Troubleshooting Windows 10

Dealing with Stop errors

If Windows has ever suddenly shut down, you’ve probably experienced that sinking feeling in the pit of your stomach. When Windows 10 encounters a serious problem that makes it impossible for the operating system to continue running, it does the only thing it can do, just as every one of its predecessors has done in the same circumstances. It shuts down immediately and displays an ominous text message whose technical details begin with the word STOP. Because a Stop error typically appears in white letters on a blue background, this type of message is often referred to as a blue-screen error or the Blue Screen of Death (BSOD). When a Stop error appears, it means that there is a serious problem that demands your immediate attention.

Windows 10 collects and saves a variety of information in logs and dump files, which a support engineer or developer armed with debugging tools can use to identify the cause of Stop errors. You don’t have to be a developer to use these tools, which are available to anyone via download from bit.ly/windows-debugging-tools. (Don’t worry; you can’t break anything by simply inspecting a .dmp file.) If you know where to look, however, you can learn a lot from these error messages alone, and in many cases you can recover completely by using standard troubleshooting techniques.

Customizing how Windows handles Stop errors

When Windows encounters a serious error that forces it to stop running, it displays a Stop message and then writes debugging information to the page file. When the computer restarts, this information is saved as a crash dump file, which can be used to debug the specific cause of the error.

You can customize two crucial aspects of this process by defining the size of the crash dump files and specifying whether you want Windows to restart automatically after a Stop message appears. By default, Windows automatically restarts after a Stop message and creates a crash dump file optimized for automatic analysis. That’s the preferred strategy in response to random, isolated Stop errors. But if you’re experiencing chronic Stop errors, you might have more troubleshooting success by changing these settings to collect a more detailed dump file and to stop after a crash.

To make this change, open Settings, type advanced in the search box, and then click View Advanced System Settings in the results list. (Or, in the Run or search box, type the undocumented command systempropertiesadvanced and press Enter.)

On the Advanced tab of the System Properties dialog box, under Startup And Recovery, click Settings. Adjust the settings under the System Failure heading, as shown in Figure 17-10.

Figure 17-10 By default, Windows keeps a kernel memory dump and restarts automatically after a Stop error. You can pick a larger or smaller dump file here.

If you want Windows to pause at the Stop error message page, clear the Automatically Restart check box and click OK.

From the same dialog box, you can also define the settings for crash dump files. By default, Windows sets this value to Automatic Memory Dump, which saves a kernel memory dump after a crash. This option includes memory allocated to kernel-mode drivers and programs, which are most likely to cause Stop errors. Because this file does not include unallocated memory or memory allocated to user-mode programs, it will usually be smaller in size than the amount of RAM on your system. The exact size varies, but in general you can expect the file to be no larger than one-third the size of installed physical RAM, and much less than that on a system with 16 GB of RAM or more. The crash files are stored in %SystemRoot% using the file name Memory.dmp. (If your system crashes multiple times, each new dump file replaces the previous file.)

If disk space is limited or you’re planning to send the crash dump file to a support technician, you might want to consider setting the system to store a small memory dump (commonly called a mini dump). A small memory dump contains just a fraction of the information in a kernel memory dump, but it’s often enough to determine the cause of a problem.

What’s in a Stop error

The exact text of a Stop error varies according to what caused the error. But the format is predictable. Don’t bother copying down the error code from the blue screen itself. Instead, look through Event Viewer for an event with the source BugCheck, as shown in the example in Figure 17-11.

Figure 17-11 Decoding the information in a Stop error can help you find the underlying problem and fix it. Start with the error code—0x0000003b, in this example.

You can gather important details from the bugcheck information, which consists of error number (in hexadecimal notation, as indicated by the 0x at the beginning of the code) and up to four parameters that are specific to the error type.

Windows 10 also displays the information in Reliability Monitor, under the heading Critical Events. Select the day on which the error occurred and double-click the “Shut down unexpectedly” entry for an event with Windows as the source. That displays the bugcheck information in a slightly more readable format than in Event Viewer, as shown next, even using the term BlueScreen as the Problem Event Name. (For more information, see “Reliability Monitor,” earlier in this chapter.)

For a comprehensive and official list of what each error code means, see the MSDN “Bug Check Code Reference” at bit.ly/bugcheck-codes. A code of 0x00000144, for example, points to problems with a USB 3 controller, whereas 0x0000009F is a driver power state failure. (Our favorite is 0xDEADDEAD, which indicates a manually initiated crash.) In general, you need a debugger or a dedicated analytic tool to get any additional useful information from a memory dump file.

Isolating the cause of a Stop error

If you experience a Stop error, don’t panic. Instead, run through the following troubleshooting checklist to isolate the problem and find a solution:

• Don’t rule out hardware problems. In many cases, software is the victim and not the cause of blue-screen errors. Common hardware failures such as a damaged hard disk or a corrupted SSD, defective physical RAM, an overheated CPU chip, or even a bad cable can result in Stop errors. If the errors seem to happen at random and the message details vary each time, there is a very good chance that you are experiencing hardware problems.

• Check your memory. Windows 10 includes a memory diagnostic tool that you can use if you suspect a faulty or failing memory chip. To run this diagnostic procedure, type memory in the search box and click Windows Memory Diagnostic in the search results. This tool, shown here, requires a restart to run its full suite of tests, which you can perform immediately or defer until your next restart.

  
• Look for a driver name in the error details. If the error message identifies a specific file name and you can trace that file to a driver for a specific hardware device, you might be able to solve the problem by disabling, removing, or rolling back that driver to an earlier version. The most likely offenders are network interface cards, video adapters, and disk controllers. For more details about managing driver files, see “Updating and uninstalling drivers” in Chapter 13, “Hardware.”
• Ask yourself, “What’s new?” Be suspicious of newly installed hardware and software. If you added a device recently, remove it temporarily and see whether the problem goes away. Take an especially close look at software in the categories that install services or file-system filter drivers—these hook into the core operating system files that manage the file system to perform tasks such as scanning for viruses. This category includes backup programs, multimedia applications, antivirus software, and DVD-burning utilities. You might need to permanently uninstall or update the program to resolve the problem.
• Search Microsoft Support. Make a note of the error code and all parameters. Search Microsoft Support using both the full and short formats. For instance, if you’re experiencing a KMODE_EXCEPTION_NOT_HANDLED error, use 0x1E and 0x0000001E as your search keywords.
• Check your system BIOS or firmware. Is an update available from the manufacturer of the system or motherboard? Check the BIOS or firmware documentation carefully; resetting all BIOS options to their defaults can sometimes resolve an issue caused by overtweaking.
• Are you low on system resources? Stop errors are sometimes the result of a critical shortage of RAM or disk space. If you can start in Safe Mode, check the amount of physical RAM installed and look at the system and boot drives to see how much free disk space is available.
• Is a crucial system file damaged? To reinstall a driver, restart your computer, press F8, and start Windows in Safe Mode. In Safe Mode, only core drivers and services are activated. If your system starts in Safe Mode but not normally, you very likely have a problem driver. Try running Device Manager in Safe Mode and uninstalling the most likely suspect. Or run System Restore in Safe Mode. If restoring to a particular day cures the problem, use Reliability Monitor to determine what changes occurred on or shortly after that day.