> ## Content Index
> Fetch the complete content index at: https://techbytefix.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Fix KMODE_EXCEPTION_NOT_HANDLED and Stop the Blue Screen
- URL: https://techbytefix.com/fix-kmode-exception-not-handled/
- Published: 2026-10-26T00:08:22.000Z
- Updated: 2026-10-26T00:08:22.000Z
- Author: Jake Whitman
- Tags: Windows, Troubleshooting

\`KMODE\_EXCEPTION\_NOT\_HANDLED\` is a Windows stop error caused when kernel-mode code, usually a faulty driver, accesses memory incorrectly and Windows cannot safely recover. Undo recent changes first, then try Windows Update, driver rollback or removal, Safe Mode, and system-repair tools in that order. These steps normally preserve personal files, but back up important data before deeper repairs whenever Windows still starts.

## What to do first when KMODE\_EXCEPTION\_NOT\_HANDLED appears

You may see a blue screen with this message:

```text
KMODE_EXCEPTION_NOT_HANDLED
```

Error

The error appears when code running in kernel mode raises an exception that Windows cannot handle safely. A faulty device driver is the most common cause, but a recent Windows or driver update, corrupted system files, defective memory, storage errors, or another failing hardware component can trigger the same stop code. The blue screen may name a driver file such as `nvlddmkm.sys`, `rtwlane.sys`, or another `.sys` file. Record that filename exactly; it can help identify the next step.

1. If Windows is still displaying the blue screen, wait for it to finish collecting information and restart. If it remains frozen, hold the computer's power button only long enough to turn it off, then start it again.
2. Photograph or write down the stop code, any `What failed` filename, and what you were doing immediately before the crash.
3. Disconnect recently added USB devices, docks, expansion cards, printers, and external storage. Leave the keyboard, mouse, display, and system drive connected.
4. Undo the change that happened just before the first crash. Remove newly installed hardware or software, or stop using a newly installed utility until the system is stable.
5. If Windows starts, copy important documents to an external drive or trusted cloud location before deeper repairs. Do not treat System Restore as a backup; it does not preserve every personal file.

Do not download a random replacement `.sys` file or use a driver from an unofficial driver site. Get kernel drivers through Windows Update, the PC manufacturer, the motherboard or device manufacturer, or the original software vendor.

![A close view of a Windows PC monitor shows a system error screen.](https://tse1.mm.bing.net/th?q=Windows%20PC%20error%20screen%20closeup&w=624&h=352&c=7)

## Will these fixes work if Windows keeps crashing or will not start?

Use normal Windows for updates and driver changes when it remains stable. Use Safe Mode when a startup driver or service causes the crash, and use the Windows Recovery Environment (WinRE) when Windows cannot reach the sign-in screen.

These instructions apply to supported Windows 10 and Windows 11 PCs. You normally need an Administrator account. Recovery tools may ask for the password of an administrator account, and BitLocker-encrypted devices may request the recovery key. Many driver and update changes require a restart. Back up important files before making repairs whenever Windows starts reliably enough to do so.

If Windows starts normally, first save your files and create a restore point if System Protection is enabled. If it crashes before you can work, enter Safe Mode:

1. Open Settings, select `System` \> `Recovery` in Windows 11, or `Update & Security` \> `Recovery` in Windows 10.
2. Beside `Advanced startup`, select `Restart now`.
3. Choose `Troubleshoot` \> `Advanced options` \> `Startup Settings` \> `Restart`.
4. Press `4` or `F4` for Safe Mode, or `5` or `F5` for Safe Mode with Networking.

If Windows cannot boot far enough to open Settings, interrupt startup by turning the PC off as soon as the Windows logo appears. Repeat this interruption until Windows enters Automatic Repair, then choose `Advanced options` \> `Troubleshoot` \> `Advanced options` \> `Startup Settings`.

A PC stuck in a restart loop may enter WinRE automatically after several failed starts. You can also boot from a Windows installation USB and select `Repair your computer` rather than `Install now`. Use the same `Troubleshoot` and `Advanced options` menus. Safe Mode loads fewer drivers. If the crash stops there, a driver or service loaded during normal startup becomes more likely.

