Maintenance procedure · Written to ASD-STE100 Issue 9 · Formatted to ANSI Z535

Read a Windows Stop Code After a Blue Screen

Windows 11 and Windows 10 — capture the stop code before the PC restarts, find it again in Event Viewer, and convert it to the form Microsoft documents it under
ApplicabilityWindows 11 and Windows 10, on a PC that reaches a stop screen and restarts, or that has already restarted and left an entry in the Windows event log. Checked against Microsoft's documentation on 2026-07-29. This page reads and records the fault. It does not repair the fault, and it does not instruct any debugger, any memory dump analysis or any driver replacement.
Task time18 min to 29 min editorial estimate, not a measurement
PersonnelOne
Revisionv1 · 2026-07-29
BEFORE YOU BEGIN

Before you begin. This procedure is general reference information, not professional advice. Equipment varies by manufacturer, model, and year. Always follow the documentation supplied with your equipment — where it differs from this page, follow the manufacturer. Verify that you have the tools, the working conditions, and the ability to do this task safely. If anything is unclear, if the equipment is damaged, or if the task exceeds your experience, stop and use a qualified professional. You are responsible for your own safety and for the outcome. This site accepts no liability for any loss, damage, or injury arising from the use of this information.

Specifications marked unverified could not be traced to a manufacturer source. Do not rely on them — obtain the value from your equipment documentation.

Summary

A blue screen shows you a stop code for a few seconds and then the PC restarts and takes it away. Without that code you are guessing, and with it you have the one piece of information that every support desk, every Microsoft article and every hardware vendor will ask you for first. This page is about capturing it reliably — off the screen if you are quick, and out of the Windows event log if you were not — and then converting it into the form Microsoft actually documents it under, which is not the form the event log gives you.

That conversion is the part almost nobody knows about. Windows records the code in the event log as an ordinary decimal number, while every Microsoft reference page describes it as a hexadecimal one, so the 159 in your event log and the 0x0000009f in Microsoft's documentation are the same code wearing different clothes. This page does that conversion with the Calculator app that is already on your PC. What it will not do is tell you what to replace: Microsoft's own analysis attributes most stop errors to third-party driver code, and naming the part on the strength of a code alone is how people buy memory to fix a driver fault. Written against Microsoft's documentation as it stood on 29 July 2026.

Safety

NOTICE

FIND THE WINDOWS VERSION ON YOUR PC FIRST.
Menu names in Windows change with a Windows update. This page follows the Microsoft documentation for Windows 11 and Windows 10.

WARNING

COPY YOUR IMPORTANT FILES TO A DIFFERENT DISK BEFORE YOU CONTINUE.
A PC with a repeated stop error can stop again at any moment. Windows stops the PC immediately at each stop error. Windows discards all the unsaved work at each stop.

NOTICE

THIS PAGE RECORDS THE FAULT.
This page does not repair the fault. A stop code gives the condition at the stop. A stop code does not name the defective part.

Necessary equipment

ItemNote
Windows PCUse an account with administrator permission for the restart setting.
Camera or mobile telephoneMake a photograph of the stop screen before the PC restarts.
Pen and paperWrite the stop code and the date of each stop.

Find the Windows version

Estimated 1 min

Windows version and OS build on your PC
Unverified — do not rely on this value
READ THESE VALUES FROM SETTINGS, THEN SYSTEM, THEN ABOUT

No tier-1 source was found for this value. Take it from the documentation supplied with your equipment.

  1. Open the Settings app on your PC.
    <1m
  2. Go to the About page in the Settings app.
    • Select System.
    • Select About.
    <1m
  3. Make a record of the version and the OS build.
    • Give these two values to each person who helps you with this fault.
    <1m

Record the stop code from the screen

Estimated 2 min

NOTEThe stop screen shows the code for a short time. A photograph keeps it.
  1. At the stop screen, read the text at the lower part of the display.
    • Microsoft gives PAGE_FAULT_IN_NONPAGED_AREA and MEMORY_MANAGEMENT as examples of a stop code.
    • The code is a name in capital letters with underline characters.
    <1m
  2. Make a photograph of the full stop screen.
    • A photograph keeps the code and every other value on the screen.
    • The screen can also name a file. That name is important.
    <1m
  3. Write the stop code and the date on paper.
    • A second stop error with the same code is strong evidence.
    • A second stop error with a different code points at the memory or the disk.
    <1m

Stop the automatic restart

Estimated 2 min

NOTEThis setting keeps the stop screen on the display until you restart the PC.
NOTICE

USE AN ACCOUNT WITH ADMINISTRATOR PERMISSION FOR THIS SECTION.
Windows refuses this change from a different account.

