Windows · Windows Server  ·  critical  ·  Bugchecks & startup

STOP 0x000000EF — CRITICAL_PROCESS_DIED

A process marked critical exited. The kernel names the process in the dump, and which one it was decides the fix entirely.

What you see

Bluescreen with CRITICAL_PROCESS_DIED, sometimes in a loop at boot, sometimes at random during use.

What is actually wrong

Corrupt system files, a failing disk, or a third-party service crashing something like svchost, wininit or services.exe.

Codes and articles

0x000000EF0xEFCRITICAL_PROCESS_DIED

Start here — find out which fix applies

A script that runs the 1 inspection command from the write-up below and prints what each one returned. It reads the machine and changes nothing — every command that could write, delete, start or stop is excluded from it by construction. Run this first, then pick the fix its output points at.

Download the read-only diagnosticchanges nothing · safe to run before reading

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Fixes (2)

Repair the system files and check the disk
Elevated PowerShell45 minuteslow riskreversible

Windows starts, even if only in Safe Mode.

  1. Repair the component store, then the system files, in that order.

    PowerShell
    DISM /Online /Cleanup-Image /RestoreHealthsfc /scannow

    SFC repairs from the component store, so repairing the store first is what makes SFC able to fix anything.

  2. Check the disk's own health before assuming software.

    PowerShell
    Get-PhysicalDisk | Format-Table FriendlyName, MediaType, HealthStatus, OperationalStatus -AutoSizeGet-StorageReliabilityCounter -PhysicalDisk (Get-PhysicalDisk) | Format-Table DeviceId, Wear, ReadErrorsTotal, UncorrectedReadErrors -AutoSize

  3. Schedule a full disk check.

    Command Prompt
    chkdsk C: /f /r

  4. Find which process died — the dump names it.

    PowerShell
    Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 5 | Format-List TimeCreated, Message

  5. If a third-party service is implicated, disable it and test.

    PowerShell
    Get-Service | Where-Object { $_.Status -eq 'Running' } | Select-Object Name, DisplayName | Sort-Object DisplayName
Confirm it workedNo further bugchecks over several days, and sfc reports no violations.
If you need to undo itRe-enable any service you disabled.
Download this fix as a PowerShell scriptasks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Break the boot loop from WinRE
Windows Recovery Environment1 hourmedium riskreversible

The machine loops before reaching a desktop.

  1. Reach WinRE and open Command Prompt. Identify the Windows volume with diskpart.

  2. Check the disk first.

    Command Prompt
    chkdsk D: /f /r

  3. Run the offline system file check.

    Command Prompt
    sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

  4. Revert any pending update transaction, which is a frequent cause of the loop.

    Command Prompt
    DISM /Image:D:\ /Cleanup-Image /RevertPendingActions

  5. If it still loops, disable automatic restart so the bugcheck stays on screen long enough to read which process died.

    Command Prompt
    bcdedit /store D:\Boot\BCD /set {default} recoveryenabled Nobcdedit /store D:\Boot\BCD /set {default} bootstatuspolicy IgnoreAllFailures

    This stops WinRE hijacking every boot, which otherwise hides the actual error text you need.

  6. As a last resort before rebuilding, use System Restore from WinRE if a restore point predates the fault.

Confirm it workedThe machine boots to sign-in.
If you need to undo itbcdedit /store D:\Boot\BCD /set {default} recoveryenabled Yes puts automatic recovery back once the machine is healthy.
Download this fix as a PowerShell script2 steps you do yourself · asks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Related faults

0xC000021A — STATUS_SYSTEM_PROCESS_TERMINATEDWindowsSTOP 0x0000009F — DRIVER_POWER_STATE_FAILUREWindowsSTOP 0x00000139 — KERNEL_SECURITY_CHECK_FAILUREWindowsSTOP 0x0000001E — KMODE_EXCEPTION_NOT_HANDLEDWindowsSTOP 0x0000007B — INACCESSIBLE_BOOT_DEVICEWindowsSTOP 0x00000133 — DPC_WATCHDOG_VIOLATIONWindows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.