CRITICAL_PROCESS_DIED is bug check 0x000000EF, and it means a system process Windows cannot run without has terminated. Repair the system files first with DISM and SFC, then look at whatever driver or update changed most recently. Those two steps cover the majority of cases.
It is one of the more alarming stop codes because it often arrives in a loop: crash, restart, crash again, sometimes without ever reaching the desktop.
What the code actually means
Windows marks a small number of processes as critical. If one exits, the operating system cannot continue safely, so it halts deliberately rather than carrying on in an unknown state. Microsoft’s bug check reference lists csrss.exe, wininit.exe, logonui.exe, smss.exe, services.exe, conhost.exe and winlogon.exe among the built-in critical services, and describes the check as happening when the state of such a process is corrupted or damaged.
The stop code names a consequence, not a culprit. Something else damaged the process, and that something is nearly always one of four things: corrupted system files, a driver, disk corruption, or failing memory. For the wider picture, here is every Windows stop code and what it means.
Work out which situation you are in
Diagnosis here is mostly about timing. What changed, and when does it crash?
| What you are seeing | Most likely cause | Start at |
|---|---|---|
| Random crashes, Windows still boots normally | Corrupted system files | Fix 1 |
| Began right after a driver update | That driver | Fix 3 |
| Began right after a Windows update | That update | Fix 4 |
| Boot loop, never reaches the desktop | System files or disk corruption | Recovery menu, then Fix 1 |
| Only on wake from sleep, never otherwise | A driver’s power handling | The sleep section below |
| Mixed stop codes, not just this one | RAM or a failing drive | Fix 5, then Fix 2 |
Before touching anything, check Event Viewer. Press Win + R, type eventvwr.msc, open Windows Logs → System, then Filter Current Log and tick Error and Critical. Microsoft’s guidance for this bug check is to look for errors in the same time window as the crash, because those often name the service or driver that failed first. The guide to the Windows Start button not working covers what the minidump files in C:WindowsMinidump are for.
If it is a boot loop: getting to the recovery menu
Power the PC on. As soon as you see the Windows logo, hold the power button for ten seconds to force it off. Do that three times. On the third attempt Windows loads Automatic Repair, which puts you into the recovery environment.
From there, Advanced options → Startup Settings → Restart → press 4 boots into Safe Mode with a minimal set of drivers. If the machine is stable there and crashes in normal mode, you have proved it is a driver rather than hardware. If Safe Mode also crashes, use Advanced options → Command Prompt instead.
One catch trips people up constantly: inside the recovery environment your Windows partition is frequently not drive C:. Check first.
dir D:WindowsTry each letter until you find the one holding your Windows folder, then substitute it in everything below.
Fix 1: Repair the system image and system files
This is the highest-yield fix for this stop code, and the order of the two commands is not optional. Open Terminal or Command Prompt as administrator and run:
DISM /Online /Cleanup-Image /RestoreHealthThen, once it finishes:
sfc /scannowDISM repairs the component store that the System File Checker pulls its replacement files from, which is why Microsoft’s instruction is to run DISM before the System File Checker. Running SFC alone against a damaged store is how you end up with the familiar “unable to fix some of them” message. Restart when both have finished.
From the recovery environment, /Online refers to the recovery image rather than your installation, so use the offline form, substituting the letter you identified earlier:
sfc /scannow /offbootdir=D: /offwindir=D:WindowsFix 2: Check the disk
File system corruption can damage the very files a critical process loads at startup, producing this stop code with no driver involved.
chkdsk C: /f /rWindows will say the volume is in use and offer to run the check at the next restart. Say yes, then reboot. Expect hours on a large mechanical drive. The switches matter: Microsoft documents that /r locates bad sectors and recovers readable information, and includes the functionality of /f. Without /f, chkdsk reports problems and fixes nothing.
If it repairs a meaningful number of bad sectors, treat that as a warning rather than a victory. Check the drive’s SMART health with CrystalDiskInfo. Anything other than good means back up now.
Fix 3: Roll back the driver that changed
If the crashes started within a day or two of a driver update, that driver is your suspect regardless of how unrelated it looks.
- Right-click Start → Device Manager
- Expand the category, right-click the device → Properties
- Open the Driver tab → Roll Back Driver
If Roll Back Driver is greyed out, no previous version is stored, so uninstall the driver instead and let Windows reinstall a generic one on restart. Storage controller, graphics and network drivers cause this more often than anything else. Change one at a time so you know which one mattered.
