Windows · Windows Server · high · Bugchecks & startup

STOP 0x0000001E — KMODE_EXCEPTION_NOT_HANDLED

Kernel-mode code raised an exception nothing was prepared to handle. Along with 0xA it is the generic "a driver did something illegal" bugcheck.

What you see

Bluescreens with 0x1E, often naming a .sys file on the screen. If a file is named, that is a real lead and worth following first.

What is actually wrong

A faulty or mismatched driver in the overwhelming majority of cases; failing memory in the rest.

Codes and articles

0x0000001E0x1EKMODE_EXCEPTION_NOT_HANDLED0x0000000AIRQL_NOT_LESS_OR_EQUAL

Start here — find out which fix applies

A script that runs the 1 inspection command from the write-up below and prints what each one returned. It reads the machine and changes nothing — every command that could write, delete, start or stop is excluded from it by construction. Run this first, then pick the fix its output points at.

Download the read-only diagnosticchanges nothing · safe to run before reading

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Fixes (2)

Deal with the named driver

Elevated PowerShell30 minuteslow riskreversible

A .sys file is on the screen or in the dump.

Identify what the file belongs to.

PowerShell

Get-ChildItem C:\Windows\System32\drivers\thedriver.sys | ForEach-Object { $_.VersionInfo } | Format-List CompanyName, FileDescription, FileVersion

Check how old it is against the rest.
PowerShell
```
Get-ChildItem C:\Windows\System32\drivers\*.sys | Sort-Object LastWriteTime | Select-Object -First 20 Name, LastWriteTime
```
A driver years older than everything around it, on hardware that has been through a Windows upgrade, is the classic cause of this bugcheck.
Get the current version from the hardware vendor, not from Windows Update.
If no newer version exists and the device is not essential, remove the driver package.
PowerShell
```
pnputil /enum-driverspnputil /delete-driver oem42.inf /uninstall /force
```
Restart.

Confirm it workedNo further bugchecks under the workload that used to trigger them.

If you need to undo itReinstall the vendor driver package; pnputil /add-driver restores a removed one if you kept the .inf.

Download this fix as a PowerShell script2 steps you do yourself · asks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Find the driver when nothing is named

WinDbg1–2 daysmedium riskreversible

The screen blames ntoskrnl.exe, which almost never means the kernel is at fault — it means the kernel was executing on someone else's behalf.

Confirm dumps are being written and are complete.

PowerShell

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' | Format-List CrashDumpEnabled, DumpFile, MiniDumpDir

Open the most recent minidump in WinDbg and run the analysis.
Command Prompt
```
!analyze -v
```
Look at the raw stack rather than the summary — the culprit is usually a frame or two below what is blamed.
Command Prompt
```
kb; !thread; lmvm ntoskrnl
```
List all loaded third-party modules and compare against the stack.
Command Prompt
```
lm kv
```
If the stack is uninformative, enable Driver Verifier on non-Microsoft drivers only.
Command Prompt
```
verifier /standard /driver.exclude ntoskrnl.exe
```
Turn it off as soon as you have an answer.
Command Prompt
```
verifier /reset
```

Confirm it workedThe named driver is dealt with and the crashes stop.

If you need to undo itverifier /reset from Safe Mode or WinRE if Verifier makes the machine unbootable.

Download this fix as a PowerShell scriptasks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.