How to Fix CRITICAL_PROCESS_DIED in Windows 11

•
Ankit Kumar
Windows 11BSODTroubleshootingFix

The Problem

CRITICAL_PROCESS_DIED (stop code 0x000000EF) means a process Windows depends on was terminated unexpectedly. Windows marks a handful of processes as critical—csrss.exe, wininit.exe, services.exe, smss.exe, lsass.exe—and if any of them exits, the kernel stops the system immediately rather than continuing in an undefined state.

Sometimes it happens once after an update and never returns. Sometimes it loops on every boot.

New to blue screens? Start with how to fix the Blue Screen of Death. For a different stop code, see DPC_WATCHDOG_VIOLATION.

The Four Realistic Causes

In the order you should suspect them:

  1. Corrupt system files — after a failed update, an interrupted shutdown, or aggressive "cleaner" software.
  2. A bad driver, especially storage, chipset, or antivirus filter drivers.
  3. Failing storage — the critical process could not read its own code back from disk.
  4. Bad RAM — less common for this specific code, but worth testing when nothing else fits.

Quick Checks First

  • Unplug recently added hardware. New RAM, a new drive, or a USB device with a poor driver is a frequent trigger.
  • Note the frequency. A single crash after an update often does not recur. A loop needs Safe Mode.
  • Recall what changed. New antivirus, a driver update, a Windows update, or a cleaner utility run in the last few days is your prime suspect.

Step 1: Get into Safe Mode

If Windows will not stay up long enough to work in, force-shutdown at the logo three times to trigger the recovery environment, then Troubleshoot → Advanced options → Startup Settings → Restart → press 4. Full steps: enter Safe Mode in Windows 11.

If it crashes in Safe Mode too, that points strongly at hardware or badly damaged system files—go to Steps 4 and 5.

Step 2: Repair System Files

This is the highest-yield fix for this stop code. In Terminal (Admin) or the recovery Command Prompt:

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

Run DISM first—it repairs the component store that SFC pulls its known-good copies from, so running SFC first often reports damage it cannot fix. Restart after both complete and run sfc /scannow once more to confirm it now reports no integrity violations. Details: repair Windows 11 with SFC and DISM.

Step 3: Update or Roll Back Drivers

  1. Right-click Start → Device Manager.
  2. Look for any device with a yellow ! and update it.
  3. If the crashes began right after a driver update: device → Properties → Driver → Roll Back Driver.
  4. Pay particular attention to storage controllers, chipset, and any third-party antivirus with a kernel filter driver—uninstall the antivirus entirely as a test, rather than merely disabling it.

Guidance: update outdated drivers.

Step 4: Check the Disk

chkdsk C: /f /r

Type Y to schedule it for the next restart, then reboot. On a large drive this takes hours; let it finish. Afterwards check SMART data properly: check SSD or hard drive health.

Step 5: Test the RAM

  1. Press Win + R, type mdsched.exe, press Enter → Restart now and check for problems.
  2. For a thorough test, use MemTest86 from a USB stick and run it for several passes—Windows Memory Diagnostic misses intermittent faults.
  3. If you have more than one stick, test with one at a time to identify the bad module.

Step 6: Undo a Bad Update or Restore

Step 7: Read the Dump to Stop Guessing

  1. Open Event Viewer → Windows Logs → System and look for BugCheck events—see use Event Viewer to find why your PC crashed.
  2. Confirm dumps are enabled: Settings → System → About → Advanced system settings → Startup and Recovery → Write debugging information → Small memory dump.
  3. The process or driver named in the dump tells you which of the causes above applies, which beats working through all five.

What Not to Do

  • Don't run a registry cleaner. Several of them delete keys that critical processes need, and they are a documented cause of this exact stop code.
  • Don't disable a critical service to "stop the crash". Ending or disabling lsass or csrss produces the same blue screen by design.
  • Don't reinstall Windows before testing the disk. If the drive is failing, the reinstall will simply fail or crash again within days.

Still Crashing?

  • If memory or disk tests fail, that hardware needs replacing—failing RAM and dying SSDs are the classic hardware causes here.
  • As a last resort that keeps your data: reinstall Windows without losing data.

Diagnose faster: PC-Troubleshooter runs driver, RAM, and disk checks in one pass so you are not guessing which one threw the stop code.

Related guides