Blue screen of death

Formats

BSoDs originally showed silver (HTML color #A8A8A8) (and later white (HTML color #FFFFFF)) text on a royal blue (HTML color #0000A8 for Windows NT 3.1–4.0; HTML color #000080 for Windows 2000–7) background with information about current memory values and register values. Starting with Windows Server 2012 (released in September 2012), Windows adopted a cerulean background (HTML color #1A67B3 for Windows 8/8.1 to Windows 10 version 1511; HTML color #0078D7 for Windows 10 version 1607–22H2). Earlier versions of Windows 11 used a black background, which was changed to dark blue starting with build 22000.348 and then back to black with build 26120.3653. Preview builds of Windows 10, Windows 11, and Windows Server (available from the Windows Insider program) feature a dark green (HTML color #246F24) background instead of a blue one. Windows 3.1, 95, and 98 supports customizing the color of the screen whereas the color was hard-coded in the Windows NT family.

Windows 95, 98, and Me render their BSoDs in the 80×25 text mode with a 720×400 screen resolution. BSoDs in the Windows NT family initially used the 80×50 text mode with a 720×400 screen resolution, but were displayed in a 640×480 screen resolution starting with Windows 2000. BSoDs from Windows 8 and Windows Server 2012 onwards are rendered in higher resolutions than previous versions of Windows, specifically the highest screen resolution available on UEFI machines. On legacy BIOS machines, they use the 1024×768 resolution by default, but they can also be configured to use the highest resolution exposed by the firmware (via the highestmode parameter in Boot Configuration Data). Windows 95, 98, Me, and NT versions prior to Windows 2000 used text mode fonts provided by the graphics adapter; Windows 2000, XP, Vista and 7 used kernel mode fonts provided by the kernel's boot video driver bootvid.dll, which is a text mode-like font used in Windows 2000 and Lucida Console in Windows XP to 7. Windows 8 and Windows Server 2012 onwards use the Segoe UI font.

Windows 10 builds 14316 and up uses the same format as Windows 8, but has a QR code which leads to a Microsoft Support web page that tries to help users troubleshoot the issue step-by-step. This format was retained in Windows 11, however build 26120.3291 onwards changes the layout to be more consistent with that of Windows 11's UI, removing the QR code among other changes.

Windows NT

In the Windows NT family of operating systems, the blue screen of death (referred to as "bug check" in the Windows software development kit and driver development kit documentation) occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This was usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation was to restart the computer. Because of this, data loss may occur since the restart was unplanned, and the user was not given an opportunity to save their work.

The text on the error screen contains the code of the error and its symbolic name (e.g. 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)) along with four error-dependent values in parentheses that are there to help software engineers fix the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which was loaded at that address. Under Windows NT, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information was in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. By default, Windows will create a memory dump file when a stop error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "minidump" (introduced in Windows 2000) to a "complete dump" which was effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows, WinDBG or KD debuggers from Debugging Tools for Windows are used. A debugger was necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen was limited and thus possibly misleading, it may hide the true source of the error. By default, Windows XP was configured to save only a 64kB minidump when it encounters a stop error, and to then automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error. This happens only when the computer has a function called "Auto Restart" enabled, which can be disabled in the Control Panel which in turn shows the stop error.

Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. If a stop error was encountered while a live kernel debugger was attached to the system, Windows will halt execution and cause the debugger to break in, rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

A BSoD can also be caused by a critical boot loader error, where the operating system was unable to access the boot partition due to incorrect storage drivers, a damaged file system or similar problems. The error code in this situation was STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there was no memory dump saved. Since the system was unable to boot from the hard drive in this situation, correction of the problem often requires using the repair tools found on the Windows installation disc.