![A Windows PC monitor displays the Safe Mode desktop.](https://tse1.mm.bing.net/th?q=Windows%20PC%20Safe%20Mode%20screen&w=624&h=352&c=7)

## Fix the likely cause in the safest order

Work through these steps from least disruptive to more involved. Test the computer after each major change instead of changing several drivers at once.

1. Remove or undo the most recent change. In `Settings` \> `Apps` \> `Installed apps`, uninstall a recently added system utility, hardware-control tool, antivirus product, or virtual-device program. If the crash began after a driver update, roll that driver back instead of immediately installing another version.
2. Install pending Windows updates from `Settings` \> `Windows Update` and restart. Windows Update is the preferred source for Windows components and many hardware drivers. If the crash began immediately after a Windows update, open `Settings` \> `Windows Update` \> `Update history` \> `Uninstall updates`, select the newest removable quality update, and confirm. Feature updates use a different recovery option and may not offer the same uninstall choice.
3. Roll back or remove a suspect device driver. Open Device Manager as Administrator, expand the relevant category, right-click the device, and select `Properties` \> `Driver`. Use `Roll Back Driver` when it is available and the problem began after an update. Otherwise choose `Uninstall Device`, select the option to remove the driver package only if Windows presents it and you are sure the package is the suspect one, then restart. Windows may reinstall a compatible driver.

If Device Manager cannot remove the package, use an elevated Command Prompt to identify installed third-party driver packages first:

```cmd
pnputil /enum-drivers
```

Command Prompt (run as Administrator)

Review the `Published Name` and `Original Name` fields. Remove only the package you have identified, using its exact published name, such as `oem42.inf`:

```cmd
pnputil /delete-driver oem42.inf /uninstall
```

Command Prompt (run as Administrator)

The command should report that the driver package was deleted. If Windows says the driver is in use or cannot be removed, do not force deletion. Repeat the operation from Safe Mode or use the device manufacturer's removal instructions. Never remove storage, chipset, keyboard, or display drivers merely because their names look unfamiliar.

1. Repair the Windows component store and protected system files. Open Command Prompt as Administrator in normal Windows or from WinRE. In WinRE, the Windows drive may not be `C:`; use `dir C:\Windows`, then `dir D:\Windows` until you find the correct installation. Run DISM first, then SFC:

```cmd
DISM.exe /Online /Cleanup-Image /RestoreHealth
```

Command Prompt (run as Administrator)

DISM should finish with a message such as `The restore operation completed successfully` and `The operation completed successfully`. If it says source files could not be found, connect to the internet and retry, or use matching Windows installation media as a repair source rather than guessing a source path.

After DISM completes, run:

```cmd
sfc /scannow
```

Command Prompt (run as Administrator)

A successful scan reports `Windows Resource Protection did not find any integrity violations` or says that corrupt files were repaired. If SFC says it could not repair some files, restart and run it once more after DISM. Persistent failures point to a damaged installation, an offline repair requirement, or an underlying storage problem.

From WinRE, the equivalent offline checks require the correct Windows drive letter. Replace `D:` below only after confirming that it contains the `Windows` folder:

```cmd
DISM.exe /Image:D:\ /Cleanup-Image /RestoreHealth
sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows
```

Command Prompt in Windows Recovery Environment

If the offline commands do not complete successfully, verify the drive letter and the recovery environment you are using before trying again. Do not use third-party driver-updater programs; they can install an incorrect kernel driver and make the original problem harder to identify.

## How to confirm the blue screen is really fixed

Restart into normal Windows after the repair, reconnect hardware one item at a time, and use the computer normally. Confirm that Windows can complete several normal restarts, launch the application that previously triggered the error, and sleep or shut down without another blue screen.

If the stop error returns, inspect crash evidence instead of guessing. Open Event Viewer and inspect `Windows Logs` \> `System` around the crash time. The `BugCheck` event may show a stop code and memory dump location, although Event Viewer often identifies the crash only generally.

Windows commonly stores small dumps in:

```text
C:\Windows\Minidump
```

Crash dump location

Look for a newly created `.dmp` file after the crash. A debugger such as WinDbg can analyze it with the `!analyze -v` command. Treat a named driver as a lead, not proof: a graphics or network driver may be blamed because it was active when defective memory or another driver caused the failure.

