Fix SYSTEM_THREAD_EXCEPTION_NOT_HANDLED Blue Screens

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED means a Windows kernel thread crashed while handling an exception, usually because a driver is incompatible, corrupted, or conflicting with hardware. Record any `.sys` file named on the blue screen, disconnect recently added hardware, and use Safe Mode to roll back or remove the related driver. If Windows will not start, use Windows Recovery Environment, Startup Settings, System Restore, and offline repair tools; do not delete or download replacement `.sys` files.

What SYSTEM_THREAD_EXCEPTION_NOT_HANDLED is telling you

The stop code means a system thread raised an exception that Windows could not handle safely. Windows displays a blue screen to prevent further damage. A faulty kernel-mode driver is the most common cause, but damaged system files, memory errors, storage problems, overheating, firmware, and a recent hardware change can produce the same result.

The blue screen may show a file name beneath the stop code, such as nvlddmkm.sys, rtwlane.sys, or another .sys file. Record the complete name and the stop code before restarting. The name points to a likely driver or device, but it is not proof: another component might have corrupted memory, and some file names are too generic to identify the real fault.

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

The error can appear during startup, while signing in, or when Windows accesses a particular device. A single crash after installing a device, driver, update, or program may not return. A crash that repeats during startup is a boot loop. Stop normal restarts and move to Safe Mode or Windows Recovery Environment instead.

If the screen displays a parameter or another stop code, record that too. Take a photograph if the computer restarts too quickly. The exact driver name and what changed immediately before the first crash are often more useful than the stop-code title alone.

Which fix applies when Windows still starts versus when it does not

These steps apply to Windows 10 and Windows 11 on desktop and laptop PCs. Driver and recovery menu names can differ slightly by manufacturer. An Administrator account is required for driver changes, DISM, SFC, and CHKDSK. Administrator rights are not required merely to disconnect hardware or enter recovery options.

Before changing anything, save your work and back up important files if Windows remains usable. A repair can require a restart, and a failing drive can become less accessible over time. Do not install a replacement .sys file from a download site.

Use this path:

• If you reach the desktop and the crash happened once, disconnect newly added hardware, then update or roll back the related driver.
• If Windows starts only intermittently, enter Safe Mode and make the driver or software change there.
• If Windows cannot reach the sign-in screen, use Windows Recovery Environment and try Startup Settings, System Restore, or offline repairs.
• If the crash began immediately after a restore point, driver installation, or Windows update, undo that specific change before attempting broader repairs.

To enter Windows Recovery Environment from a working desktop, use the following path. Hold Shift while selecting Restart if Windows is unstable.

Settings > System > Recovery > Advanced startup > Restart now

You can also interrupt normal boot two or three times by turning the PC off when the Windows logo appears. Windows should display Automatic Repair and then Advanced options. Use this only to reach recovery; do not keep interrupting startup after the recovery screen appears.

If BitLocker is enabled, recovery tools may request the BitLocker recovery key. Obtain it from the Microsoft account or organization that manages the device before proceeding.

The safest order of fixes for the blue screen

Work from the least disruptive change to the more involved repair. After each step, restart and check whether the stop code returns.

1. Shut down the PC and disconnect newly added USB devices, docks, external drives, adapters, and other hardware. Leave the keyboard, mouse, display, and required power connections attached. If the crash stops, reconnect devices one at a time and install the manufacturer’s current driver for the device that triggers it.

If the problem began after adding internal hardware, such as memory, a graphics card, or a Wi-Fi adapter, power off, disconnect power, and have the hardware reseated or removed safely. Do not open a device that is under warranty if doing so could void its coverage.

If disconnecting hardware stops the crash, the removed device, its driver, or its connection is implicated. If the crash continues, proceed to Safe Mode or the next applicable step.

2. If Windows reaches the desktop, open Device Manager as Administrator and locate the device associated with the named driver. Check the driver provider and date in its properties.

Start > Device Manager > device category > device > Properties > Driver

Choose Update Driver when a known compatible driver is available. If the crash started immediately after an update, choose Roll Back Driver instead. If rollback is unavailable, uninstall the device from Device Manager and restart; Windows may reinstall a basic driver. Prefer the computer or device manufacturer’s driver, not a random driver-download site.