Details

Earlier versions (NT, 2000, XP, Vista, 7)

BSoDs in the Windows NT family before the release of Windows 8 and Windows Server 2012 displayed the error name in uppercase (e.g. APC_INDEX_MISMATCH) and its respective hexadecimal error number (e.g. 0x00000001), along with four parameters. This was shown together in the following format:

error code (parameter 1, parameter 2, parameter 3, parameter 4)<br id="mwAU4"/>error name

Depending on the error number and its nature, all, some, or even none of the parameters contain data pertaining to what went wrong, and/or where it happened. In addition, starting with Windows 2000 onwards, the error screens showed up to four paragraphs of general explanation and advice and may have included other technical data such the file name of the culprit and memory addresses.

The following is a re-creation of the BSoD from Windows 2000, although they somewhat vary:

*** STOP: 0x00000001 (0x00000000,0x00000000,0x00000000,0x00000000) APC_INDEX_MISMATCH If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow these steps: Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows 2000 updates you might need. If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode. Refer to your Getting Started manual for more information on troubleshooting Stop errors.

C-series error codes (also known as hard errors) had a truncated BSoD design, oftentimes not showing the error name, codes, or the four paragraphs of advice. Instead, it would show various different formats of the error screen depending on the type of error that occurred, including:

1. BSoDs related to the termination of the Winlogon process (e.g. "0xC000021A (WINLOGON_FATAL_ERROR)"):

STOP: c000021a {Fatal System Error} The Windows Logon Process system process terminated unexpectedly with a status of parameter 1 (parameter 2 parameter 3). The system has been shut down.

(NOTE: Depending on the type of error that occurred, "Windows Logon Process" would be displayed as "Windows SubSystem" or similar. On Windows 2000, the above message was sometimes accompanied with the four paragraphs of general instructions and advice, which is absent on Windows XP to Windows 7.)

2. BSoDs related to a corrupt registry file critical to the operating system (e.g. "0xC0000218 (STATUS_CANNOT_LOAD_REGISTRY_FILE)"):

STOP: c0000218 {Registry File Failure} The registry cannot load the hive (file):\SystemRoot\System\Config\SOFTWARE or its log or alternate. It is corrupt, absent, or not writable.

3. Hardware errors that can prevent Windows from booting properly (This example is 0x00000080 (NMI_HARDWARE_FAILURE); note that the error code is not shown in this example below):

*** Hardware Malfunction Call your hardware vendor for support NMI: Parity Check / Memory Parity Error *** The system has halted ***

Several error codes contained written descriptions that were used in lieu of the error name, describing what kind of error that has happened. For example, 0x000000F4 (CRITICAL_OBJECT_TERMINATION) was originally written as A process or thread crucial to system operation has unexpectedly exited or been terminated, and 0x000000E2 (MANUALLY_INITIATED_CRASH) was originally written as The user manually initiated the crash dump.

With the release of Windows XP, the layout of the BSoD was slightly altered, which would remain in use for subsequent versions of Windows until Windows 8. Specifically, the hexadecimal error number and the four parameters were moved to the bottom of the screen after the four paragraphs under the label "Technical information:". References to Windows 2000 were shortened to simply say Windows, and the message about referring the user to the Getting Started manual for troubleshooting BSoDs (referred to as "stop errors") was also removed. The error screens also began with the now-infamous message:

A problem has been detected and Windows has been shut down to prevent damage to your computer.

The following is a re-creation of the BSoD from Windows XP to Windows 7, although they somewhat vary:

A problem has been detected and Windows has been shut down to prevent damage to your computer. APC_INDEX_MISMATCH If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow these steps: Check to make sure any new hardware or software is properly installed. If this is a new installation, ask your hardware or software manufacturer for any Windows updates you might need. If problems continue, disable or remove any newly installed hardware or software. Disable BIOS memory options such as caching or shadowing. If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode. Technical Information: *** STOP: 0x00000001 (0x00000000,0x00000000,0x00000000,0x00000000)

From Windows 2000 onwards, system memory dumps are automatically performed, usually in the form of a 64 KB "minidump" by default. When this happens, the BSoD on Windows 2000 will display the following message that replaces the four paragraphs of general instructions and advice, which can also be seen when "Write an event to the system log" and/or "Send an administrative alert" is checked in the "System Failure" section under "Startup and Recovery" in System Properties even when system memory dumps are disabled:

Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group.

