Home Windows

Fix: ntoskrnl.exe BSOD in Windows

By Deep Shrestha

Fix: ntoskrnl.exe BSOD in Windows

The ntoskrnl.exe is a kernel image of the Windows operating system which is responsible for numerous system services such as process, memory management, and hardware virtualization. The cache manager, executive, kernel, security reference monitor, and scheduler are all part of the ntoskernel.exe. 

The default driver in Windows rarely causes a ntoskrnl.exe BSOD (Blue Screen of Death). However, if a custom, overclocked or obsolete driver corrupts the memory unit used by ntoskrnl.exe, the OS will blame it and display a BSOD to prevent the computer from further damage.

So, if we get any errors related to ntoskernel.exe, our first priority should be to check our memory module and uninstall any third-party driver.

Note: The ntoskrnl.exe file is located in C:\Windows\System32.

What Causes ntoskrnl.exe BSOD?

We have listed a few reasons your computer runs into ntoskrnl.exe Blue Screen of Death Error.

  • Faulty memory modules
  • Outdated driver
  • Overclocked memory
  • XMP (Extreme Memory Profile) enabled

Why Does ntoskrnl.exe Take a Lot of Memory?

The OS uses ntoskrnl.exe for any process that requires disk activity. Also, when communicating with devices and drivers, ntoskrnl.exe uses RAM to store the data.

Therefore, if we have a corrupted driver, there may be a memory management issue, consuming a high memory.

All ntoskrnl.exe BSOD Errors

The computer might run into many ntoskrnl.exe Blue Screen of Death errors. Although most of them are related to issues with memory management and driver problems, some errors may be caused by other factors.

  • driver_irql_not_less_or_equal ntoskrnl.exe
  • system_service_exception ntoskrnl.exe
  • irql_not_less_or_equal ntoskrnl.exe
  • page_fault_in_nonpaged_area ntoskrnl.exe
  • memory_management ntoskrnl.exe
  • kmode_exception_not_handled ntoskrnl.exe
  • unexpected_kernel_mode_trap ntoskrnl.exe
  • Critical_process_died ntoskrnl.exe
  • apc_index_mismatch ntoskrnl.exe
  • ntoskrnl.exe missing or corrupt
  • bad_pool_header ntoskrnl.exe

How to Fix ntoskrnl.exe Blue Screen of Death in Windows

Here is a list of solution that you can try to fix any issue with ntoskrnl.exe BSOD.

Run Windows Memory Diagnostic Tool

The Windows Diagnostic tool in Windows checks the memory modules for any fault. So, if your computer suffers from a constant Blue Screen of Death, you can run the Windows Memory Diagnostic Tool to find out any errors in your RAM sticks. 

Follow these steps to start the Windows Memory Diagnostic Tool.

  1. Press the Windows key + R.
  2. Type “mdsched.exe” and press Enter.
  3. Click Restart now and check for problems (recommended).
    windows-memory-diagnostics

Once the computer restarts, the system will run the Windows Memory Diagnostic. During the diagnostic process, the computer will show you the detailed report of your memory module. However, you can also use the Event Viewer feature to view the Windows log folder. 

Run SFC and DISM Command

The System File Checker (SFC) is a command which allows you to repair any corrupted system files. If the computer gets the ntoskrnl.exe BSOD with a corrupted Windows NT OS Kernel file, the SFC command will correct them. 

Follow these steps to run the System File Checker command.

  1. Press the Windows key + R.
  2. Type “cmd” without the quotation mark and press Ctrl + Shift + Enter to run Command Prompt as an administrator.
  3. In command, type sfc /scannow and press Enter.
    sfcscan
  4. The SFC feature will check for any corrupted Windows system files and repair them.

Note: System files are those files located inside System32.

If the SFC report says it could not fix some issues, the chkdsk command may resolve the issue. Follow these steps to run the chkdsk command

  1. Run Command Prompt as administrator.
  2. Type “chkdsk C: /r” without the quotation mark and press Enter.
    chkdsk
  3. Press Y if the command asks again for permission.
  4. Once the process is complete, restart the computer and run SFC again.

