Blue Screen Of Death

Possible issues contributing to a BSoD may include hardware failures, an issue with or without a device driver, viruses, malware, and other factors such as intentional user action.

• Illustration — The boot screens of Windows 1.01 and 2.03 when running on an incorrect DOS version, displaying mojibake Blue screen errors have been around since the first version of Windows in 1985. In one of the beta versions of Windows 1.0, the boot screen would have the text "Incorrect DOS version" alongside other messages detailing what check failed to pass appended into it if it detects a version of DOS that is newer than the OS expects before starting normally. This behavior remains in the final version released to retail (version 1.01); however, the remaining text messages were removed during development in the lead up to Windows 1.0's release, displaying mojibake instead. This does not indicate a system crash, however, as when the system actually crashes, it usually results in a freeze or the operating system exiting out to DOS. This behavior is also present in Windows 2.0 and Windows 2.1. Windows 3.0 uses a text-mode screen for displaying important system messages, usually from digital device drivers in 386 Enhanced Mode or other situations where a program could not run. Windows 3.1 changed the color of this screen from black to blue. It also displays a blue screen when the user presses the Ctrl+Alt+Delete key combination to bring up a rudimentary task manager that is reserved for quitting any unresponsive programs if they are available. Like previous versions of Windows, Windows 3.x exits to DOS if an error condition is severe enough.

On June 26, 2025, Microsoft announced that the color of the BSoD would be officially changed to black alongside an overhaul of the design of the screen itself which will be present in Windows 11 version 24H2, saying that the new design will be "easier to navigate unexpected restarts and faster recoveries". This new redesign appeared in later insider builds of Windows 11 version 24H2 as early as February 21, 2025 before it was set as the default on March 28, 2025. Previously, the color change appeared on a few builds of Windows 11 (including the RTM) before reverting to a more different shade of blue in later builds of Windows 11 before February 21, 2025. The announcement was made nearly a year after the 2024 CrowdStrike outages in July 2024 (which caused BSoDs to many computers in the business and enterprise segments running Windows due to an update bug), and the change was made eight months after the incident.

• Illustration — The rudimentary task manager screen from Windows 3.1x, often confused with the blue screen of death due to its similarities On September 4, 2014, several online journals including Business Insider, DailyTech, Engadget, Gizmodo, Lifehacker, Neowin, Softpedia, TechSpot, Boy Genius Report (BGR), The Register, and The Verge, as well as print and non-English sources like PC Authority and Austrian tech site FutureZone all attributed the creation of the blue screen of death to Steve Ballmer, the former CEO of Microsoft. The articles specifically cited a blog post by Microsoft employee Raymond Chen entitled "Who wrote the text for the Ctrl+Alt+Del dialog in Windows 3.1?", which focused on the creation of the first rudimentary task manager in Windows 3.x. The aforementioned task manager shared some visual similarities with a BSoD, with Ballmer writing the messages that appeared on the screen. Chen himself addressed this misinformation in a blog post on September 9, 2014, where he was scathing about the evaluation of major tech news sites that had picked up on the incorrect story and performed poor or non-existent research that demonstrated complete ignorance of his original account. In addition to the faulty base story, he noted that over half a dozen sites had included other embellished or invented details in their stories, including incorrectly naming Chen as a Microsoft executive, treating Chen as an "official company spokesperson", and using unrelated images from Windows 95 or Windows NT as illustrations. He also pointed out one specific site that has the worst single distortion out of any misinformations (that being BGR (Boy Genius Report)), who "fabricated a scenario and posited it as real" in a rhetorical question to readers, and found that several sources had conflated the creation of the BSoD with the fact that they occur, thus inverting cause and effect by implying that the invention of BSoDs caused fatal errors to occur instead of their actual, helpful function of giving the user information about a fatal error after the system has already become unrecoverable (such incorrect sources transitively blamed Ballmer for the existence of all fatal crashes in Windows). He would then later follow this up with another blog post a day later on September 10, claiming responsibility for revising the BSoD in Windows 95. He mentions the fact that he was the one who "sort of" created the BSoD in its first modern incarnation in Windows 95. According to former Microsoft employee Dave Plummer, the BSoD in the Windows NT family was not based on the rudimentary task manager screen of Windows 3.x, but was actually designed by Microsoft developer John Vert. Vert has also stated the reason why the error screens were blue was because the universal color palette of the video hardware at that time was very rudimentary and he personally used a MIPS OS box and SlickEdit for programming so that both the firmware and editor displayed white text on a blue background, making it for a more consistent programming experience.

