Fix KMODE_EXCEPTION_NOT_HANDLED and Stop the Blue Screen

`KMODE_EXCEPTION_NOT_HANDLED` is a Windows stop error caused when kernel-mode code, usually a faulty driver, accesses memory incorrectly and Windows cannot safely recover. Undo recent changes first, then try Windows Update, driver rollback or removal, Safe Mode, and system-repair tools in that order. These steps normally preserve personal files, but back up important data before deeper repairs whenever Windows still starts.

What to do first when KMODE_EXCEPTION_NOT_HANDLED appears

You may see a blue screen with this message:

KMODE_EXCEPTION_NOT_HANDLED

The error appears when code running in kernel mode raises an exception that Windows cannot handle safely. A faulty device driver is the most common cause, but a recent Windows or driver update, corrupted system files, defective memory, storage errors, or another failing hardware component can trigger the same stop code. The blue screen may name a driver file such as nvlddmkm.sys, rtwlane.sys, or another .sys file. Record that filename exactly; it can help identify the next step.

1. If Windows is still displaying the blue screen, wait for it to finish collecting information and restart. If it remains frozen, hold the computer's power button only long enough to turn it off, then start it again.
2. Photograph or write down the stop code, any What failed filename, and what you were doing immediately before the crash.
3. Disconnect recently added USB devices, docks, expansion cards, printers, and external storage. Leave the keyboard, mouse, display, and system drive connected.
4. Undo the change that happened just before the first crash. Remove newly installed hardware or software, or stop using a newly installed utility until the system is stable.
5. If Windows starts, copy important documents to an external drive or trusted cloud location before deeper repairs. Do not treat System Restore as a backup; it does not preserve every personal file.

Do not download a random replacement .sys file or use a driver from an unofficial driver site. Get kernel drivers through Windows Update, the PC manufacturer, the motherboard or device manufacturer, or the original software vendor.

Will these fixes work if Windows keeps crashing or will not start?

Use normal Windows for updates and driver changes when it remains stable. Use Safe Mode when a startup driver or service causes the crash, and use the Windows Recovery Environment (WinRE) when Windows cannot reach the sign-in screen.

These instructions apply to supported Windows 10 and Windows 11 PCs. You normally need an Administrator account. Recovery tools may ask for the password of an administrator account, and BitLocker-encrypted devices may request the recovery key. Many driver and update changes require a restart. Back up important files before making repairs whenever Windows starts reliably enough to do so.

If Windows starts normally, first save your files and create a restore point if System Protection is enabled. If it crashes before you can work, enter Safe Mode:

1. Open Settings, select System > Recovery in Windows 11, or Update & Security > Recovery in Windows 10.
2. Beside Advanced startup, select Restart now.
3. Choose Troubleshoot > Advanced options > Startup Settings > Restart.
4. Press 4 or F4 for Safe Mode, or 5 or F5 for Safe Mode with Networking.

If Windows cannot boot far enough to open Settings, interrupt startup by turning the PC off as soon as the Windows logo appears. Repeat this interruption until Windows enters Automatic Repair, then choose Advanced options > Troubleshoot > Advanced options > Startup Settings.

A PC stuck in a restart loop may enter WinRE automatically after several failed starts. You can also boot from a Windows installation USB and select Repair your computer rather than Install now. Use the same Troubleshoot and Advanced options menus. Safe Mode loads fewer drivers. If the crash stops there, a driver or service loaded during normal startup becomes more likely.

Fix the likely cause in the safest order

Work through these steps from least disruptive to more involved. Test the computer after each major change instead of changing several drivers at once.

1. Remove or undo the most recent change. In Settings > Apps > Installed apps, uninstall a recently added system utility, hardware-control tool, antivirus product, or virtual-device program. If the crash began after a driver update, roll that driver back instead of immediately installing another version.
2. Install pending Windows updates from Settings > Windows Update and restart. Windows Update is the preferred source for Windows components and many hardware drivers. If the crash began immediately after a Windows update, open Settings > Windows Update > Update history > Uninstall updates, select the newest removable quality update, and confirm. Feature updates use a different recovery option and may not offer the same uninstall choice.
3. Roll back or remove a suspect device driver. Open Device Manager as Administrator, expand the relevant category, right-click the device, and select Properties > Driver. Use Roll Back Driver when it is available and the problem began after an update. Otherwise choose Uninstall Device, select the option to remove the driver package only if Windows presents it and you are sure the package is the suspect one, then restart. Windows may reinstall a compatible driver.

If Device Manager cannot remove the package, use an elevated Command Prompt to identify installed third-party driver packages first:

pnputil /enum-drivers

Review the Published Name and Original Name fields. Remove only the package you have identified, using its exact published name, such as oem42.inf:

pnputil /delete-driver oem42.inf /uninstall

The command should report that the driver package was deleted. If Windows says the driver is in use or cannot be removed, do not force deletion. Repeat the operation from Safe Mode or use the device manufacturer's removal instructions. Never remove storage, chipset, keyboard, or display drivers merely because their names look unfamiliar.

4. Repair the Windows component store and protected system files. Open Command Prompt as Administrator in normal Windows or from WinRE. In WinRE, the Windows drive may not be C:; use dir C:\Windows, then dir D:\Windows until you find the correct installation. Run DISM first, then SFC:

DISM.exe /Online /Cleanup-Image /RestoreHealth

DISM should finish with a message such as The restore operation completed successfully and The operation completed successfully. If it says source files could not be found, connect to the internet and retry, or use matching Windows installation media as a repair source rather than guessing a source path.

