Windows · Windows Server  ·  high  ·  Bugchecks & startup

STOP 0x0000001E — KMODE_EXCEPTION_NOT_HANDLED

Kernel-mode code raised an exception nothing was prepared to handle. Along with 0xA it is the generic "a driver did something illegal" bugcheck.

What you see

Bluescreens with 0x1E, often naming a .sys file on the screen. If a file is named, that is a real lead and worth following first.

What is actually wrong

A faulty or mismatched driver in the overwhelming majority of cases; failing memory in the rest.

Codes and articles

0x0000001E0x1EKMODE_EXCEPTION_NOT_HANDLED0x0000000AIRQL_NOT_LESS_OR_EQUAL

Fixes (2)

Deal with the named driver
Elevated PowerShell30 minuteslow riskreversible

A .sys file is on the screen or in the dump.

  1. Identify what the file belongs to.

    PowerShell
    Get-ChildItem C:\Windows\System32\drivers\thedriver.sys | ForEach-Object { $_.VersionInfo } | Format-List CompanyName, FileDescription, FileVersion

  2. Check how old it is against the rest.

    PowerShell
    Get-ChildItem C:\Windows\System32\drivers\*.sys | Sort-Object LastWriteTime | Select-Object -First 20 Name, LastWriteTime

    A driver years older than everything around it, on hardware that has been through a Windows upgrade, is the classic cause of this bugcheck.

  3. Get the current version from the hardware vendor, not from Windows Update.

  4. If no newer version exists and the device is not essential, remove the driver package.

    PowerShell
    pnputil /enum-driverspnputil /delete-driver oem42.inf /uninstall /force

  5. Restart.

Confirm it workedNo further bugchecks under the workload that used to trigger them.
If you need to undo itReinstall the vendor driver package; pnputil /add-driver restores a removed one if you kept the .inf.
Find the driver when nothing is named
WinDbg1–2 daysmedium riskreversible

The screen blames ntoskrnl.exe, which almost never means the kernel is at fault — it means the kernel was executing on someone else's behalf.

  1. Confirm dumps are being written and are complete.

    PowerShell
    Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CrashControl' | Format-List CrashDumpEnabled, DumpFile, MiniDumpDir

  2. Open the most recent minidump in WinDbg and run the analysis.

    Command Prompt
    !analyze -v

  3. Look at the raw stack rather than the summary — the culprit is usually a frame or two below what is blamed.

    Command Prompt
    kb; !thread; lmvm ntoskrnl

  4. List all loaded third-party modules and compare against the stack.

    Command Prompt
    lm kv

  5. If the stack is uninformative, enable Driver Verifier on non-Microsoft drivers only.

    Command Prompt
    verifier /standard /driver.exclude ntoskrnl.exe

  6. Turn it off as soon as you have an answer.

    Command Prompt
    verifier /reset
Confirm it workedThe named driver is dealt with and the crashes stop.
If you need to undo itverifier /reset from Safe Mode or WinRE if Verifier makes the machine unbootable.

Related faults

STOP 0x0000009F — DRIVER_POWER_STATE_FAILUREWindowsSTOP 0x00000139 — KERNEL_SECURITY_CHECK_FAILUREWindowsSTOP 0x0000007B — INACCESSIBLE_BOOT_DEVICEWindowsSTOP 0x00000133 — DPC_WATCHDOG_VIOLATIONWindowsSTOP 0x00000050 — PAGE_FAULT_IN_NONPAGED_AREAWindows0xC000021A — STATUS_SYSTEM_PROCESS_TERMINATEDWindows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.