Do not select an option to delete driver files unless you have confirmed the package is the cause and have a replacement available.

If the driver change worked, Windows should start and remain stable through several restarts. If the same blue screen returns, the change did not resolve the cause or another component is producing the failure.

3. Remove recently installed system utilities, antivirus products, VPN clients, disk tools, overclocking software, and virtualization tools if the timing matches the first crash. Use normal Apps settings rather than deleting their folders. Some security and virtualization drivers load before ordinary applications and can cause this stop code even when the application itself never opens.

If removing the recent software stops the crashes, reinstall only a current version from the manufacturer when Windows is stable. If the crashes continue, continue with Windows Update or System Restore.

4. Install pending Windows updates only after the system is stable enough to remain running. Updates can contain a corrected driver, but installing several unrelated drivers at once makes the cause harder to identify.

Settings > Windows Update > Check for updates

Windows should report that updates are downloaded or installed, or that no updates are available. If the computer crashes during the update, return to Safe Mode or Windows Recovery Environment and undo the most recent change.

5. If the crash began after a known change, use System Restore. It normally preserves personal files but removes drivers, applications, and settings installed after the selected restore point. Choose a restore point dated before the first crash.

Windows Recovery Environment > Troubleshoot > Advanced options > System Restore

A successful restore reports that Windows was restored to the selected point. If no restore points exist, this option cannot help; that does not indicate that your personal files are damaged.

6. Repair Windows system files from an elevated Command Prompt. From a normal desktop, open Command Prompt as Administrator. Run DISM first, then SFC.

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc.exe /scannow

DISM should finish with a message that the restore operation completed successfully. SFC should report either that it found no integrity violations or that it found and repaired corrupted files. If DISM reports that source files could not be found, connect to the internet and retry, or use matching Windows installation media as a repair source. If SFC says it could not perform the requested operation, run it from Safe Mode.

If the tools report errors they could not repair, do not assume the driver is fixed. Continue with CHKDSK and the hardware checks below.

7. Check the Windows volume for file-system errors from an elevated Command Prompt. Restart when prompted.

chkdsk C: /scan

The scan reports whether it found file-system problems. If it says repairs require an offline scan, back up important data and schedule the repair.

chkdsk C: /f

Do not cancel an offline CHKDSK repair unless the computer is clearly unresponsive for an extended period. If the scan reports bad sectors, repeated errors, or cannot complete, suspect a failing drive rather than only a driver problem.

8. If Windows will not boot, open Windows Recovery Environment and choose Troubleshoot > Advanced options > Startup Settings > Restart. Select 4 or F4 for Safe Mode, or 5 or F5 for Safe Mode with Networking. In Safe Mode, roll back or uninstall the suspected driver and remove software installed just before the crashes began. You can also open Troubleshoot > Advanced options > System Restore without loading the desktop.

If Safe Mode starts, the basic Windows configuration is working well enough to undo a recent driver or software change. If Safe Mode also crashes, use System Restore, offline checks, or hardware diagnostics instead of repeatedly restarting normally.

From Recovery Environment, use Command Prompt for offline checks only when you know the Windows volume letter. It may not be C: in recovery. Find the correct volume by checking which one contains the Windows folder.

dir C:\Windows
dir D:\Windows
dir E:\Windows

Run offline SFC against the correct volume, replacing C: if Windows is on another letter.

sfc.exe /scannow /offbootdir=C:\ /offwindir=C:\Windows

If the command reports that it repaired files, restart and test Windows. If it cannot find the installation, use the volume letter that contained the Windows folder. Do not manually delete the named .sys file: it may be required for startup, and removing it can turn a recoverable driver problem into an unbootable installation.

How to confirm the crash is actually fixed

A successful repair is more than one normal boot. Restart the computer several times, open the applications that were running when the crash occurred, reconnect removed devices one at a time, and use the PC long enough to reproduce the original workload. Test under the condition that caused the failure, such as sleep, gaming, video playback, docking, or heavy disk activity.

If Windows remains stable, check Reliability Monitor for the crash history.

Control Panel > System and Security > Security and Maintenance > Reliability Monitor > View reliability history

You can also inspect Event Viewer, although it may record only that Windows stopped unexpectedly rather than the original cause.

