Fixes / Windows · Checked

Windows CRITICAL_PROCESS_DIED: what it means and how to fix it

Short answer

CRITICAL_PROCESS_DIED (bug check 0xEF) means a process Windows cannot run without, such as csrss.exe, wininit.exe or services.exe, stopped unexpectedly, so Windows shut down to protect your data. Corrupted system files or a faulty driver are the usual causes. The most likely fix: open Command Prompt as administrator and run DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow.

What this message means

Windows marks a small set of processes as critical: csrss.exe, wininit.exe, winlogon.exe, smss.exe, services.exe, logonui.exe and conhost.exe. If one of them ends or its state becomes corrupted, Windows can no longer trust its own integrity, so it stops immediately and shows stop code CRITICAL_PROCESS_DIED (0x000000EF). The stop code does not say why the process died. It only tells you that something damaged or killed a core part of Windows. That damage usually comes from corrupted system files, a bad driver or update, failing storage, or a service that a program has set to restart the computer if it fails. On Windows 11 24H2 and later the screen is black instead of blue, but the stop code is the same.

Common causes

CauseHow to tell
Corrupted or missing Windows system filesThe crash happens at random or right after sign-in, with no recent hardware change. sfc /scannow reports "Windows Resource Protection found corrupt files".
A faulty, outdated or newly installed driver (storage, graphics or antivirus drivers are common)The crashes started after a driver, BIOS or Windows update, or after you plugged in new hardware. Device Manager may show a yellow exclamation mark on a device.
An interrupted or failed Windows update, driver or BIOS updateThe PC was forced off or lost power during "Working on updates" or a firmware update, and now crashes during startup or loops into "Preparing Automatic Repair".
Failing hard drive or SSD, or file system errorsWindows is slow to load, files fail to open, you hear clicking from a hard drive, or chkdsk reports bad sectors. Event Viewer shows Disk or Ntfs errors just before the crash.
Security software or a third-party service interfering with core processesThe crash stops when you start in Safe Mode or do a clean boot, and came back after you installed or updated antivirus, system tweak, or overclocking software.
Malware that has tampered with system processesUnknown programs at startup, disabled Windows Security, or browser changes you did not make, together with the crashes.

How to fix it

1. Undo the most recent change

Windows 10 and Windows 11 when Windows still starts. Menu paths differ, as noted.

  1. If you added hardware recently (RAM, drive, USB device, dock), shut down, remove it and start the PC again.
  2. To roll back a driver: right-click Start > Device Manager, right-click the device you updated > Properties > Driver tab > Roll Back Driver. If the button is greyed out, choose Uninstall device instead and restart.
  3. To remove a recent update on Windows 11: Settings > Windows Update > Update history > Uninstall updates, then uninstall the newest one.
  4. On Windows 10: Settings > Update & Security > Windows Update > View update history > Uninstall updates.
  5. Uninstall any antivirus, system optimizer or overclocking tool installed just before the crashes began (Settings > Apps), then restart.

2. Repair Windows system files with DISM and SFC

Windows 10 and Windows 11 when Windows starts normally or in Safe Mode

  1. Click Start, type cmd, right-click Command Prompt and choose Run as administrator.
  2. Type DISM.exe /Online /Cleanup-image /Restorehealth and press Enter. Wait until it reaches 100% (this can take 10 to 30 minutes and needs an internet connection).
  3. Type sfc /scannow and press Enter. Wait for verification to reach 100%.
  4. Restart the PC. If SFC said it could not fix some files, run both commands a second time.
  5. To see what SFC changed, run findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" and open the file on your desktop.

3. If Windows will not start: use the recovery screen and Safe Mode

Windows 10 and Windows 11

  1. Turn the PC on and, as soon as the Windows logo appears, hold the power button to force it off. Do this 2 or 3 times and Windows opens the recovery environment ("Choose an option"). If you can reach the sign-in screen, hold Shift and click Power > Restart instead.
  2. Go to Troubleshoot > Advanced options > Uninstall Updates and remove the latest quality update first, then the latest feature update if the crash continues.
  3. If that doesn't help, go to Troubleshoot > Advanced options > Startup Repair.
  4. To reach Safe Mode, go to Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 (or F4) for Safe Mode, or 5 (F5) for Safe Mode with Networking.
  5. In Safe Mode, run the DISM and SFC commands from the previous fix and remove any recently added drivers or programs.