section BSoDs originally showed silver (HTML color #A8A8A8) (and later white (HTML color #FFFFFF)) text on a royal blue (HTML color #0000A8 for Windows NT 3.1–4.0; HTML color #000080 for Windows 2000–7) background with information about current memory values and register values. Starting with Windows Server 2012 (released in September 2012), Windows adopted a cerulean background (HTML color #1A67B3 for Windows 8/8.1 to Windows 10 version 1511; HTML color #0078D7 for Windows 10 version 1607–22H2). Earlier versions of Windows 11 used a black background, which was changed to dark blue starting with build 22000.348 and then back to black with build 26120.3653. Preview builds of Windows 10, Windows 11, and Windows Server (available from the Windows Insider program) feature a dark green (HTML color #246F24) background instead of a blue one. Windows 3.1, 95, and 98 supports customizing the color of the screen whereas the color was hard-coded in the Windows NT family. Windows 95, 98, and Me render their BSoDs in the 80×25 text mode with a 720×400 screen resolution. BSoDs in the Windows NT family initially used the 80×50 text mode with a 720×400 screen resolution, but were displayed in a 640×480 screen resolution starting with Windows 2000. BSoDs from Windows 8 and Windows Server 2012 onwards are rendered in higher resolutions than previous versions of Windows, specifically the highest screen resolution available on UEFI machines. On legacy BIOS machines, they use the 1024×768 resolution by default, but they can also be configured to use the highest resolution exposed by the firmware (via the highestmode parameter in Boot Configuration Data). Windows 95, 98, Me, and NT versions prior to Windows 2000 used text mode fonts provided by the graphics adapter; Windows 2000, XP, Vista and 7 used kernel mode fonts provided by the kernel's boot video driver bootvid.dll, which is a text mode-like font used in Windows 2000 and Lucida Console in Windows XP to 7. Windows 8 and Windows Server 2012 onwards use the Segoe UI font. Windows 10 builds 14316 and up uses the same format as Windows 8, but has a QR code which leads to a Microsoft Support web page that tries to help users troubleshoot the issue step-by-step. This format was retained in Windows 11, however build 26120.3291 onwards changes the layout to be more consistent with that of Windows 11's UI, removing the QR code among other changes.

In the Windows NT family of operating systems, the blue screen of death (referred to as "bug check" in the Windows software development kit and driver development kit documentation) occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This was usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation was to restart the computer. Because of this, data loss may occur since the restart was unplanned, and the user was not given an opportunity to save their work. The text on the error screen contains the code of the error and its symbolic name (e.g. 0x0000001E (KMODE_EXCEPTION_NOT_HANDLED)) along with four error-dependent values in parentheses that are there to help software engineers fix the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which was loaded at that address. Under Windows NT, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information was in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. By default, Windows will create a memory dump file when a stop error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64kB "minidump" (introduced in Windows 2000) to a "complete dump" which was effectively a copy of the entire contents of physical memory (RAM). The resulting memory dump file may be debugged later, using a kernel debugger. For Windows, WinDBG or KD debuggers from Debugging Tools for Windows are used. A debugger was necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information on-screen was limited and thus possibly misleading, it may hide the true source of the error. By default, Windows XP was configured to save only a 64kB minidump when it encounters a stop error, and to then automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error. This happens only when the computer has a function called "Auto Restart" enabled, which can be disabled in the Control Panel which in turn shows the stop error. Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. If a stop error was encountered while a live kernel debugger was attached to the system, Windows will halt execution and cause the debugger to break in, rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem. A BSoD can also be caused by a critical boot loader error, where the operating system was unable to access the boot partition due to incorrect storage drivers, a damaged file system or similar problems. The error code in this situation was STOP: 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there was no memory dump saved. Since the system was unable to boot from the hard drive in this situation, correction of the problem often requires using the repair tools found on the Windows installation disc.