  1. Type advanced system settings in the search box on the taskbar.
    <1m
  2. Select View advanced system settings in the results.
    <1m
  3. Select the Advanced tab.
    <1m
  4. In the Startup and Recovery group, select Settings.
    <1m
NOTICE

MAKE A RECORD OF THE INITIAL STATE OF THIS SETTING FIRST.
After this change the PC stays on the stop screen. You must then restart the PC with its power switch.

  1. Examine the check box Automatically restart.
    • A mark at this check box restarts the PC immediately after a stop error.
    • That restart removes the stop screen before you can read it.
    <1m
  2. Clear the mark at that check box.
    • Microsoft gives this change for a stop code that the event log does not hold.
    <1m
  3. Select OK.
    • Put the mark back at this check box after you find the code.
    <1m

Find the code again in Event Viewer

Estimated 5 min to 10 min

Event log entry for an unexpected stop
Manufacturer or standard verified
41 Event ID

Source: Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first" · tier 1 · accessed 2026-07-29

  1. Type event viewer in the search box on the taskbar.
    <1m
  2. Select Event Viewer in the results.
    <1m
  3. Open the System log.
    • Select Windows Logs in the tree at the left.
    • Select System.
    <1m
  4. Find an entry with the number 41 in the Event ID column.
    • The source of this entry is Microsoft-Windows-Kernel-Power.
    • The level of this entry is Critical.
    • This entry reports an unexpected restart of the PC.
    2m
  5. Compare the date of that entry against the date of your stop error.
    • The event log holds one entry for each unexpected stop.
    <1m
  6. Select that entry.
    <1m
  7. Select the Details tab in the lower part of the window.
    <1m
  8. Read the value at BugcheckCode.
    • Windows writes this value as an ordinary decimal number.
    • A value of 0 at BugcheckCode means Windows recorded no code for that stop.
    <1m
  9. Write that number on paper.
    <1m

Convert the code to hexadecimal

Estimated 3 min

Digits after 0x in a documented bug check code
Manufacturer or standard verified
8 digits

Source: Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first" · tier 1 · accessed 2026-07-29

  1. Type calc in the search box on the taskbar.
    <1m
  2. Select Calculator in the results.
    <1m
  3. Change the Calculator to its programmer mode.
    • Microsoft gives the path View, then Programmer, for this change.
    <1m
  4. At the left of the Calculator, select DEC.
    <1m
  5. Type the decimal number from the event log.
    <1m
  6. At the left of the Calculator, select HEX.
    • The Calculator now shows the hexadecimal form of the same code.
    <1m
  7. Write the hexadecimal value with eight digits after the characters 0x.
    • Add zeros at the left of the value until it has eight digits.
    • Microsoft documents 9F as 0x0000009f.
    • Microsoft documents A as 0x0000000A.
    • The decimal number 159 becomes 0x0000009f.
    1m

Find the documentation for the code

Estimated 6 min to 12 min

Cause of the defect behind a stop error
Unverified — do not rely on this value
CONSULT THE MANUFACTURER OF THE NAMED DRIVER OR THE NAMED DEVICE

No tier-1 source was found for this value. Take it from the documentation supplied with your equipment.