4. Check the drive for errors

Windows 10 and Windows 11

  1. Open Command Prompt as administrator (or Troubleshoot > Advanced options > Command Prompt from the recovery screen).
  2. From the recovery screen, the Windows drive may not be C:. Type dir C:\Windows and dir D:\Windows to find the drive that has the Windows folder.
  3. Run chkdsk C: /f /r, replacing C: with that drive letter. If Windows is running, type Y to schedule the check for the next restart, then restart.
  4. Let it finish without turning off the PC. On large hard drives this can take over an hour.
  5. If chkdsk reports bad sectors, or the problems keep returning, back up your files and run the drive maker's diagnostic tool. The drive may be failing.

5. Repair system files from the recovery screen (offline SFC)

Windows 10 and Windows 11 when Windows will not start even in Safe Mode

  1. In the recovery screen, go to Troubleshoot > Advanced options > Command Prompt.
  2. Find the Windows drive letter with dir C:\Windows (try D: or E: if not found).
  3. Run sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows, replacing C: with the drive you found. The /Online form of DISM does not work here.
  4. Type exit, then choose Continue to start Windows.

6. Use System Restore, or reset Windows and keep your files

Windows 10 and Windows 11

  1. In the recovery screen, go to Troubleshoot > Advanced options > System Restore and pick a restore point dated before the crashes started. Your documents are not affected, but apps and drivers installed after that date are removed.
  2. If there is no usable restore point, go to Troubleshoot > Reset this PC > Keep my files.
  3. Choose Cloud download (downloads a fresh copy of Windows, useful when local files are corrupted) or Local reinstall.
  4. After the reset, reinstall your apps and install drivers from the PC or motherboard maker's support site.

Next time, skip the search

Crade is an AI assistant for Mac and Windows that sees your screen. When a message like this pops up, ask “what does this mean?” and it explains the exact error in front of you, step by step.

Download Crade

Still not fixed?

If the crash comes back after a reset, the cause is probably hardware. Run the PC maker's built-in diagnostics (usually F2 or F12 at power-on on Dell and HP, or Lenovo Diagnostics), test the memory with Windows Memory Diagnostic (mdsched.exe), and check for a BIOS or firmware update on the maker's site. If the recovery screen asks for a BitLocker recovery key, you can find it at aka.ms/myrecoverykey when signed in with your Microsoft account. IT staff can open the crash dumps in C:\Windows\Minidump with WinDbg (!analyze -v) to find the process or driver involved, and check Event Viewer > Windows Logs > System for errors logged just before the crash. If the PC is under warranty, contact the manufacturer and quote stop code 0xEF CRITICAL_PROCESS_DIED.

Questions people ask

Is CRITICAL_PROCESS_DIED a hardware or software problem?

It is usually software: corrupted system files, a bad driver or a failed update. If DISM, SFC and a reset do not fix it, look at the hardware next, especially the drive and the memory.

Will I lose my files fixing CRITICAL_PROCESS_DIED?

DISM, SFC, chkdsk, Uninstall Updates, Startup Repair and System Restore do not delete your personal files. Reset this PC with Keep my files keeps your documents but removes your installed apps. Only the Remove everything option erases your data.

How do I fix CRITICAL_PROCESS_DIED if I can't get into Safe Mode?

Force the PC off 2 or 3 times during startup to open the recovery screen. From there, use Uninstall Updates, Startup Repair or System Restore, or open Command Prompt and run chkdsk and offline SFC. If even that screen doesn't load, create Windows installation media on another PC, boot from it and choose Repair your computer.

Why is the screen black instead of blue?

Starting with Windows 11 version 24H2, Microsoft replaced the blue stop screen with a black one. The stop code and the fixes are the same.

Can a virus cause CRITICAL_PROCESS_DIED?

Yes. Malware that tampers with processes like csrss.exe or winlogon.exe can trigger it. Once Windows starts, run a Microsoft Defender Offline scan (Windows Security > Virus & threat protection > Scan options).

Sources

Related errors