Fix 4: Uninstall the recent Windows update
Same logic, different source. Go to Settings → Windows Update → Update history, scroll to the bottom, click Uninstall updates, and remove the most recent one. Restart and watch for a day. From the recovery environment the equivalent is Advanced options → Uninstall Updates.
Fix 5: System Restore, and testing the RAM
System Restore rewinds drivers, system files and registry state to a point before the trouble started, without touching your documents. Run rstrui.exe from a working desktop, or Advanced options → System Restore from the recovery menu. It only helps if restore points exist, and protection is off by default on many machines.
Memory faults are a genuine but less common cause. Test with mdsched.exe, which restarts and checks before Windows loads. For a serious answer, run MemTest86 from a USB stick for several passes. Any error means a bad stick, and testing one at a time tells you which.
When it only happens on wake from sleep
This pattern points at a driver rather than at corruption. A device that fails to resume correctly takes down a service that depends on it, and the critical process dies as a knock-on effect.
Start with the network adapter and storage controller. In Device Manager, open the adapter’s Properties → Power Management tab and untick Allow the computer to turn off this device to save power. Then update chipset and storage drivers from your laptop or motherboard manufacturer’s support page rather than Windows Update, which lags behind on power management fixes.
Turning off Fast Startup is worth trying too. It saves the kernel session to disk instead of shutting it down fully, so a driver in a bad state survives what looks like a clean shutdown. Go to Control Panel → Power Options → Choose what the power buttons do → Change settings that are currently unavailable and untick Turn on fast startup.
Things that will not fix it
| Commonly suggested | Reality |
|---|---|
sfc /scannow on its own | Cannot repair when the component store is damaged; run DISM first |
chkdsk C: with no switches | Reports errors only, repairs nothing |
| Scanning the QR code on the blue screen | Leads to a generic page, not a diagnosis of your fault |
| Third-party driver updater packs | Frequently install the wrong version for your exact hardware |
| Disabling automatic restart on system failure | Only lets you read the code for longer; changes nothing |
| Registry cleaner utilities | No mechanism by which they address this bug check |
Last resort: reinstall over the top
On Windows 11 you can reinstall the current version without losing anything. Go to Start → Settings → System → Recovery, and under Fix problems using Windows Update select Reinstall now. Microsoft states this preserves your apps, files and settings, though it needs Windows 11 with the 2022 annual update or later and may be unavailable on a work or school managed device.
If it is missing or does not hold, Reset this PC with Keep my files is next. On Windows 10 the equivalent is to reinstall Windows 10 from installation media, which also offers the in-place upgrade that repairs the system while keeping your files.
Common questions
What does CRITICAL_PROCESS_DIED mean?
It is bug check 0x000000EF. A process Windows treats as essential, such as csrss.exe or winlogon.exe, terminated unexpectedly, so Windows halted rather than continuing in a compromised state. The usual underlying causes are corrupted system files, a faulty driver, disk corruption, or failing memory.
Can bad RAM cause CRITICAL_PROCESS_DIED?
Yes, though it is not the most common cause. Failing memory corrupts whatever happens to be loaded into the bad region, which can include a critical system process. Suspect RAM if you also see other stop codes such as MEMORY_MANAGEMENT, and confirm it with MemTest86 rather than guessing.
How do I fix CRITICAL_PROCESS_DIED if Windows will not boot?
Force a shutdown three times during startup to reach Automatic Repair. From there try Safe Mode first. If Safe Mode fails, open Command Prompt from Advanced options and run offline SFC and chkdsk against your Windows partition, remembering that its drive letter is often not C:.
Does this stop code mean my hard drive is failing?
Not necessarily. Disk corruption at the file system level produces the same symptom as physical failure, and chkdsk repairs the former. Treat it as a hardware warning only if chkdsk reports bad sectors, or if the drive’s SMART status reads anything other than good.
Why does it only happen when my PC wakes from sleep?
A driver that fails to resume correctly is the usual explanation, most often the network adapter or storage controller. Update those drivers from the manufacturer’s site, disable the power saving option in the adapter’s properties, and turn off Fast Startup so shutdowns fully unload the kernel session.
Work in order and change one thing at a time: DISM then SFC, then chkdsk, then whichever driver or update changed most recently. Resetting Windows will usually clear the crashes, but if the real fault is a dying drive or a bad memory stick, it will come straight back on the fresh install.