On Windows XP, the above message remains the same, but with some slight modifications, and is displayed after the four paragraphs of general advice, which were hidden on Windows 2000 when a memory dump is performed:

Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group for further assistance.

In some cases, but especially for Windows Vista and 7, the following messages are displayed along with an indicator showing the progress of the memory dumps…

Collecting data for crash dump ... Initializing disk for crash dump ... Beginning dump of physical memory. Dumping physical memory to disk: 100

…which is then followed up with the below message being displayed upon completion of the memory dumps:

Physical memory dump complete. Contact your system admin or technical support group for further assistance.

Additionally, on versions of Windows using the 64-bit architecture, the BSoD would have the four parameters extended to sixteen digits ("0x0000000000000000") instead of eight ("0x00000000").

Later versions (Server 2012 and 8 onwards)

With the release of Windows 8 and Windows Server 2012, the BSoD was significantly changed, removing all of the above in favor of the error name and a concise description. Windows 8 also adds a sad emoticon to the error screen, which was absent from Japanese releases and Windows Server releases. The hexadecimal error code and parameters can still be found in the Windows Event Log or in memory dumps.

The main text that is displayed on the screen by default is read as follows:

Your PC/device ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you.

The above message can change depending on whether or not automatic restart or memory dumps are enabled or disabled. Such examples include:

1. BSoDs with the automatic restart functionality disabled but memory dumping enabled:

Your PC/device ran into a problem and needs to restart. We're just collecting some error info, and then you can restart.

2. BSoDs with the automatic restart functionality enabled but memory dumping disabled:

Your PC/device ran into a problem and needs to restart. We'll restart for you.

3. BSoDs with both the automatic restart functionality and memory dumping disabled:

Your PC/device ran into a problem and needs to restart. You can restart.

(NOTE: In both examples No.2 and No.3, a percentage completion (e.g. "100% complete") which shows the progress of the memory dumps being performed is absent when memory dumping is disabled.)

C-series BSoDs use the same format as the normal BSOD except with the aforementioned hexadecimal error code in place of the error name. Hardware errors causing an BSoD also uses the same format as the normal BSoD, including the use of the error name instead of an error code. One such example are BSoDs with the error name "NMI_HARDWARE_FAILURE" (error code 0x00000080). Written descriptions for certain error codes were also replaced with the error name due to the aforementioned changes to the format of the BSoD (i.e. the message A process or thread crucial to system operation has unexpectedly exited or been terminated for error code 0x000000F4 was replaced with the error name "CRITICAL_OBJECT_TERMINATION").

The format introduced with Windows Server 2012 and Windows 8 was retained in Windows 10 and Windows 11 (as well as its Server counterparts). Beginning with build 14316 of Windows 10 version 1607, a QR code was added to the screen for quick troubleshooting, while all references to the word "PC" were changed to "device" starting from Windows 10 version 2004 onwards. Build 26120.3291 of Windows 11 version 24H2 made a complete overhaul to the format of the BSoD, changing the layout to be more consistent with the design language of Windows 11 while removing the QR code and the sad emoticon completely. The hexadecimal error code (but not the parameters) returned and is shown after the error name, but without the leading zeroes (e.g. 0x00000001 (APC_INDEX_MISMATCH) becoming 0x01).

Windows 9x

The Windows 9x line of operating systems used the blue screen of death as the main way for virtual device drivers to report errors to the user. This version of the BSoD, internally referred to as "_VWIN32_FaultPopup", gives the user the option either to restart the computer or to terminate the current running program and continue using Windows, allowing the user to save their work before any data could be lost. Depending on the type of situation it may have occurred, however, the options to either continue or restart may or may not work at all. This is in contrast to the BSoDs in the Windows NT family, which prevented the user from using the computer until it has been powered off or restarted (usually automatic for the latter).

