How to Check Blue Screen (BSOD) Logs in Windows 10 and 11

When Windows crashes with a blue screen (BSOD), it usually restarts before you can read the error. Windows does keep a record, though: a log entry with the stop code and, in most cases, a dump file that can point to the driver or hardware that caused the crash. This guide shows how to find blue screen logs in Windows 10 (and Windows 11) with Event Viewer, Reliability Monitor, and minidump files, how to read what they say, and what to do next.

Quick Answer

Press Windows key + R, type eventvwr, and open Windows Logs > System. Click Filter Current Log and enter 1001 in the Event ID box. Open a BugCheck event to see the stop code and dump file location. For an easier timeline, run perfmon /rel to open Reliability Monitor. Crash dump files are in C:\Windows\Minidump.

Method 1: Reliability Monitor (Easiest)

1. Press Windows key + R, type perfmon /rel, and press Enter. You can also search Start for View reliability history.
2. Look for red X icons in the Windows failures row.
3. Click the day of the crash. Entries such as “Windows was not properly shut down” or “Shut down unexpectedly” mark the crash.
4. Click View technical details to see the BugCheck code and parameters.

Reliability Monitor also shows app crashes and updates on the same timeline, which helps you spot a driver or update installed just before the crashes began.

Method 2: Event Viewer

1. Press Windows key + R, type eventvwr, and press Enter.
2. Expand Windows Logs and click System.
3. In the right pane, click Filter Current Log.
4. In the <All Event IDs> box, type 1001, 41 and click OK.
5. Click an event with Source BugCheck and read the General tab.

Event	Source	What it means
1001	BugCheck	A blue screen occurred. Shows the bugcheck (stop) code and the dump file path.
41	Kernel-Power	The PC restarted without shutting down cleanly. A BugcheckCode of 0 on the Details tab usually means a power loss, freeze, or hard reset rather than a BSOD.
6008	EventLog	“The previous system shutdown was unexpected”

To reuse the filter later, click Create Custom View with the same settings and name it “Blue screens.”

Method 3: Minidump Files

Windows saves a small crash dump for each blue screen in C:\Windows\Minidump. The file names include the date, for example 092426-10953-01.dmp. A full memory dump may also be saved as C:\Windows\MEMORY.DMP.

Analyze a dump with WinDbg

1. Install WinDbg from the Microsoft Store.
2. Open WinDbg as administrator and choose File > Open dump file. Select a .dmp file. If opening it from the Minidump folder is blocked, copy it to your Desktop first.
3. Once it loads, click the !analyze -v link or type it in the command box and press Enter.
4. Look for MODULE_NAME, IMAGE_NAME, and PROCESS_NAME. A third-party driver file (for example, one from a graphics, network, or antivirus vendor) is a strong clue.

Free tools such as NirSoft BlueScreenView show the same information in a simpler list. Download them only from the developer’s official site.

Common Stop Codes and What to Check

Stop code	Code	Common causes
IRQL_NOT_LESS_OR_EQUAL	0x0000000A	Faulty drivers, bad RAM
SYSTEM_SERVICE_EXCEPTION	0x0000003B	Graphics or other drivers, system file corruption
PAGE_FAULT_IN_NONPAGED_AREA	0x00000050	RAM, drivers, antivirus
KMODE_EXCEPTION_NOT_HANDLED	0x0000001E	Drivers
CRITICAL_PROCESS_DIED	0x000000EF	Corrupted system files, failing drive
WHEA_UNCORRECTABLE_ERROR	0x00000124	Hardware: CPU, overclocking, overheating, power supply
VIDEO_TDR_FAILURE	0x00000116	Graphics driver or GPU
DRIVER_POWER_STATE_FAILURE	0x0000009F	Drivers during sleep or wake

No Dump Files? Turn On Crash Dumps

1. Press Windows key + R, type sysdm.cpl, and press Enter.
2. On the Advanced tab, under Startup and Recovery, click Settings.
3. Under Write debugging information, choose Small memory dump (256 KB) or Automatic memory dump.
4. Make sure Small dump directory is %SystemRoot%\Minidump.
5. Uncheck Automatically restart if you want the blue screen to stay visible so you can read it.

Dumps also need a page file on the system drive, and cleanup tools can delete old dumps.

What to Do After You Find the Cause

• Driver named in the dump: update it from the manufacturer’s site, or roll it back in Device Manager > Properties > Driver > Roll Back Driver.
• Crashes started after an update: uninstall the update under Settings > Update & Security > View update history > Uninstall updates.
• Possible system file corruption: run sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth in an admin Command Prompt.
• Possible memory problem: run Windows Memory Diagnostic (mdsched).
• Possible drive problem: run chkdsk C: /scan and check the drive’s health with the manufacturer’s tool.
• Hardware codes (WHEA): remove overclocks, check temperatures, and reseat components.

Frequently Asked Questions

Where are blue screen logs stored in Windows 10?

The event log entries are in Event Viewer under Windows Logs > System (Event ID 1001). Dump files are in C:\Windows\Minidump and C:\Windows\MEMORY.DMP.

Is the process the same on Windows 11?

Yes. Event Viewer, Reliability Monitor, and dump file locations are the same.

Can I delete old minidump files?

Yes, once you’ve finished troubleshooting. Disk Cleanup can remove them under System error memory dump files or System error minidump files.

Summary

1. Run perfmon /rel for a quick crash timeline and bugcheck code.
2. In Event Viewer, filter the System log for Event ID 1001 (and 41).
3. Open dumps from C:\Windows\Minidump in WinDbg and run !analyze -v.
4. Match the stop code and module to a driver, update, or hardware cause.
5. Turn on small memory dumps if no dump files are being saved.