How to Fix KMODE_EXCEPTION_NOT_HANDLED in Windows 11

The Problem

KMODE_EXCEPTION_NOT_HANDLED (stop code 0x0000001E) means something running in kernel mode — a driver, or occasionally Windows itself — raised an exception that no code was ready to catch. Kernel mode has no safety net, so Windows stops immediately rather than risk corrupting memory or your files.

Like SYSTEM_THREAD_EXCEPTION_NOT_HANDLED, this one often prints the offending file in brackets. When it does, you have your answer. When it does not, the reliable order is: fast startup, recently changed drivers, third-party antivirus, then memory.

Crashing during shutdown or wake from sleep specifically? Fast startup is the single most common cause — jump to Step 2.

Symptoms

• Blue screen reading KMODE_EXCEPTION_NOT_HANDLED, sometimes followed by a .sys filename.
• Crashes on shutdown, on waking from sleep, or a few minutes after logging in.
• Started after installing new hardware, a driver, or a security suite.
• The PC may boot fine in Safe Mode but crash reliably in normal mode.

Step 1: Find Out What Failed

1. Photograph the screen and read anything in brackets after the stop code.
2. Press Windows + R, type eventvwr.msc, press Enter.
3. Open Windows Logs → System and filter by source BugCheck.
4. Confirm dumps are being written: Windows + R → sysdm.cpl → Advanced → Startup and Recovery → Settings → Write debugging information set to Small memory dump (256 KB). Files land in C:\Windows\Minidump.
5. Full method: how to use Event Viewer to find why your PC crashed.

Step 2: Turn Off Fast Startup

Fast startup saves the kernel and drivers to disk instead of shutting them down properly. If a driver does not survive that round trip, you get this exact stop code — and because the bad state is saved, it comes back every boot.

1. Open Control Panel → Power Options → Choose what the power buttons do.
2. Click Change settings that are currently unavailable.
3. Untick Turn on fast startup (recommended) and Save changes.
4. Restart — not shut down and power on, since a normal shutdown is what fast startup interferes with.
5. Give it a full day. If the crashes stop, leave it off; the boot time cost is a couple of seconds on an SSD.

Step 3: Reverse the Most Recent Driver Change

1. Right-click Start → Device Manager.
2. Expand Display adapters, Network adapters, and Sound, video and game controllers — the three most common sources.
3. Right-click the device → Properties → Driver tab → Roll Back Driver if it is available.
4. If it is greyed out, choose Uninstall device, tick Attempt to remove the driver, reboot, and install the vendor's current release.
5. For graphics specifically, remove it properly: clean install GPU drivers with DDU.
6. General guidance: how to update outdated drivers.

Step 4: Remove Third-Party Antivirus Temporarily

Security suites install filter drivers that sit deep in the kernel and are a well-known source of this stop code, especially after a Windows feature update.

1. Uninstall the suite through Settings → Apps → Installed apps — do not merely disable it, since the drivers stay loaded.
2. Run the vendor's official removal tool afterwards; most leave drivers behind otherwise.
3. Reboot. Microsoft Defender takes over automatically, so you are not unprotected: fix Windows Defender not working.
4. If the crashes stop, reinstall the suite fresh from the vendor's current installer, or stay on Defender.

Step 5: Repair Windows System Files

1. Right-click Start → Terminal (Admin).
2. Run:

   sfc /scannow
   

3. Then:

   DISM /Online /Cleanup-Image /RestoreHealth
   

4. Reboot and run sfc /scannow again — the second pass repairs what the first could not, once DISM has fixed the component store.
5. Detail: how to run SFC and DISM.

Step 6: Test the Memory

1. Windows + R → mdsched.exe → Restart now and check for problems.
2. Press F1 during the test and choose Extended for the test mix.
3. For a definitive answer, run MemTest86 from USB for four or more passes.
4. Disable XMP / EXPO in firmware and retest — a memory profile the CPU cannot handle produces kernel exceptions with no consistent pattern. See how to enter BIOS or UEFI.
5. Any error means bad RAM or an unstable profile: check and upgrade your RAM.

Step 7: Name the Driver With Driver Verifier

Use this only when nothing has been named and you can reach Safe Mode, because it deliberately increases crashes while it runs.

1. Windows + R → verifier → Create custom settings (for code developers).
2. Select Standard settings, then Select driver names from a list and tick only non-Microsoft drivers.
3. Reboot and use the PC. The next crash should print a specific .sys file.
4. Turn it off from Terminal (Admin) as soon as you have the name:

   verifier /reset
   

5. If the PC will not boot, enter Safe Mode and run the same command there.

Step 8: Roll Back the Update or Restore the System

1. Windows + R → rstrui → choose a restore point dated before the crashes started.
2. To remove a specific update: Settings → Windows Update → Update history → Uninstall updates.
3. Full method: fix Windows 11 after a bad update.
4. Set restore points to be created routinely from now on: create a system restore point.

What Not to Do

• Don't disable fast startup and stop there if crashes continue — it treats a symptom, not the driver underneath.
• Don't run two antivirus suites at once. Competing kernel filter drivers cause exactly this failure.
• Don't leave Driver Verifier enabled after it names a file.
• Don't factory reset first. A bad driver reinstalls itself and a bad RAM stick does not care.

Still Not Working?

If the crashes survive clean drivers, no third-party antivirus, tested memory, and repaired system files, look at firmware and heat: update the motherboard BIOS from the manufacturer's support page, and check temperatures under load. Back up first — set up automatic backups.

Related: fix IRQL_NOT_LESS_OR_EQUAL, fix BAD_POOL_HEADER, and fix SYSTEM_SERVICE_EXCEPTION.