A user reports a Blue Screen of Death on their workstation. What information would you collect, and how would you begin diagnosing the root cause?

Question

Accepted Answer

A Blue Screen of Death, commonly referred to as a BSOD, occurs when Windows encounters a critical error that it cannot recover from. The system halts and displays a blue screen with a stop code and, in newer versions of Windows, a QR code that links to troubleshooting information. As an L2 technician, your job is to move beyond the surface symptoms and identify the underlying cause so the issue does not recur.

The first piece of information to collect is the stop code displayed on the blue screen itself. Stop codes like IRQL_NOT_LESS_OR_EQUAL, KERNEL_DATA_INPAGE_ERROR, or SYSTEM_SERVICE_EXCEPTION each point to different categories of problems. If the user did not note the stop code, you can retrieve it from the system after it reboots.

Once the machine is back online, open Event Viewer and navigate to Windows Logs, then System. Look for events marked as Critical or Error around the time of the crash. The BugCheck event, typically under the source "BugCheck," will list the stop code and parameters. This gives you the same information that was on the blue screen, even if no one recorded it at the time.

Next, check if Windows created a memory dump file. By default, Windows saves a minidump to C:\Windows\Minidump after a BSOD. You can open these dump files using the Windows Debugger tool, WinDbg, which is part of the Windows SDK. Running the command "!analyze -v" in WinDbg performs an automated analysis of the crash dump and often identifies the specific driver or module that caused the failure. This is one of the most powerful tools for BSOD diagnosis.

Gather context from the user as well. Ask what they were doing when the crash occurred. Were they running a specific application? Did they recently install new software or a driver update? Had the machine been running unusually slowly beforehand? Was there a Windows Update applied recently? These details help narrow the scope of your investigation.

Common BSOD causes fall into a few categories. Driver issues are the most frequent culprit, especially after a Windows Update or when new hardware is connected. Hardware failures, particularly in RAM and storage drives, cause data corruption that triggers blue screens. Overheating can cause instability, especially in laptops with clogged vents. Corrupted system files, a failing hard drive, or malware can also be responsible.

For recurring BSODs, run hardware diagnostics. Use Windows Memory Diagnostic to test the RAM. Check the health of the storage drive using tools like CrystalDiskInfo or the built-in chkdsk utility. Verify that all drivers are up to date, paying special attention to graphics drivers, chipset drivers, and network adapters.

Document your findings in the ticket, including the stop code, the analysis from WinDbg if available, any patterns you identified, and the resolution. If the BSOD is a one-time event and no underlying issue is found, monitor the system for recurrence before closing the ticket.