BSoDs in the Windows NT family before the release of Windows 8 and Windows Server 2012 displayed the error name in uppercase (e.g. APC_INDEX_MISMATCH) and its respective hexadecimal error number (e.g.), along with four parameters. This was shown together in the following format: error code (parameter 1, parameter 2, parameter 3, parameter 4) error name Depending on the error number and its nature, all, some, or even none of the parameters contain data pertaining to what went wrong, and/or where it happened. In addition, starting with Windows 2000 onwards, the error screens showed up to four paragraphs of general explanation and advice and may have included other technical data such the file name of the culprit and memory addresses. The following is a re-creation of the BSoD from Windows 2000, although they somewhat vary: C-series error codes (also known as hard errors) had a truncated BSoD design, oftentimes not showing the error name, codes, or the four paragraphs of advice. Instead, it would show various different formats of the error screen depending on the type of error that occurred, including: 1. BSoDs related to the termination of the Winlogon process (e.g. "0xC000021A (WINLOGON_FATAL_ERROR)"): (NOTE: Depending on the type of error that occurred, "Windows Logon Process" would be displayed as "Windows SubSystem" or similar. On Windows 2000, the above message was sometimes accompanied with the four paragraphs of general instructions and advice, which is absent on Windows XP to Windows 7.) 2. BSoDs related to a corrupt registry file critical to the operating system (e.g. "0xC0000218 (STATUS_CANNOT_LOAD_REGISTRY_FILE)"): 3. Hardware errors that can prevent Windows from booting properly (This example is 0x00000080 (NMI_HARDWARE_FAILURE); note that the error code is not shown in this example below): • Hardware Malfunction Call your hardware vendor for support NMI: Parity Check / Memory Parity Error • The system has halted *** Several error codes contained written descriptions that were used in lieu of the error name, describing what kind of error that has happened. For example, 0x000000F4 (CRITICAL_OBJECT_TERMINATION) was originally written as A process or thread crucial to system operation has unexpectedly exited or been terminated, and 0x000000E2 (MANUALLY_INITIATED_CRASH) was originally written as The user manually initiated the crash dump. With the release of Windows XP, the layout of the BSoD was slightly altered, which would remain in use for subsequent versions of Windows until Windows 8. Specifically, the hexadecimal error number and the four parameters were moved to the bottom of the screen after the four paragraphs under the label "Technical information:". References to Windows 2000 were shortened to simply say Windows, and the message about referring the user to the Getting Started manual for troubleshooting BSoDs (referred to as "stop errors") was also removed. The error screens also began with the now-infamous message: A problem has been detected and Windows has been shut down to prevent damage to your computer. The following is a re-creation of the BSoD from Windows XP to Windows 7, although they somewhat vary: From Windows 2000 onwards, system memory dumps are automatically performed, usually in the form of a 64 KB "minidump" by default. When this happens, the BSoD on Windows 2000 will display the following message that replaces the four paragraphs of general instructions and advice, which can also be seen when "Write an event to the system log" and/or "Send an administrative alert" is checked in the "System Failure" section under "Startup and Recovery" in System Properties even when system memory dumps are disabled: Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group. On Windows XP, the above message remains the same, but with some slight modifications, and is displayed after the four paragraphs of general advice, which were hidden on Windows 2000 when a memory dump is performed: Beginning dump of physical memory Physical memory dump complete. Contact your system administrator or technical support group for further assistance. In some cases, but especially for Windows Vista and 7, the following messages are displayed along with an indicator showing the progress of the memory dumps… Collecting data for crash dump... Initializing disk for crash dump... Beginning dump of physical memory. Dumping physical memory to disk: 100 …which is then followed up with the below message being displayed upon completion of the memory dumps: Physical memory dump complete. Contact your system admin or technical support group for further assistance. Additionally, on versions of Windows using the 64-bit architecture, the BSoD would have the four parameters extended to sixteen digits ("") instead of eight ("").