After DISM completes, run:

sfc /scannow

A successful scan reports Windows Resource Protection did not find any integrity violations or says that corrupt files were repaired. If SFC says it could not repair some files, restart and run it once more after DISM. Persistent failures point to a damaged installation, an offline repair requirement, or an underlying storage problem.

From WinRE, the equivalent offline checks require the correct Windows drive letter. Replace D: below only after confirming that it contains the Windows folder:

DISM.exe /Image:D:\ /Cleanup-Image /RestoreHealth
sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

If the offline commands do not complete successfully, verify the drive letter and the recovery environment you are using before trying again. Do not use third-party driver-updater programs; they can install an incorrect kernel driver and make the original problem harder to identify.

How to confirm the blue screen is really fixed

Restart into normal Windows after the repair, reconnect hardware one item at a time, and use the computer normally. Confirm that Windows can complete several normal restarts, launch the application that previously triggered the error, and sleep or shut down without another blue screen.

If the stop error returns, inspect crash evidence instead of guessing. Open Event Viewer and inspect Windows Logs > System around the crash time. The BugCheck event may show a stop code and memory dump location, although Event Viewer often identifies the crash only generally.

Windows commonly stores small dumps in:

C:\Windows\Minidump

Look for a newly created .dmp file after the crash. A debugger such as WinDbg can analyze it with the !analyze -v command. Treat a named driver as a lead, not proof: a graphics or network driver may be blamed because it was active when defective memory or another driver caused the failure.

If the same .sys file appears across multiple dumps, check its file properties and match it to the device or software vendor. Update, roll back, or remove that vendor's software from an official source. If different unrelated drivers are blamed on different crashes, suspect memory, storage, overheating, firmware, or a low-level security or virtualization program rather than replacing each driver in turn.

If the crashes stop after the same driver is rolled back or removed and Windows completes several normal restarts, that change is a strong indication that the driver was involved. It still does not prove that the driver was the only cause.

What to do if KMODE_EXCEPTION_NOT_HANDLED keeps coming back

Use recovery tools when ordinary driver repair has not stopped the crashes, but protect your files before choosing a destructive option.

System Restore

System Restore can revert system files, drivers, registry settings, and installed programs to an earlier restore point without normally deleting personal documents. It is useful when the crashes began after a recent software or driver change.

1. In normal Windows, search for Create a restore point, open it, select System Restore, and choose a restore point from before the first crash.
2. In WinRE, select Troubleshoot > Advanced options > System Restore.
3. Review the affected programs before confirming. The computer will restart.

If no restore points exist, this option cannot help. It does not repair failing hardware.

Startup Repair

From WinRE, choose Troubleshoot > Advanced options > Startup Repair. Windows will check boot configuration and files needed to start. It is aimed at startup failures, so it may not fix a driver that crashes only after sign-in. If it reports that it could not repair the PC, return to Safe Mode or use the other recovery options rather than repeating it indefinitely.

Test memory and storage

Run Windows Memory Diagnostic by searching for Windows Memory Diagnostic, selecting Restart now and check for problems, and allowing the test to complete. You can review the result in Event Viewer under Windows Logs > System, filtering for MemoryDiagnostics-Results. A reported memory error is a hardware fault until proven otherwise; shut down and test one memory module at a time only if you are comfortable working inside the PC and following its service manual.

Check the system drive from an elevated Command Prompt:

chkdsk C: /scan

The scan reports whether Windows found file-system errors. If it reports problems that require an offline repair, back up first and follow its prompt to schedule a check. Do not use repeated intensive repairs on a drive that is clicking, disappearing, or becoming unusually slow; copy data and replace or service the drive.

Disconnect nonessential hardware and test the computer with its original configuration. Check for overheating, loose components, recent firmware changes, and failed power supplies. A crash that continues in Safe Mode, appears during memory testing, or occurs before Windows loads is more likely to involve hardware or firmware.

Back up your files and seek professional repair when memory errors persist, the system drive shows signs of failure, the machine cannot remain on long enough to copy data, BitLocker recovery is required and the key is unavailable, or repairs would require opening unfamiliar hardware. Do not repeatedly reset or reinstall Windows to conceal a failing component; that can waste time and make data recovery harder.

Conclusion

Record the stop screen, undo the latest change, and then test updates, drivers, Safe Mode, and system repairs in that order. If the crash returns, use repeated dump evidence and hardware tests to separate a driver problem from failing memory, storage, firmware, or another component. Back up your files and stop local repairs when the hardware is failing or the PC cannot remain stable.

Frequently Asked Questions

Can a blue screen with KMODE_EXCEPTION_NOT_HANDLED damage my files?

The blue screen does not intentionally delete personal files, but an abrupt shutdown can leave open files or damage the file system. Back up important data as soon as Windows starts, and stop forcing restarts if the drive is failing.

Should I use Driver Verifier to find the bad driver?

Driver Verifier can deliberately make a defective driver crash so it can be identified, but it can also create a boot loop. Use it only when you can reach WinRE and know how to disable it with `verifier /reset`; ordinary rollback, removal, and minidump analysis are safer first steps.

Does KMODE_EXCEPTION_NOT_HANDLED always mean the driver named on the blue screen is bad?

No. The named driver was often active when the exception occurred, but defective memory, another driver, corrupted files, or hardware can make an innocent driver appear responsible. Look for the same driver across multiple crash dumps and test the wider system when the names vary.