Event Viewer > Windows Logs > System

Look for events at the crash time, especially driver installation, disk, memory, or hardware errors. Do not treat every warning near the crash as the cause.

If the blue screen returns, check whether it names the same .sys file or repeats the same stop-code parameters. The same driver after a rollback or removal suggests that the change did not take effect or that another component is invoking it. A different file name on each crash points more strongly toward memory corruption, failing hardware, overheating, or incompatible low-level software.

Minidumps can provide more detail when they are enabled. Check this folder after a crash:

C:\Windows\Minidump

If a new dump appears, preserve it before using cleanup tools. Analysis normally requires debugging software and the correct symbols; do not assume that the driver named by a basic dump viewer is solely responsible.

The fix is verified when Windows remains stable through repeated restarts and the original workload, no new dump is created for the same failure, and reconnecting hardware does not reproduce the crash. If any of those checks fails, continue diagnosing rather than declaring the repair complete.

What to do if SYSTEM_THREAD_EXCEPTION_NOT_HANDLED keeps coming back

Repeated crashes after driver repair call for hardware and firmware checks. Back up important files first. If the computer cannot stay on long enough to back up, stop forcing restarts and remove the drive or use a qualified repair service that can copy the data safely.

Test memory with Windows Memory Diagnostic or a reputable bootable memory test. Remove nonstandard memory overclocks and return firmware settings to their stable defaults before testing. If errors appear, test modules and slots according to the computer or motherboard manufacturer’s instructions; replace the failing part rather than continuing to reinstall Windows.

Check storage health with the manufacturer’s diagnostic utility. Warning signs include slow file access, disappearing drives, repeated disk errors in Event Viewer, CHKDSK bad-sector reports, or crashes that become more frequent during disk activity. Replace a failing drive and restore from a backup instead of repeatedly repairing its file system.

Overheating can cause apparently random driver crashes. Check that fans operate, vents are clear, and the heatsink is not blocked by dust. Return CPU or GPU overclocks and undervolts to default settings. A crash during games or other sustained workloads points toward temperature, power delivery, graphics hardware, or its driver.

Install BIOS, UEFI, chipset, storage-controller, and device firmware updates only from the computer or component manufacturer, and follow its power and recovery instructions. An interrupted firmware update can make the system unusable, so do not update firmware during an unstable power supply or from an unverified download.

Temporarily remove or disable recently installed antivirus, virtualization, encryption, RGB, monitoring, and overclocking tools using their supported uninstallers. Their kernel drivers can conflict even when Windows and the main device driver are current. Re-enable protections or replace the software once stability is confirmed.

Suspect a hardware change rather than only a driver when the crash began immediately after installing memory, a graphics card, a Wi-Fi adapter, or another component; when the named driver changes from crash to crash; or when errors appear in Safe Mode, memory tests, storage diagnostics, or temperature checks.

Seek professional repair when memory or storage diagnostics report errors, the system overheats or powers off, firmware recovery is involved, important data is not backed up, or the PC crashes in Safe Mode with different driver names. A clean reinstall should be a last resort after data recovery and hardware checks, not the first response to this stop code.

Conclusion

Record the `.sys` name, undo the most recent driver or hardware change, and make one reversible change at a time. If Windows will not start, use Startup Settings or System Restore from Windows Recovery Environment. If crashes continue with changing driver names or memory, disk, heat, or firmware symptoms, protect your data and investigate the hardware.

Frequently Asked Questions

Should I delete the `.sys` file named on the blue screen?

No. It may be a required Windows or device driver, and deleting it can prevent startup. Identify its associated device or software, then roll back, update, or uninstall that component through supported Windows or manufacturer tools. Never download a replacement `.sys` file from an unverified site.

Can SYSTEM_THREAD_EXCEPTION_NOT_HANDLED be caused by RAM?

Yes. Faulty or unstable memory can corrupt data used by different drivers, so the named file may change from one crash to another. Run a memory diagnostic and return any overclocked memory settings to their defaults.

What if Windows keeps restarting before I can sign in?

Enter Windows Recovery Environment using Automatic Repair or the Advanced startup option, then choose Startup Settings and Safe Mode. From there, undo the recent driver or software change. System Restore is another option if a suitable restore point exists. If Safe Mode also crashes, use System Restore, offline checks, or hardware diagnostics.