Critical Process Died in Windows 11 is a blue-screen stop error with bug check code 0x000000EF. Windows displays it when a process required for the operating system ends unexpectedly or its data becomes corrupted.
The stop code identifies what Windows detected, not what caused it. A damaged system file, faulty storage, unstable memory, a bad driver, malware, or an interrupted update can all produce the same screen. The most useful starting point is whether Windows can still reach the desktop.
Start with the situation that matches your PC
| What is happening | Start here |
|---|---|
| Windows starts after one crash | Record what changed and check reliability history |
| The error began after a driver or Windows update | Roll back the specific recent change |
| Windows crashes during startup | Enter Windows Recovery Environment and use Safe Mode |
| SFC or DISM reports corruption | Repair the component store and system files |
| Crashes occur during disk activity or files become corrupted | Back up immediately and check the system drive |
| BSODs continue with different stop codes | Test memory, storage, temperatures, and system stability |
Disconnect newly attached nonessential USB devices before proceeding. A faulty external drive, dock, adapter, or peripheral driver can trigger crashes and complicate the diagnosis.
When Windows still reaches the desktop
Do not begin with a reset. First identify whether the crash followed a specific change.
Review recent changes and reliability history
Press Windows key + R, enter perfmon /rel, and open Reliability Monitor. Look at the day and time of the Critical Process Died event. Check for a driver installation, Windows update, application failure, or hardware error immediately before it.
Also inspect:
- recently installed drivers or device utilities;
- new antivirus, system-tuning, or disk-management software;
- a Windows update installed just before the first crash;
- storage warnings or sudden freezes; and
- BIOS changes, overclocking, undervolting, or memory-profile changes.
Reliability Monitor does not always name the responsible component, but the timeline can prevent unrelated fixes. Return overclocked hardware to default settings while testing.
Windows may save crash dumps under C:\Windows\Minidump. Their presence confirms that Windows captured crash information, but interpreting the responsible module requires debugging knowledge. Do not delete the files before a technician or support engineer reviews them.
Roll back the driver that changed
A recently updated storage, chipset, graphics, or security-related driver deserves attention when the timing matches the crashes.
- Right-click Start and open Device Manager.
- Expand the relevant device category.
- Open the device’s Properties > Driver tab.
- Select Roll Back Driver when available.
- Restart Windows and test normal use.
Do not update every driver at once. That removes the ability to identify which change helped and may introduce another incompatible package. Use the PC manufacturer’s driver for storage controllers, chipset components, and laptop-specific hardware when one is provided.
Remove a recent Windows update only when the timing matches
Open Settings > Windows Update > Update history > Uninstall updates. Remove only the latest applicable quality update when the crashes began immediately after it and no known correction is available.
Restart and test. Avoid removing security updates as routine maintenance. Reinstall a corrected update when Microsoft or the device manufacturer resolves the conflict.
When Windows is trapped in a crash loop
Reach Windows Recovery Environment by allowing Windows to enter Automatic Repair after repeated failed starts, or boot from official Windows installation media and select Repair your computer.
Choose:
Troubleshoot > Advanced options > Startup Settings > Restart
Then select Safe Mode. The Windows 11 Safe Mode guide covers the available entry routes when Windows starts, partially starts, or does not reach the sign-in screen.
A PC that remains stable in Safe Mode points toward a third-party driver, startup application, or service rather than basic Windows startup files. Remove the recent suspect software or driver, then restart normally.
When Safe Mode also crashes, prioritize system-file, storage, and memory checks. Startup Repair may help when boot configuration or startup components are damaged, but it is not a universal BSOD repair.
Repair Windows system files
Open Windows Terminal as administrator and run DISM first:
DISM /Online /Cleanup-Image /RestoreHealthAfter DISM completes, run:
sfc /scannowDISM repairs the Windows component store that SFC uses as a repair source. SFC then verifies protected operating-system files and replaces damaged copies where possible. Restart after both commands finish.
When Windows will not start, open Command Prompt from Advanced options. Offline repair uses different drive letters and command syntax, so first identify the Windows partition rather than assuming it is C: inside Recovery Environment.
Repeatedly running SFC without acting on its result adds no value. The SFC /scannow troubleshooting guide explains what to do when Windows Resource Protection cannot start, cannot perform the requested operation, or finds files it cannot repair.
Check the system drive before resetting Windows
Storage failure can corrupt a critical Windows process and then make repair or reset operations fail. Back up important data first when the PC still starts.
Run a non-disruptive file-system scan from an elevated terminal:
chkdsk C: /scanReview the result instead of immediately scheduling an aggressive repair. Warning signs of physical drive trouble include:
- SMART or manufacturer diagnostic warnings;
- freezes during file access;
- files that repeatedly become corrupted;
- clicking from a mechanical hard drive;
- the drive disappearing from UEFI; or
- repair tools failing at inconsistent points.
CHKDSK repairs file-system structures; it cannot restore failing flash memory or mechanical hardware. Replace an unhealthy drive rather than repeatedly reinstalling Windows onto it.
Test memory when crashes are inconsistent
Faulty or unstable RAM can corrupt data used by critical processes. Press Windows key + R, enter mdsched.exe, and choose to restart and check for problems.
Windows Memory Diagnostic is a useful first test, but a passing result does not prove that memory is healthy. Persistent crashes with different stop codes may justify a longer bootable memory test, testing one module at a time, or professional hardware diagnosis.
Disable XMP, EXPO, memory overclocking, and CPU undervolting temporarily. Stability at default firmware settings is more meaningful than repeating Windows repairs on an unstable system.
Scan for malware without adding another conflict
Open Windows Security > Virus & threat protection > Scan options and run a Full scan. Use Microsoft Defender Offline scan when persistent malware is suspected and the PC can restart safely.
Do not install several real-time antivirus products to investigate one crash. Competing security drivers can destabilize Windows and make the original problem harder to isolate.
Use recovery options in the least destructive order
System Restore is appropriate when a restore point exists from before the crashes. It reverses system files, drivers, registry changes, and installed software without normally deleting personal documents.
Choose Troubleshoot > Advanced options > System Restore from Windows Recovery Environment, or search for Create a restore point when Windows starts.
When system corruption persists but Windows reaches the desktop, use the repair reinstall that keeps apps and files before Reset this PC. It replaces Windows components while preserving more of the current setup.
Reset this PC is a later option. Keep my files retains normal personal files but removes applications and resets settings. Remove everything is destructive and requires a verified backup.
Microsoft’s Windows recovery options comparison can help confirm which recovery path matches the computer’s condition.
How to tell software failure from hardware instability
Software is more likely when the problem began immediately after one identifiable update, the PC remains stable in Safe Mode, and rolling back the change stops the crashes.
Hardware deserves priority when:
- Critical Process Died appears alongside several other stop codes;
- Windows crashes during installation or before third-party software loads;
- corruption returns after a clean installation;
- memory or storage diagnostics report errors;
- the computer freezes outside Windows; or
- crashes track heat, movement, or heavy load.
Microsoft defines bug check 0xEF as the termination of a critical system process. The documentation confirms the stop condition, but the machine’s timeline, dump files, and hardware tests are what identify the underlying cause.
A single crash that never returns does not justify a reset. Install applicable updates, monitor Reliability Monitor, and keep a current backup. Repeated crashes require evidence-led diagnosis, starting with the most recent change and escalating only when the results point elsewhere.
