In the
Windows NT family of operating systems, the blue screen of death (referred to as "
bug check" in the Windows
software development kit and driver development kit documentation) occurs when the kernel or a driver running in
kernel mode encounters an error from which it cannot recover. This was usually caused by an
illegal operation being performed. The only safe action the operating system can take in this situation was to
restart the computer. Because of this, data loss may occur since the restart was unplanned, and the user was not given an opportunity to save their work. The text on the error screen contains the code of the error and its symbolic name (e.g. ) along with four error-dependent values in parentheses that are there to help software engineers fix the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which was loaded at that address. Under Windows NT, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information was in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a
Unix timestamp), and the third lists the name of the driver. By default, Windows will create a
memory dump file when a stop error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "minidump" (introduced in Windows 2000) to a "complete dump" which was effectively a copy of the entire contents of physical memory (
RAM). The resulting memory dump file may be debugged later, using a kernel
debugger. For Windows, WinDBG or KD debuggers from
Debugging Tools for Windows are used. A debugger was necessary to obtain a
stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen was limited and thus possibly misleading, it may hide the true source of the error. By default, Windows XP was configured to save only a 64kB minidump when it encounters a stop error, and to then automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a
random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error. This happens only when the computer has a function called "Auto Restart" enabled, which can be disabled in the Control Panel which in turn shows the stop error. Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate
computer. If a stop error was encountered while a live kernel debugger was attached to the system, Windows will halt execution and cause the debugger to break in, rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem. A BSoD can also be caused by a critical boot loader error, where the operating system was unable to access the boot partition due to incorrect storage drivers, a damaged file system or similar problems. The error code in this situation was . In such cases, there was no memory dump saved. Since the system was unable to boot from the hard drive in this situation, correction of the problem often requires using the repair tools found on the Windows installation disc.
Details Earlier versions (NT, 2000, XP, Vista, 7) BSoDs in the Windows NT family before the release of
Windows 8 and
Windows Server 2012 displayed the error name in uppercase (e.g. ) and its respective hexadecimal error number (e.g. ), along with four parameters. This was shown together in the following format: Depending on the error number and its nature, all, some, or even none of the parameters contain data pertaining to what went wrong, and/or where it happened. In addition, starting with
Windows 2000 onwards, the error screens showed up to four paragraphs of general explanation and advice and may have included other technical data such the file name of the culprit and memory addresses. The following is a re-creation of the BSoD from Windows 2000, although they somewhat vary: For C-series error codes (also known as hard errors), the BSoD would be truncated, sometimes not showing the error name, codes, or the four paragraphs of advice. Instead, it would often show different formats of the error screen depending on the type of error that occurred. Such examples include: 1. BSoDs related to the termination of the
Winlogon process (e.g. ""): {{pre|style=background-color: #000080; color: #ffffff|border=no|width=640px| STOP: c000021a {Fatal System Error} The Windows Logon Process/SubSystem system process terminated unexpectedly with a status of parameter 1 (parameter 2 parameter 3). The system has been shut down. }} (NOTE: On Windows 2000, the above message was sometimes displayed alongside the four paragraphs of general instructions and advice, the latter of which is absent on Windows XP to Windows 7.) 2. BSoDs related to a corrupt registry file critical to the operating system (e.g. ""): {{pre|style=background-color: #000080; color: #ffffff|border=no|width=640px| STOP: c0000218 {Registry File Failure} The registry cannot load the hive (file):\SystemRoot\System\Config\SOFTWARE or its log or alternate. It is corrupt, absent, or not writable. }} 3. Hardware errors that can prevent Windows from booting properly (This example is ; note that the error code is not shown in this example below): Certain error codes would contain descriptions that were used on the BSoD in lieu of the error name, describing what kind of error that has happened. For example, BSoDs with error code originally read "A process or thread crucial to system operation has unexpectedly exited or been terminated", and BSoDs with error code originally read "The user manually initiated the crash dump". With the release of
Windows XP, the layout of the BSoD was slightly altered, which would remain in use for subsequent versions of Windows until
Windows 8. Specifically, the hexadecimal error number and the four parameters were moved to the bottom of the screen after the four paragraphs under the label "Technical information:". The message about referring the user to the Getting Started manual for troubleshooting BSoDs (referred to as "stop errors") was also removed, and references to Windows 2000 were shortened to simply say Windows. The error screens also began with the now-infamous message: The following is a re-creation of the BSoD from Windows XP to Windows 7, although they somewhat vary: From Windows 2000 onwards, system memory dumps are automatically performed, usually in the form of a 64 KB "minidump" by default. When this happens, the BSoD on Windows 2000 will display the following message that replaces the four paragraphs of general instructions and advice, which can also be seen when "Write an event to the system log" and/or "Send an administrative alert" is checked in the "System Failure" section under "Startup and Recovery" in System Properties even when system memory dumps are disabled: On Windows XP, the above message remains the same, but with some slight modifications, and is displayed after the four paragraphs of general advice, which were hidden on Windows 2000 when a memory dump is performed: On Windows Vista and 7, the following messages are displayed along with an indicator showing the progress of the memory dumps: Upon completion of the memory dumps, the following message is then displayed on screen: Additionally, on versions of Windows using the 64-bit architecture, the BSoD would have the four parameters extended to sixteen digits ("") instead of eight ("").
Later versions (Server 2012 and 8 onwards) With the release of Windows 8 and Windows Server 2012, the BSoD was significantly changed, removing all of the above in favor of the error name and a concise description. Windows 8 also adds a sad emoticon to the error screen, which was absent from Japanese releases and Windows Server releases. The hexadecimal error code and parameters can still be found in the
Windows Event Log or in
memory dumps. The main text that is displayed on the screen by default is read as follows: The above message can change depending on whether or not automatic restart or memory dumps are enabled or disabled. Such examples include: 1. BSoDs with the automatic restart functionality disabled but memory dumping enabled: 2. BSoDs with the automatic restart functionality enabled but memory dumping disabled: 3. BSoDs with both the automatic restart functionality and memory dumping disabled: (NOTE: In both examples No.2 and No.3, a percentage completion (e.g. "100% complete") which shows the progress of the memory dumps being performed is absent when memory dumping is disabled.) C-level BSoDs, including ones relating to Winlogon termination, use the same format as the normal BSoD with the aforementioned hexadecimal error code in place of the error name. Hardware errors causing an BSoD also uses the same format as the normal BSoD, including the use of the error name instead of an error code. One such example are BSoDs with the error name "" (error code ). Unlike with Windows 7 and prior, error codes that had written descriptions were changed to simply use the error name due to the aforementioned changes to the format of the BSoD, for instance, the message "A process or thread crucial to system operation has unexpectedly exited or been terminated" for error code was changed to use the error name "". The format introduced with Windows Server 2012 and Windows 8 was retained in Windows 10 and Windows 11 (as well as its Server counterparts). Beginning with build 14316 of Windows 10 version 1607, a
QR code was added to the screen for quick troubleshooting, while all references to the word "PC" were changed to "device" starting from Windows 10 version 2004 onwards. Build 26120.3291 of Windows 11 version 24H2 made a complete overhaul to the format of the BSoD, changing the layout to be more consistent with the design language of Windows 11 while removing the QR code and the sad emoticon completely. The hexadecimal error code (but not the parameters) returned and is shown after the error name, but without the leading zeroes (e.g. becoming ). ==Windows 9x==