If the same `.sys` file appears across multiple dumps, check its file properties and match it to the device or software vendor. Update, roll back, or remove that vendor's software from an official source. If different unrelated drivers are blamed on different crashes, suspect memory, storage, overheating, firmware, or a low-level security or virtualization program rather than replacing each driver in turn.

If the crashes stop after the same driver is rolled back or removed and Windows completes several normal restarts, that change is a strong indication that the driver was involved. It still does not prove that the driver was the only cause.

## What to do if KMODE\_EXCEPTION\_NOT\_HANDLED keeps coming back

Use recovery tools when ordinary driver repair has not stopped the crashes, but protect your files before choosing a destructive option.

### System Restore

System Restore can revert system files, drivers, registry settings, and installed programs to an earlier restore point without normally deleting personal documents. It is useful when the crashes began after a recent software or driver change.

1. In normal Windows, search for `Create a restore point`, open it, select `System Restore`, and choose a restore point from before the first crash.
2. In WinRE, select `Troubleshoot` \> `Advanced options` \> `System Restore`.
3. Review the affected programs before confirming. The computer will restart.

If no restore points exist, this option cannot help. It does not repair failing hardware.

### Startup Repair

From WinRE, choose `Troubleshoot` \> `Advanced options` \> `Startup Repair`. Windows will check boot configuration and files needed to start. It is aimed at startup failures, so it may not fix a driver that crashes only after sign-in. If it reports that it could not repair the PC, return to Safe Mode or use the other recovery options rather than repeating it indefinitely.

### Test memory and storage

Run Windows Memory Diagnostic by searching for `Windows Memory Diagnostic`, selecting `Restart now and check for problems`, and allowing the test to complete. You can review the result in Event Viewer under `Windows Logs` \> `System`, filtering for `MemoryDiagnostics-Results`. A reported memory error is a hardware fault until proven otherwise; shut down and test one memory module at a time only if you are comfortable working inside the PC and following its service manual.

Check the system drive from an elevated Command Prompt:

```cmd
chkdsk C: /scan
```

Command Prompt (run as Administrator)

The scan reports whether Windows found file-system errors. If it reports problems that require an offline repair, back up first and follow its prompt to schedule a check. Do not use repeated intensive repairs on a drive that is clicking, disappearing, or becoming unusually slow; copy data and replace or service the drive.

Disconnect nonessential hardware and test the computer with its original configuration. Check for overheating, loose components, recent firmware changes, and failed power supplies. A crash that continues in Safe Mode, appears during memory testing, or occurs before Windows loads is more likely to involve hardware or firmware.

Back up your files and seek professional repair when memory errors persist, the system drive shows signs of failure, the machine cannot remain on long enough to copy data, BitLocker recovery is required and the key is unavailable, or repairs would require opening unfamiliar hardware. Do not repeatedly reset or reinstall Windows to conceal a failing component; that can waste time and make data recovery harder.

![A Windows PC monitor displays the Startup Repair recovery tool.](https://tse1.mm.bing.net/th?q=Windows%20PC%20Startup%20Repair%20screen&w=624&h=352&c=7)

## Conclusion

Record the stop screen, undo the latest change, and then test updates, drivers, Safe Mode, and system repairs in that order. If the crash returns, use repeated dump evidence and hardware tests to separate a driver problem from failing memory, storage, firmware, or another component. Back up your files and stop local repairs when the hardware is failing or the PC cannot remain stable.

## Frequently Asked Questions

### Can a blue screen with KMODE\_EXCEPTION\_NOT\_HANDLED damage my files?

The blue screen does not intentionally delete personal files, but an abrupt shutdown can leave open files or damage the file system. Back up important data as soon as Windows starts, and stop forcing restarts if the drive is failing.

### Should I use Driver Verifier to find the bad driver?

Driver Verifier can deliberately make a defective driver crash so it can be identified, but it can also create a boot loop. Use it only when you can reach WinRE and know how to disable it with \`verifier /reset\`; ordinary rollback, removal, and minidump analysis are safer first steps.

### Does KMODE\_EXCEPTION\_NOT\_HANDLED always mean the driver named on the blue screen is bad?

No. The named driver was often active when the exception occurred, but defective memory, another driver, corrupted files, or hardware can make an innocent driver appear responsible. Look for the same driver across multiple crash dumps and test the wider system when the names vary.