Windows · Windows Server  ·  critical  ·  Bugchecks & startup

STOP 0x000000EF — CRITICAL_PROCESS_DIED

A process marked critical exited. The kernel names the process in the dump, and which one it was decides the fix entirely.

What you see

Bluescreen with CRITICAL_PROCESS_DIED, sometimes in a loop at boot, sometimes at random during use.

What is actually wrong

Corrupt system files, a failing disk, or a third-party service crashing something like svchost, wininit or services.exe.

Codes and articles

0x000000EF0xEFCRITICAL_PROCESS_DIED

Fixes (2)

Repair the system files and check the disk
Elevated PowerShell45 minuteslow riskreversible

Windows starts, even if only in Safe Mode.

  1. Repair the component store, then the system files, in that order.

    PowerShell
    DISM /Online /Cleanup-Image /RestoreHealthsfc /scannow

    SFC repairs from the component store, so repairing the store first is what makes SFC able to fix anything.

  2. Check the disk's own health before assuming software.

    PowerShell
    Get-PhysicalDisk | Format-Table FriendlyName, MediaType, HealthStatus, OperationalStatus -AutoSizeGet-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk) | Format-Table DeviceId, Wear, ReadErrorsTotal, UncorrectedReadErrors -AutoSize

  3. Schedule a full disk check.

    Command Prompt
    chkdsk C: /f /r

  4. Find which process died — the dump names it.

    PowerShell
    Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 5 | Format-List TimeCreated, Message

  5. If a third-party service is implicated, disable it and test.

    PowerShell
    Get-Service | Where-Object { $_.Status -eq 'Running' } | Select-Object Name, DisplayName | Sort-Object DisplayName
Confirm it workedNo further bugchecks over several days, and sfc reports no violations.
If you need to undo itRe-enable any service you disabled.
Break the boot loop from WinRE
Windows Recovery Environment1 hourmedium riskreversible

The machine loops before reaching a desktop.

  1. Reach WinRE and open Command Prompt. Identify the Windows volume with diskpart.

  2. Check the disk first.

    Command Prompt
    chkdsk D: /f /r

  3. Run the offline system file check.

    Command Prompt
    sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

  4. Revert any pending update transaction, which is a frequent cause of the loop.

    Command Prompt
    DISM /Image:D:\ /Cleanup-Image /RevertPendingActions

  5. If it still loops, disable automatic restart so the bugcheck stays on screen long enough to read which process died.

    Command Prompt
    bcdedit /store D:\Boot\BCD /set {default} recoveryenabled Nobcdedit /store D:\Boot\BCD /set {default} bootstatuspolicy IgnoreAllFailures

    This stops WinRE hijacking every boot, which otherwise hides the actual error text you need.

  6. As a last resort before rebuilding, use System Restore from WinRE if a restore point predates the fault.

Confirm it workedThe machine boots to sign-in.
If you need to undo itbcdedit /store D:\Boot\BCD /set {default} recoveryenabled Yes puts automatic recovery back once the machine is healthy.

Related faults

0xC000021A — STATUS_SYSTEM_PROCESS_TERMINATEDWindowsSTOP 0x0000009F — DRIVER_POWER_STATE_FAILUREWindowsSTOP 0x00000139 — KERNEL_SECURITY_CHECK_FAILUREWindowsSTOP 0x0000001E — KMODE_EXCEPTION_NOT_HANDLEDWindowsSTOP 0x0000007B — INACCESSIBLE_BOOT_DEVICEWindowsSTOP 0x00000133 — DPC_WATCHDOG_VIOLATIONWindows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.