PAGE_FAULT_IN_NONPAGED_AREA is bug check 0x50, and it fires when Windows reaches for a memory address that should always have been resident in RAM and finds nothing valid there. Faulty memory causes it most often. A driver touching memory it already released causes most of the rest.
The name is the diagnosis. Nonpaged memory is the pool Windows may never swap out to disk, because the code using it runs at a level where waiting on a disk read is not permitted. A fault there is unrecoverable, so Windows halts. Microsoft’s description of bug check 0x50 is that invalid system memory has been referenced, and that the address is typically either plain wrong or pointing at freed memory.
What Microsoft lists as the cause
The documented cause list for 0x50 is short, and worth knowing before you change anything.
| Documented cause | What it looks like on your machine |
|---|---|
| Faulty driver or system service | Crashes cluster around one activity: gaming, waking from sleep, plugging in a device |
| Antivirus software | Started after installing or updating a third-party security suite |
| Corrupted NTFS volume | Crashes come with slow file operations, or the drive is old |
| Faulty or failing hardware | Random timing, no pattern, usually main memory but sometimes cache or video RAM |
Nothing else is on that list. Registry cleaners and page file size changes are not on it either, and Fix 3 explains why the most popular of those is misunderstood.
Read the screen before you change anything
Modern blue screens print a stop code and sometimes a filename beneath it. That filename is the most valuable thing on the screen. Microsoft’s documentation confirms that when the responsible driver can be identified, its name is printed there, so spotting nvlddmkm.sys or ntfs.sys skips most of the diagnostic work. The QR code identifies nothing, it links to a generic page, so photograph the text instead.
| What the screen shows | What it tells you | Where to start |
|---|---|---|
A .sys filename you recognise | That driver, or the hardware it serves | Fix 5 |
ntfs.sys or a storage driver name | Volume or disk corruption | Fix 4 |
| A security vendor’s driver name | Antivirus filter driver | Fix 6 |
| Stop code only, no filename | Undecided, likely RAM | Fix 1 or Fix 2 |
| Different filename each crash | Almost always memory, not drivers | Fix 1 or Fix 2 |
That last row is the one people get wrong. A different driver named on every crash does not mean five broken drivers. It means the memory underneath them is unreliable and whichever driver was running took the blame. If 0x50 isn’t the only code you’re seeing, the reference to every Windows stop code and what it means will show whether the others point the same way.
No filename on screen? Windows still wrote a minidump to C:WindowsMinidump, and free tools such as NirSoft’s BlueScreenView open those files and name the driver directly. Event Viewer is the other route: Win + R, then eventvwr.msc, then Windows Logs, then System, filtered to Error and Critical around the crash time.
Which situation are you in
Answer this before touching anything.
| What changed just before the crashes started | Most likely cause | Go to |
|---|---|---|
| New RAM installed, or XMP/EXPO switched on | Unstable or mismatched memory | Fix 1 |
| Nothing, machine is a few years old | Degrading memory | Fix 2 |
| Driver or GPU update | Driver | Fix 5 |
| New antivirus or security suite | Filter driver | Fix 6 |
| Power loss, or the machine was slow first | Volume corruption | Fix 4 |
| A failed or interrupted Windows update | Damaged system files | Fix 3 |
Fix 1: The new RAM case
If the first blue screen arrived within hours of a memory upgrade, the memory is the suspect and nothing else needs running yet. Three separate things go wrong here.
The stick is not seated. DIMM slots need firm pressure until both clips close by themselves. Half-seated memory produces exactly this stop code. Power off, unplug, press each module down until it clicks, retest.
The kit is mismatched. Two sticks of the same model bought at different times are not a matched pair. Kits are tested and binned together, and the memory controller has to run every installed module on one shared set of timings, so mixing kits means one is operating outside what it was validated for. Same brand and same advertised speed does not make a pair.
The XMP or EXPO profile is unstable. These profiles run memory above the JEDEC default the board would otherwise use, which is an overclock however routine it has become. Enter BIOS, set memory to Auto or the JEDEC default, and run for a day.
That last step is the cleanest test on this page. Stable at default speed and crashing with the profile enabled means the profile is at fault, not the sticks. Some boards recover with a slower profile, and four modules in a four-slot board frequently will not hold the rated speed at all, particularly on DDR5.
Still crashing at default speed? Remove all but one module. Check the motherboard manual for which slot to populate first, because it is rarely the one nearest the CPU, then rotate through the sticks until the crashes follow one of them. Microsoft’s own guidance is blunter: if you added new hardware before the error, shut down, remove it and restart.
Fix 2: Test the memory properly
Windows has a built-in tester. Press Win + R and run:
mdsched.exeChoose to restart and check. Results are not shown when you log back in, which catches people out. They land in Event Viewer, in the System log, under a MemoryDiagnostics-Results entry.
Treat a clean pass as weak evidence. The built-in test is short and misses intermittent faults. MemTest86 written to a USB stick and left running for several full passes, ideally overnight, is what settles the question. One error is one too many. There is no acceptable number.