  1. Find your code in the Microsoft reference page in the sources.
    • That page gives one topic for each documented code.
    2m
  2. Read the description of the code.
    • A description gives the condition at the stop, not the defective part.
    2m
  3. If the stop screen named a file, write that name with the code.
    • Microsoft gives the name of the responsible driver on the screen when Windows can identify it.
    <1m
  4. Give the code, the file name and the Windows version to your support contact.
    1m

Terminology

This page uses one term for each item and holds it throughout, as ASD-STE100 requires. Equipment sellers and other guides use the names below for the same parts.

stop code
Also called: blue screen code, bsod code, error code on blue screen, crash code, stop error, what does the blue screen mean
bug check code
Also called: bugcheck, bug check, kernel error code, bugcheckcode, the number in the event log
blue screen
Also called: bsod, blue screen of death, the blue error screen, black screen with sad face, my computer crashed
Event Viewer
Also called: event log, windows logs, system log, crash log, where windows keeps errors
Automatically restart
Also called: auto restart on crash, stop my pc restarting, keep the blue screen on screen, startup and recovery setting
hexadecimal
Also called: hex, hex code, 0x code, the code with 0x in front

When to use a professional

Stop if the PC stops again during this procedure. Copy your important files to a different disk first. Then speak to Microsoft Support or to the PC manufacturer.

Stop before any memory dump analysis. Microsoft gives that work to a support agent or to an IT professional, with a debugger. This page does not instruct a debugger.

Stop if the event log holds no entry with the number 41. Stop if every value in that entry is 0. Microsoft gives a hardware fault or a power fault as a cause of that condition. Speak to the PC manufacturer.

Stop if the stop code names a driver from another company. The manufacturer of that driver holds the correction for it. Give them the code and the file name.

Do not remove parts from the PC. Do not open the PC. A PC under warranty can lose that warranty.

Common questions

The PC restarts before I can read the blue screen. What do I do?

Two answers, and you can use both. The quick one is to photograph the screen with your phone the moment it appears — it captures the code and everything else on the screen, including a driver file name if Windows managed to identify one. The durable one is the setting this page walks you through: Microsoft documents clearing the Automatically restart check box under Startup and Recovery, which leaves the stop screen on the display until you restart the machine yourself. If it has already restarted and you missed it, you have not lost the code — it is in the Windows event log, and the Event Viewer section here gets it back.

Why is the number in Event Viewer different from the code Microsoft documents?

Because they are written in different number bases, and this catches almost everyone. Microsoft states that Event ID 41 records the bug check code in decimal format, while most documentation describing bug check codes refers to them as hexadecimal values. So the event log might say 159 while every reference page in the world calls the same fault 0x0000009f. Microsoft's own worked example is exactly that pair. The conversion is a job for the Calculator app in programmer mode, which is what the convert section here does, and the last detail matters: pad the hexadecimal value with zeros so there are eight digits after the 0x, because that is the form Microsoft indexes them under.

Does the stop code tell me which part has failed?

No, and this is the most expensive misunderstanding about blue screens. The code describes the condition Windows was in when it stopped, not the component responsible. Microsoft's published breakdown of stop error root causes is that around 70% come from third-party driver code, 10% from hardware issues, 5% from Microsoft code, and 15% cannot be determined because the memory was too corrupted to analyse. A memory-flavoured code name does not therefore mean the memory has failed. If the stop screen named a driver file, that name is worth far more than the code by itself, which is why this page has you write both down.

What is Event ID 41, exactly?

It is the entry Windows writes when the machine restarted without shutting down cleanly. It appears in the System log with the source Microsoft-Windows-Kernel-Power at Critical level, and its text reads that the system has rebooted without cleanly shutting down first. It is not itself a diagnosis — Microsoft is explicit that by itself it might not contain enough information to define what happened, and it appears whether the cause was a stop error, a power cut, or someone holding the power button. What makes it useful is the extra data attached to it, which is where the bug check code lives when there is one.

The BugcheckCode in my event log is 0. What does that mean?

It means Windows did not manage to record a code for that stop, and Microsoft treats that as a signal in its own right rather than a dead end. Its guidance points at conditions where something stopped Windows writing the error to disk at all: an interrupted power supply, a drained or removed laptop battery, a faulty or underpowered power supply, or a machine that was switched off at the wall while unresponsive. A related pattern is a PowerButtonTimestamp of zero, which suggests power was disconnected from a machine that had stopped responding. If everything in the entry is zero, this stops being a software question and becomes a hardware and power one.