Once we run the SFC command, we need to run the DISM (Deployment Image Servicing and Management) command to manage both Windows Online and Offline Images. Follow these steps to run the DISM command. 

  1. Run Command Prompt as administrator.
  2. Type the following Command:
    DISM.exe /Online /Cleanup-Image /Restorehealth
    running-dism-command
  3. This command performs a cleanup and recovery operation on corrupted system Files.

Once you complete both SFC and DISM operations, restart your computer.

Revert Overclocked Hardware

Overclocked computer components are also known to cause ntoskrnl.exe Blue Screen of Death error. If a computer has overclocked RAM and it constantly turns off due to the BSOD, it is best to reset the BIOS settings. Therefore, resetting the BIOS setting will revert all overclocked devices to normal speed. 

Follow these steps to reset your BIOS.

  1. Enter the BIOS of your motherboard.
  2. Search for an option like Load Setup Defaults (depends on motherboard manufacturer).
    load-setup-defaults
  3. Press Enter and Save Changes.

Once the changes are saved, the computer will restart. 

Uninstall Third-Party Drivers

The computer may also get the ntoskrnl.exe BSOD due to unofficial drivers. If these drivers use the memory address allocated to ntoskrnl.exe, the OS forces the computer to the Blue Screen of Death to prevent any memory issue. 

Try uninstalling any third-party drivers or recently installed applications to fix this issue. 

Restore the Registry

Before starting this solution, this process requires a backup of the Windows Registry before the computer gets constant BSOD. You can skip this process if you do not have the backup file.

The registry contains the data of Windows information and settings. Therefore, if a computer starts to turn off randomly (or malfunction), we can use the backup of the registry to roll back the Windows settings. So, it is always recommended to make a backup of the Windows Registry every month. 

Follow these steps to restore the registry.

  1. Press the Windows + R key.
  2. Type “regedit” without the quotation mark.regedit-1
  3. The Registry Editor dialog box will open.
  4. Go to Files > Import.
  5. Here, Browse the backup of your Registry.
  6. Click Open and restart the computer.

Fix the Issue With Android Emulators

If you run an emulator software, you may get the ntoskrnl.exe BSOD error. Most android emulators require a Virtual Machine (VM) to give users a better gaming experience. However, Microsoft’s virtual machine can cause some memory issues when running the android emulator. 

Therefore, we either need to uninstall the emulator app or disable and restart Microsoft’s Virtual Machine to fix the ntoskrnel.exe BSOD issue.

To disable Microsoft’s VM, run the command as administrator and run the following command:

  • bcdedit /set hypervisorlaunchtype off
    disable-microsoft-vm

If this does not fix the issue, then uninstall the emulator.

Update Drivers

As we discussed, most of the ntoskrnl.exe BSOD error arises due to driver issues. Therefore, it is only ideal to update your drivers to fix this issue. However, some drivers like the Realtek Audio Drivers are known to cause the BSOD due to some unknown issues. 

To update your driver, Press the Windows + X key and click on Device Manager. Here, expand the list. Right-click the driver you want to update and click on Update. Now, Click on Search automatically for drivers.

update-driver-1

Once the update is complete, click on close.

You can also update all your drivers at once using the Windows Update feature. Go to Settings > Windows Update (Security & update > Windows Update for Windows 10). Click on Check for Updates.

WINDOWS-UPDATES

Once the download is complete, restart your computer to install the updates.

Note: Whether or not the Realtek Audio Drivers cause BSOD, it is ideal to uninstall and reinstall this driver.

Remove Faulty Memory Modules

A faulty RAM stick is the most common reason for a Blue Screen of Death. However, in this case, memory leak or poor memory management may also cause the Blue Screen of Death. Whatever may be the reason, we cannot rule out the fact that the memory module is faulty.

