sense

Call a technician when valuable data is at risk, the computer remains unstable after targeted software repairs, or a business machine cannot tolerate more trial and error. Drive-health failures, excessive temperatures, memory-test errors and crashes after a component swap all justify hardware investigation.

For local help, Nerds 2 You Edmonton provides on-site PC repair for desktops and laptops at homes and offices, with data backup and recovery guidance available before major changes. Small and medium-sized businesses can also arrange ongoing IT support for security, cloud services and day-to-day reliability.

Ask what the diagnosis covers before authorising work: suspected parts, data handling, warranty and whether a board-level fault means repair, replacement or referral. A clear answer keeps the repair from becoming guesswork.

For businesses comparing broader support arrangements, explore outsourced IT support and weigh who owns backups, patching, maintenance and recovery. Choose the model that matches the risk, not the loudest promise.

Continue self-repair while changes remain targeted and your files are safe; arrange an on-site diagnosis when uncertainty or data risk takes over. If the crash continues after every step, book an on-site visit to finish the blue screen fix Windows 11 process with your stop code and evidence file in hand.

Nerds 2 You Edmonton offers on-site Windows troubleshooting and laptop and desktop repair for homes and businesses. If recurring blue screens are interrupting your work, visit Nerds 2 You Edmonton to arrange a visit, and have your crash photos, recent-change notes and diagnostic results ready.