Fix 3: The page file test, and what it actually proves
Increasing virtual memory does not fix bug check 0x50. The word “nonpaged” is the giveaway: the memory involved was never eligible to be paged out, so the size of pagefile.sys has no bearing on it. That advice is folklore.
Removing the page file temporarily tests something narrower but real. Disabling it deletes pagefile.sys, and re-enabling it builds a fresh one elsewhere on the disk, which works around a bad sector sitting under the old one. That is why the trick sometimes appears to fix things.
To try it: Win + R, then sysdm.cpl, Advanced tab, Performance Settings, Advanced tab, Virtual memory Change. Untick Automatically manage paging file size for all drives, select No paging file, click Set, and restart.
Two warnings. On a machine with limited RAM, applications will start throwing out-of-memory errors. With no page file Windows may also be unable to write a crash dump, so the next blue screen leaves you no minidump and no driver name. Turn it back on once you have an answer, and prefer Fix 4 if you suspect the disk.
Fix 4: Check the volume
Microsoft names a corrupted NTFS volume as a direct cause of 0x50 and prescribes chkdsk for it. Open Terminal or Command Prompt as administrator:
chkdsk C: /f /rYou will be asked to schedule it for the next restart, because the system volume cannot be locked while Windows is running. Answer Y and reboot. Per Microsoft’s reference, /r locates bad sectors and recovers readable information, and includes everything /f does. On a large mechanical drive this takes hours. Let it finish.
A drive that is quietly failing announces itself twice: blue screens like this one, and boot times that keep creeping upwards. If sluggish starts came first and you put them down to age, the checks used to fix slow startup overlap with this one. Check SMART status with CrystalDiskInfo too. Anything other than Good means back up first and troubleshoot second.
Fix 5: System files and drivers
Damaged system files produce this code less often than hardware does, but the repair is quick and harmless. Run both, in this order, as administrator:
DISM /Online /Cleanup-Image /RestoreHealthsfc /scannowDISM repairs the component store that System File Checker pulls replacement files from, which is why running SFC first often reports damage it cannot repair. Of the DISM switches, only /RestoreHealth repairs the image: /ScanHealth and /CheckHealth report what they find and change nothing.
For the driver itself, open Device Manager, find the device, then Properties, Driver tab, Roll Back Driver. A greyed out button means Windows kept no previous version, so uninstall the device with Delete the driver software for this device ticked, then install the version you want from the manufacturer’s site rather than Windows Update. If the machine blue screens before you can finish, do all of this from Safe Mode, which loads a minimal driver set and usually stays up long enough to work in.
Fix 6: Antivirus
Third-party security software installs kernel filter drivers that sit in the path of every file operation, which is how it earns its place on Microsoft’s cause list. Disabling real-time protection does not unload those drivers. Uninstall the product properly, using the vendor’s removal tool where one exists, and run on Microsoft Defender alone for a few days.
If you have a minidump
Parameter values from the dump narrow things further, and BlueScreenView shows them without any debugger setup.
| Parameter | Meaning |
|---|---|
| 1 | The memory address that was referenced |
| 2 | Operation type: read, write or execute |
| 3 | The address of the instruction that referenced it |
| 4 | Type of page fault |
Parameter 3 pointing inside ntoskrnl.exe does not mean Windows itself is broken. The kernel is usually just the code that walked into memory something else corrupted.
When none of it works
If every stick tests clean, the volume checks out, DISM and SFC report no damage and the crashes continue, you are down to the motherboard, the CPU memory controller or the power supply. A clean reinstall of Windows is a reasonable final software test: crashes that survive it are hardware, definitively.
Common questions
What does PAGE_FAULT_IN_NONPAGED_AREA mean?
It is bug check 0x50. Windows requested a memory address that should always have been present in RAM and found nothing valid there. Because the memory involved is never allowed to be paged out to disk, the fault cannot be recovered from, so Windows stops immediately rather than continue with corrupt data.
Is PAGE_FAULT_IN_NONPAGED_AREA always caused by bad RAM?
No, but memory is the most common single cause. Microsoft also documents faulty drivers, antivirus filter drivers and a corrupted NTFS volume as causes. A different driver named on each crash points at memory. The same driver named every time points at that driver.
Will increasing virtual memory fix it?
No. The memory involved in bug check 0x50 is nonpaged, meaning Windows never swaps it to disk, so the size of the page file has no effect on the fault. Deleting and rebuilding the page file can work around a bad disk sector, which is a different problem entirely.
Why did it start right after I installed new RAM?
Three usual reasons: a module that is not fully seated, two kits bought separately that were never binned as a matched pair, or an XMP or EXPO profile the sticks cannot hold. Set memory to its JEDEC default in BIOS and run for a day to separate the third from the first two.
Can I keep using the PC while I work through this?
Only if the crashes are occasional and your files are backed up. Every unexpected halt risks corrupting whatever was being written at that moment, which is how one fault becomes several. Repeated crashes during a chkdsk or a Windows update are the ones that turn recoverable into reinstall.
Test the RAM before you change anything else. Bug check 0x50 has a long list of possible causes and one dominant one, and the hours people spend on drivers and system files are usually hours spent avoiding the memory test that would have answered the question on the first night.