If the computer is running on dual memory, take one out of the slot to check if the computer still suffers from BSOD. If it does not, then the memory you just took out is the faulty one, causing your computer to crash constantly. Repeat this process for both memory sticks.

However, if you are running on a single memory stick, try using another RAM stick.

Reset Windows

If none of the above solutions fix the BSOD, we can try resetting the OS. Resetting the Windows can fix the BSOD errors like ntoskrnl.exe missing or corrupt as it will reinstall everything, including the system files.

Follow these steps to reset Windows.

  1. Click on the Start menu.
  2. Go to Settings > System > Recovery.
  3. Click on Reset this PC.
    reset-this-pc-get-started
  4. The Windows will ask you a series of questions like whether to keep files or remove everything. Choose according to your will. 
  5. The reset will take a few minutes to complete. 

Once the computer starts, the computer should be free from the constant shutdown.

Using Windows Performance Tool-kit

In order to use this, you need to have installed Windows ADK, which can be downloaded from official Microsoft’s website.

  1. Open Run and type in “CMD.” Then press Ctrl + Shift + Enter to start command prompt with administrator privileges.
  2. Paste the following command in the prompt:
    xperf -on latency -stackwalk profile -buffersize 1024 -MaxFile 256 -FileMode Circular && timeout -1 && xperf -d cpuusage.etl
    running-windows-performance-tool
  3. The code will run for 60 seconds and revert to default directory.
  4. A log file named cpuusage.etl will have been created in C:\Windows\system32.
  5. From this diagnostic file, details regarding the files and application causing the memory dump can be identified. Once the process has been identified, you can proceed to terminate or uninstall the application as required.

Resource Monitor Utility

The resource monitor utility is a crucial feature in Windows OS that lists CPU, disk, network and memory usage of all the process that are running. Using this feature, we can check if the ntoskrnl.exe file is performing smoothly.

Follow these steps to view Resource Monitor Utility.

  1. Press Ctrl + Alt + Del Key simultaneously.
  2. Select Task Manager and go to Performance tab.
  3. Now, click on Open Resource Monitor to open the Resource Monitor dialog box.
    open-resource-monitor
  4. On Overview tab, Under CPU, you can see all the process and their details. Here, click on PID (Process ID) until all process are displayed in ascending order.
  5. Locate The Process ID 4 which is the PID of ntoskrnl.exe and will be indicated as System under Image. 
  6. Right-click on System and click on Analyze Wait Chain…. It must read System is running normally.
    analyse-wait-chain-of-system

Disable Startup Process

Some application process may run automatically when the computer starts. If these startup application, for unknown reason, uses the same memory address causing a conflict. This will result in a ntoskrnl.exe Blue Screen of Death. 

Therefore, we need to disable any unnecessary startup process from the task manager. To disable start up process, follow these steps.

  1. Press Ctrl + Alt + Del key.
  2. Click on Task Manager. Then, click on More details.
  3. Here, you will see all the process running in the background. 
  4. Click on the Startup tab.
  5. Right-click on any process that you do not need during startup and select Disable.
    disable-steam-on-startup
  6. It is recommended to check the Startup impact as well. Remove any process from startup with Startup impact Low or None.
    startup-impact-low-or-none

Malware Issue

Malicious software and virus can attack the system files on our computer. This may cause a system file to corrupt or the computer may not detect them at all. When a computer does not detect a system files (files inside System32), it cannot function. This will result in constant Blue Screen of Death.

You can also look for the process in task manager. If the PID of the process consuming your CPU is 4, the process is authentic and belongs to the OS. But, if the PID is something different than it can be assured that the process has been infected by malware and causing the crash.

Use Antivirus software to detect and remove any malicious software and virus from your computer.

How to Reinstall ntoskrnl.exe File?

The computer will not boot if it does not find the ntoskrnl.exe file. Therefore, there is no way you can reinstall the file as the computer will not boot at all. We can only solve a ntoskrnl.exe file missing issue by reinstalling the OS itself.

Reinstalling the OS from scratch will install all its system files, including the Windows NT Operating System Kernel file.