The most common BSoD was displayed on an 80×25 text-mode screen, which was the operating system's way of reporting an interrupt caused by a processor exception; it is a more serious form of the general protection fault dialog boxes. The memory address of the error was given and the error type was a hexadecimal number from 00 to 11 (0 to 17 decimal). The error codes are as follows:

• 00: Division fault
• 01: Startup Error
• 02: Non-Maskable Interrupt
• 03: Shutdown Error
• 04: Overflow Trap
• 05: Bounds Check Fault
• 06: Invalid Opcode Fault
• 07: "Coprocessor Not Available" Fault
• 08: Double Fault
• 09: Coprocessor Segment Overrun
• 0A: Invalid Task State Segment Fault
• 0B: Not Present Fault
• 0C: Stack Fault
• 0D: General Protection Fault
• 0E: Page Fault
• 0F: Error Message Limit Exceed
• 10: Coprocessor Error Fault
• 11: Alignment Check Fault

The following situations below can cause a BSoD:

• Missing or different dependency versions (e.g. VC++, .NET, DirectX, etc.);
• Faulty or poorly written kernel-level device drivers;
• Corrupted Windows core files;
• Misconfigured registry keys;
• Hardware incompatibilities;
• Damaged hardware such as failing memory, storage device, graphics card, etc., can also cause a BSoD.

In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con", "c:\aux\aux", or "c:\prn\prn" on the hard drive, which can be inserted on a website to crash visitors' machines as a prank. In reality, however, they are reserved device names for DOS systems; attempting to access them from Windows causes a crash, bringing up said BSoD. Creating the aforementioned directories within Windows will also not work and may cause the same BSoD to occur. On March 16, 2000, Microsoft released a security update to resolve this issue.

One famous instance of a Windows 9x BSoD occurred during a presentation of a Windows 98 beta given by Bill Gates at COMDEX on April 20, 1998: The demo PC crashed with a BSoD when his assistant, Chris Capossela, connected a scanner to the PC to demonstrate Windows 98's support for Plug and Play devices. This event brought thunderous applause from the crowd and Gates replied (after a nervous pause): "That must be why we're not shipping Windows 98 yet."

Similar screens

Stop errors are comparable to kernel panics in macOS, Linux, and other Unix-like systems, and to bugchecks in OpenVMS.

A black screen of death can occur upon hardware or software failures. Windows 3.1 displays a black screen of death instead of a blue one. Some versions of macOS (notably OS X Lion) display a black screen of death instead of a kernel panic, usually pointed to a graphics card or sleep/wake issue, it may also display a black screen when the operating system fails to boot properly. The Xbox series of consoles (which includes the original Xbox, Xbox 360, Xbox One and the Xbox Series X/S) also display a black screen when a hardware or software error occurs.

In some cases, a differently-colored error screen was used. Beta versions of Windows 98 display a red error screen raised by the Advanced Configuration and Power Interface (ACPI) when the host computer's BIOS encounters a problem. The bootloader of the first beta version of Windows Vista originally displayed a red screen background in the event of a boot failure, which was changed to black afterwards. As mentioned earlier, the insider builds of Windows 10 and later, as well as Windows Server 2016 and later, display a green screen instead of blue. Windows 10 and later (and Windows Server 2016 and later) also display an orange screen in an extremely rare case where a hardware issue with the GPU or a graphics driver problem was encountered.

ReactOS, an open-source operating system designed to achieve binary compatibility with Windows, implements a version of the blue screen of death similar to that used in Windows NT operating systems.

systemd, a software suite providing system components for Linux operating systems, also implements a version of the blue screen of death similar to that of Windows, albeit not as a replacement to the kernel panic in Linux (see above), but rather was used in the event of a bootup failure. This iteration uses systemd-bsod, which was added on December 6, 2023 starting with version 255 of systemd. Some versions of Linux (including Arch Linux) also use a kernel panic with a blue background, akin to that of the Windows blue screen of death.