Should I run a memory test or start replacing hardware?

Not on the strength of a code alone, and not as your first move. Microsoft's general troubleshooting order for stop errors starts with much cheaper things: review the code in the event logs, install the latest Windows cumulative updates, make sure the BIOS and firmware are current, then run relevant hardware and memory tests, check for malware, and confirm there is enough free disk space — its suggestion is 10-15% free. Note where hardware testing sits in that list, which is fourth, not first. If you do run the Windows Memory Diagnostics tool, be aware it restarts the machine to do its work, so save everything first.

Is a one-off blue screen something to worry about?

A single one, with no repeat, is usually not worth a project. What matters is the pattern, which is why this page has you write down the code and the date every time. A second stop with the same code is strong evidence pointing somewhere specific. A series of stops with different codes each time tends to point at something underneath the software — memory or storage — rather than at any one driver. Either way, a machine that is stopping unexpectedly is a machine that can lose whatever you have not saved, so get your files copied somewhere else before you spend an evening diagnosing it.

Sources

Every specification on this page is traced to one of these sources. Tier 1 is a manufacturer document, a published standard, or a government safety authority. See Standards for the full tiering rule.

  1. Tier 1Troubleshooting Windows unexpected restarts and stop code errorsMicrosoft · accessed 2026-07-29 · re-verification due 2027-01-25
  2. Tier 1Advanced troubleshooting for stop code errorsMicrosoft · accessed 2026-07-29 · re-verification due 2027-01-25
  3. Tier 1Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first"Microsoft · accessed 2026-07-29 · re-verification due 2027-01-25
  4. Tier 1Bug checks (stop code errors)Microsoft · accessed 2026-07-29 · re-verification due 2027-01-25
  5. Tier 1Bug check code referenceMicrosoft · accessed 2026-07-29 · re-verification due 2027-01-25
  6. Tier 1Windows 11 release informationMicrosoft · accessed 2026-07-29 · re-verification due 2027-01-25
  7. Tier 1Windows 10 release informationMicrosoft · accessed 2026-07-29 · re-verification due 2027-01-25

Revision history

Current version 1 · updated 2026-07-29 · next review due 2027-07-29

  1. v1 · 2026-07-29First draft. Built entirely from Microsoft's own documentation, read on 2026-07-29: the support article served at the troubleshoot-blue-screen-errors URL, and four learn.microsoft.com product and troubleshooting topics — 'Advanced troubleshooting for stop code errors', 'Advanced troubleshooting for Event ID 41', 'Bug checks (stop code errors)' and 'Bug check code reference' — read through the Microsoft Learn MCP connector. Version binding uses the already-registered Windows 11 and Windows 10 release information sources. The decimal-to-hexadecimal conversion, the eight-digit padding rule and the worked pair 159 / 0x0000009f are Microsoft's own, from the Event ID 41 article. The page is deliberately scoped to reading and recording the code: memory dump analysis, WinDbg and the !analyze extension are named in the boundary and not instructed, because Microsoft addresses that material to support agents and programmers. No stop code is interpreted for the reader and no component is named as the cause, because Microsoft's own root-cause breakdown attributes most stop errors to third-party driver code. The procedure was verified against Microsoft's documentation, not reproduced on a failing machine, and this record says so rather than claiming a test result. The two verified specifications carry spec_key null: this drafting session was not permitted to write data/specs.json, so the registry entries must be added when the record is merged.

Corrections to this page are listed in the public corrections log. Reports that are credible and not yet verified are listed in the public errata register, and an open one renders above the step it concerns.

Comments and corrections

Found an error? A correction with a manufacturer source is applied and logged publicly. You can also write to corrections@fixchecklist.com.

Every step above carries its own report control, which tags the report with that step so a correction reaches the right place. For anything about the procedure as a whole — the order of the sections, a step that is missing, something that did not match your equipment — use this: report something about this whole procedure.

The comment system is not connected yet. Comments are stored in GitHub Discussions through Giscus, outside this site, so that a redeploy cannot destroy them.