With the release of Windows 8 and Windows Server 2012, the BSoD was significantly changed, removing all of the above in favor of the error name and a concise description. Windows 8 also adds a sad emoticon to the error screen, which was absent from Japanese releases and Windows Server releases. The hexadecimal error code and parameters can still be found in the Windows Event Log or in memory dumps. The main text that is displayed on the screen by default is read as follows: Your PC/device ran into a problem and needs to restart. We're just collecting some error info, and then we'll restart for you. The above message can change depending on whether or not automatic restart or memory dumps are enabled or disabled. Such examples include: 1. BSoDs with the automatic restart functionality disabled but memory dumping enabled: Your PC/device ran into a problem and needs to restart. We're just collecting some error info, and then you can restart. 2. BSoDs with the automatic restart functionality enabled but memory dumping disabled: Your PC/device ran into a problem and needs to restart. We'll restart for you. 3. BSoDs with both the automatic restart functionality and memory dumping disabled: Your PC/device ran into a problem and needs to restart. You can restart. (NOTE: In both examples No.2 and No.3, a percentage completion (e.g. "100% complete") which shows the progress of the memory dumps being performed is absent when memory dumping is disabled.) C-series BSoDs use the same format as the normal BSOD except with the aforementioned hexadecimal error code in place of the error name. Hardware errors causing an BSoD also uses the same format as the normal BSoD, including the use of the error name instead of an error code. One such example are BSoDs with the error name "NMI_HARDWARE_FAILURE" (error code). Written descriptions for certain error codes were also replaced with the error name due to the aforementioned changes to the format of the BSoD (i.e. the message A process or thread crucial to system operation has unexpectedly exited or been terminated for error code was replaced with the error name "CRITICAL_OBJECT_TERMINATION"). The format introduced with Windows Server 2012 and Windows 8 was retained in Windows 10 and Windows 11 (as well as its Server counterparts). Beginning with build 14316 of Windows 10 version 1607, a QR code was added to the screen for quick troubleshooting, while all references to the word "PC" were changed to "device" starting from Windows 10 version 2004 onwards. Build 26120.3291 of Windows 11 version 24H2 made a complete overhaul to the format of the BSoD, changing the layout to be more consistent with the design language of Windows 11 while removing the QR code and the sad emoticon completely. The hexadecimal error code (but not the parameters) returned and is shown after the error name, but without the leading zeroes (e.g. 0x00000001 (APC_INDEX_MISMATCH) becoming).

