Windows 11 Crash Triage Cheat Sheet

Sidebar

Operating Systems · Windows 11 Crash Triage Cheat Sheet

The first ten minutes after a blue screen or an unexpected restart: what to record, which events say what happened, how to decode the stop code, where the dumps are and what to save before anything overwrites it. Event IDs, field names and the dump settings were read from the PC this was written on (Windows 11 Pro, build 26300) as a normal user; the WinDbg commands and the bug check reference link are from Microsoft's documentation and were not run here.

First Two Minutes: Record, Don't Fix

TimeWrite down when it happened, and what you were doing. Event times and your memory are the two halves of the timeline

Stop code textWindows 11 shows a name such as KERNEL_MODE_HEAP_CORRUPTION and a QR code; a phone photo of the screen is enough

Don't clean upDisk Cleanup and Storage Sense can delete System error memory dump files: the evidence. Leave them until the dumps are copied

Don't uninstall yetOne change at a time, recorded (see the Drivers & Updates sheet). Changing three things first makes the cause unknowable

Keep a logDate, stop code, what changed recently, what you tried. A plain text file is fine

Did It Crash or Just Restart?

Kernel-Power 41The system has rebooted without cleanly shutting down first. Written at the next start. The fields tell you which kind

BugcheckCode ≠ 0A blue screen. The code is stored in decimal: 314 is 0x13A

BugcheckCode = 0Windows had no chance to say why: power loss, a hard hang, a forced power-off or a heat cut-out. No dump will exist

PowerButtonTimestampA time here (and LongPowerButtonPressDetected = true) means the power button was held. On this PC both no-code restarts show 0 / false

EventLog 6008The previous system shutdown at … was unexpected. The same story from the Event Log service, with the last-alive time

User32 1074A planned restart or shutdown, and which process asked for it. Not a crash

Kernel-Power 109The kernel power manager has initiated a shutdown transition. Normal: it accompanies ordinary restarts

WER-SystemErrorReporting 1001Written after a blue screen: The bugcheck was: 0x0000013a (…four parameters…). A dump was saved in: C:\WINDOWS\Minidump\…

Both Kernel-Power 41 and event 1001 are the first thing to read: together they give the code, the four parameters and the dump's file name.

Decode the Stop Code

'{0:X}' -f 314PowerShell: decimal from event 41 to hex (13A)

[Convert]::ToString(314,16)The same, another way

learn.microsoft.comSearch bug check code reference and the code (e.g. 0x13A): the page names the four parameters and what each means

Four parametersEvery bug check has four. For 0x13A: P1 type of heap corruption, P2 the heap, P3 where it was detected, P4 reserved

Hex vs decimalEvent 41 shows decimal; documentation, WinDbg and event 1001 show hex

Where the Evidence Lives

C:\Windows\Minidump\*.dmpSmall dumps, one per crash (about 3.6 MB each on this PC). Listing works as a normal user; reading them needs administrator rights

C:\Windows\MEMORY.DMPThe full/kernel/automatic dump, if the dump type is set to one (not present on this PC)

CrashDumpEnabledHKLM\SYSTEM\CurrentControlSet\Control\CrashControl: 0 none, 1 complete, 2 kernel, 3 small, 7 automatic (here: 3). Read-only to look at

sysdm.cplSystem Properties > Advanced > Startup and Recovery: the dump type, auto-restart and the dump path (changing it needs admin and a note of the old value)

AutoRebootSet to 1 here: Windows restarts by itself after a blue screen, so you may miss the screen. Untick Automatically restart to read it

perfmon /relReliability Monitor: a stability index (1 to 10) and a day-by-day list of crashes, failed updates and app failures

Other Logs That Help

Application Error 1000An application crashed: the faulting program and module (e.g. KAPS.exe, 19 times here)

Application Hang 1002A program stopped responding

Windows Error Reporting 1001Application log: a report was created. Very noisy (4,755 here), so filter by time

Service Control Manager 7034The service terminated unexpectedly; 7031 adds that it will be restarted

disk 7 / 11 / 51 / 153Bad block / controller error / paging error / I/O retried. Storage trouble, often USB drives

WHEA-LoggerHardware errors the CPU or memory reported. None on this PC. Reading rule: none is weak evidence, not an all-clear

Save It Before It Goes

Copy the dumpsAdministrator PowerShell: Copy-Item C:\Windows\Minidump\*.dmp C:\crash-evidence\. Open copies, never the originals

wevtutil epl System C:\crash-evidence\System.evtxExport the System log (probably needs admin; not tested here). The System log holds only 20 MB and here reaches back to July

systeminfo > C:\crash-evidence\si.txtOS build, hotfixes, RAM, BIOS version: a one-file snapshot

Screenshot Reliability MonitorIt keeps about a year but is easy to lose with a reinstall

Hash the copiesGet-FileHash on each, in a text file: proves later they are unchanged

Then Read the Dump (Not Needed in the First Ten Minutes)

windbg -z <dump>Open a copy in WinDbg with the symbol path set (srv*C:\Symbols*https://msdl.microsoft.com/download/symbols)

.bugcheckShows the code and parameters. Check they match the event log: if not, wrong dump

!analyze -vMicrosoft's first command: bug check, Probably caused by and the stack. A suspect, not a verdict

lmList the loaded modules (drivers) with dates

Two dumpsThe same module in both is much stronger than one dump

Small dumps show only the thread that stopped: damage done earlier by something else may not be visible.

Two crashes with the same code

Same stop code twice is a lead, not a diagnosis. Line the crashes up against what changed (Windows Update history, new drivers, new software) before blaming a part. The Drivers & Updates sheet has the commands.

The 17-minute gap

Event 41 is written at the next start, and last alive (event 6008) can be minutes before it. Use the earlier time when you look for what happened.