The most frustrating thing about a blue screen is that the machine restarts before you can read the stop code, let alone investigate it. That is Windows defaulting to an automatic restart after a crash so you get back to work quickly, and the cost is that the evidence disappears. This guide covers two changes: keep the blue screen on screen, and save a dump file. Then it covers how to read those files and find the driver responsible.
For what the common stop codes mean and which component each one tends to point at, see Windows Blue Screen Error Codes Explained. This article is about disabling the automatic restart, keeping the dump, and analysing what you captured.
1. Why it restarts, and why you should turn that off
Windows ticks "Automatically restart" under System failure by default, so the moment the kernel crashes it reboots before you can read anything. Turn it off and the crash screen stays put, giving you time to photograph or write down the stop code and the name of the failing driver, such as nvlddmkm.sys or ntfs.sys.
One thing worth knowing: from Windows 11 24H2 the crash screen is black rather than blue, and the frowning face and QR code are gone. It shows the stop code and the failing component directly. The screen is more compact and stays for less time, which makes disabling the automatic restart more useful than ever.
2. Disable automatic restart and set a dump type through the UI
- Right-click This PC and choose Properties, or press
Win + R, typeSystemPropertiesAdvancedand press Enter, then open the Advanced tab of System Properties. - Under Startup and Recovery, click Settings.
- Under System failure:
- Clear "Automatically restart". This is the step that matters.
- Choose a dump type from Write debugging information, using step 3 to decide.
- Make sure "Write an event to the system log" is ticked.
- Click OK and reboot once for the setting to take effect.
You can also reach the same window through Settings > System > About > Advanced system settings.
3. Choosing a dump type
| Type | What it contains | Default location | Who it suits |
|---|---|---|---|
| (None) | Nothing written | None | Not recommended, you give up debugging |
| Small memory dump (256 KB) | Key context only, smallest file | C:\Windows\Minidump | Comparing repeated crashes, most commonly used |
| Kernel memory dump | All kernel-mode memory | C:\Windows\MEMORY.DMP | A good balance for most people |
| Complete memory dump | All physical memory | C:\Windows\MEMORY.DMP | When you need user mode, file is roughly RAM size |
| Automatic memory dump (default) | Same as kernel, paging file can be smaller | C:\Windows\MEMORY.DMP | Fine for most people, leave as default |
Recommendations:
- Crashes keep recurring and you want separate files to compare, choose Small memory dump. Each crash adds a new file to the Minidump folder without overwriting earlier ones.
- You just want one usable snapshot, leave it on Automatic memory dump.
- Complete memory dump is not a good idea on a normal machine, since it takes up roughly as much disk space as you have RAM.
4. Registry and command line, for bulk or remote setup
Everything the UI does lives in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl:
AutoReboot, 1 restarts automatically, 0 disables it.CrashDumpEnabled, 0 none, 1 complete, 2 kernel, 3 small, 7 automatic.DumpFileis the path to MEMORY.DMP,MinidumpDiris the Minidump folder.
Run as administrator, after backing up the key:
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v AutoReboot /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CrashControl" /v CrashDumpEnabled /t REG_DWORD /d 7 /f
Editing the registry carries risk, so reg export the whole CrashControl key first and make sure you are on the right machine.
5. The prerequisite people miss, the paging file must be on
A crash dump is written to the paging file on the boot drive first, then moved to MEMORY.DMP after the restart. Two traps here:
- The paging file is disabled or moved to another drive, so no dump can be written. Check System Properties > Advanced > Performance Settings > Advanced > Virtual Memory Change, and confirm the C drive (your boot drive) has a paging file, either system managed or a large enough custom size.
- It is set to a small fixed size, so kernel or complete dumps run out of room. The safest configuration is to leave the paging file system managed and pair it with Automatic memory dump, since Windows calculates a workable size itself.
How to Set Virtual Memory on a Computer covers how to size it. Do not switch the paging file off to free up space on C, or you will have nothing to look at after the next crash.
6. Where to look after a crash, and how to read it
Event Viewer, start here and install nothing
Open Event Viewer > Windows Logs > System and look for BugCheck, Kernel-Power or Critical entries around the time of the crash. That confirms the stop code and the rough time. Even with no dump file, Event Viewer proves a crash happened and shows the code.
Small tools for reading minidumps
- BlueScreenView from NirSoft, free. Lists the stop code, the driver that triggered it and the time for each crash, which is enough for most people.
- WhoCrashed, the free version is sufficient. Analyses the dump in one click and tells you which driver is most likely at fault.
WinDbg for a deeper look
Microsoft's WinDbg, installed from the Windows SDK or the Store, opens the dump and !analyze -v returns the driver name and a stack trace. Worth doing if you are comfortable with it, or if you need to send findings to a hardware vendor.
7. A typical path through a crash
- Disable automatic restart, reproduce the crash, and note the stop code and the failing driver name (something like
xxx.sys). - Look the code up against the blue screen code list to see whether it usually points at the graphics card, memory, disk or network adapter.
- Update that driver, or roll back one you installed or updated recently. If crashes began after a Windows update, uninstall that update from update history.
- If memory or the disk is suspect, run Windows Memory Diagnostic (
mdsched.exe) andchkdsk C: /f /r.
Common questions
With automatic restart off, will the machine hang forever on the crash screen? It stops and waits for you, it does not hang permanently. Read the code, take a photo, then hold the power button to shut down and start again.
The Minidump folder is empty, nothing was written. Check that the paging file is on the boot drive and system managed (step 5), check that Write debugging information is not set to None, then reboot once so the settings apply.
The analysis points at ntoskrnl.exe, is Windows broken?ntoskrnl.exe is the kernel, and in most cases it is the victim of a driver rather than the cause. Look for the third-party driver named in !analyze -v, since that is where the answer usually is.
Can I delete dump files?
Yes. Old files in C:\Windows\Minidump and MEMORY.DMP can go. Deleting them only costs you the ability to investigate that crash later, and does not affect how Windows runs. They are fair game when C is short on space.