• Illustration — The blue screen of death in Windows 9x, as it appears on Windows 95 and Windows 98 The Windows 9x line of operating systems used the blue screen of death as the main way for virtual device drivers to report errors to the user. This version of the BSoD, internally referred to as " _VWIN32_FaultPopup ", gives the user the option either to restart the computer or to terminate the current running program and continue using Windows, allowing the user to save their work before any data could be lost. Depending on the type of situation it may have occurred, however, the options to either continue or restart may or may not work at all. This is in contrast to the BSoDs in the Windows NT family, which prevented the user from using the computer until it has been powered off or restarted (usually automatic for the latter). The most common BSoD was displayed on an 80×25 text-mode screen, which was the operating system's way of reporting an interrupt caused by a processor exception; it is a more serious form of the general protection fault dialog boxes. The memory address of the error was given and the error type was a hexadecimal number from 00 to 11 (0 to 17 decimal). The error codes are as follows: • 00: Division fault • 01: Startup Error • 02: Non-Maskable Interrupt • 03: Shutdown Error • 04: Overflow Trap • 05: Bounds Check Fault • 06: Invalid Opcode Fault • 07: "Coprocessor Not Available" Fault • 08: Double Fault • 09: Coprocessor Segment Overrun • 0A: Invalid Task State Segment Fault • 0B: Not Present Fault • 0C: Stack Fault • 0D: General Protection Fault • 0E: Page Fault • 0F: Error Message Limit Exceed • 10: Coprocessor Error Fault • 11: Alignment Check Fault The following situations below can cause a BSoD: • Missing or different dependency versions (e.g. VC++,.NET, DirectX, etc.); • Faulty or poorly written kernel-level device drivers; • Corrupted Windows core files; • Misconfigured registry keys; • Hardware incompatibilities; • Damaged hardware such as failing memory, storage device, graphics card, etc., can also cause a BSoD. In Windows 95 and 98, a BSoD occurs when the system attempts to access the file " c:\con\con ", " c:\aux\aux ", or " c:\prn\prn " on the hard drive, which can be inserted on a website to crash visitors' machines as a prank. In reality, however, they are reserved device names for DOS systems; attempting to access them from Windows causes a crash, bringing up said BSoD. Creating the aforementioned directories within Windows will also not work and may cause the same BSoD to occur. On March 16, 2000, Microsoft released a security update to resolve this issue. One famous instance of a Windows 9x BSoD occurred during a presentation of a Windows 98 beta given by Bill Gates at COMDEX on April 20, 1998: The demo PC crashed with a BSoD when his assistant, Chris Capossela, connected a scanner to the PC to demonstrate Windows 98's support for Plug and Play devices. This event brought thunderous applause from the crowd and Gates replied (after a nervous pause): "That must be why we're not shipping Windows 98 yet."

Stop errors are comparable to kernel panics in macOS, Linux, and other Unix-like systems, and to bugchecks in OpenVMS. A black screen of death can occur upon hardware or software failures. Windows 3.1 displays a black screen of death instead of a blue one. Some versions of macOS (notably OS X Lion) display a black screen of death instead of a kernel panic, usually pointed to a graphics card or sleep/wake issue, it may also display a black screen when the operating system fails to boot properly. The Xbox series of consoles (which includes the original Xbox, Xbox 360, Xbox One and the Xbox Series X/S) also display a black screen when a hardware or software error occurs. • Illustration — The Red Screen of Death in Windows Longhorn build 5048 (note the word "execution" was misspelt as "exectuion", which was fixed in later builds) In some cases, a differently-colored error screen was used. Beta versions of Windows 98 display a red error screen raised by the Advanced Configuration and Power Interface (ACPI) when the host computer's BIOS encounters a problem. The bootloader of the first beta version of Windows Vista originally displayed a red screen background in the event of a boot failure, which was changed to black afterwards. As mentioned earlier, the insider builds of Windows 10 and later, as well as Windows Server 2016 and later, display a green screen instead of blue. Windows 10 and later (and Windows Server 2016 and later) also display an orange screen in an extremely rare case where a hardware issue with the GPU or a graphics driver problem was encountered. • Illustration — The blue screen of death on ReactOS, with a different font compared to its contemporary Windows versions ReactOS, an open-source operating system designed to achieve binary compatibility with Windows, implements a version of the blue screen of death similar to that used in Windows NT operating systems. • Illustration — Kernel panic encountered in Arch Linux 6.10 and later, providing a BSOD-style panic screen with an ASCII art of Tux and optionally a QR code leading to a Panic Report. The color differs per distribution. systemd, a software suite providing system components for Linux operating systems, also implements a version of the blue screen of death similar to that of Windows, albeit not as a replacement to the kernel panic in Linux (see above), but rather was used in the event of a bootup failure. This iteration uses systemd-bsod, which was added on December 6, 2023 starting with version 255 of systemd. Some versions of Linux (including Arch Linux) also use a kernel panic with a blue background, akin to that of the Windows blue screen of death.