Use Event Viewer to Find Why Your PC Crashed

The Problem

When a PC crashes, freezes, or restarts on its own, Windows writes down what happened. The trouble is that Event Viewer shows tens of thousands of entries, most of them meaningless warnings that appear on perfectly healthy machines.

The skill is not reading the logs — it is knowing which four or five event sources actually matter and how to filter to them. With that, a crash usually points at a specific driver, service, or piece of hardware in about five minutes.

Already have a stop code on screen? Search for it directly — start at how to fix a BSOD. PC restarting with no blue screen at all? See fix Windows 11 freezing and crashing randomly.

Symptoms

Use this guide when:

• The PC restarts on its own with no message.
• A blue screen appears and vanishes too fast to photograph.
• One app crashes repeatedly and its own error tells you nothing.
• You need to know whether a fault is hardware or software before spending money.

Step 1: Open Event Viewer

1. Press Windows + R, type eventvwr.msc, press Enter. (Or right-click Start → Event Viewer.)
2. In the left pane, expand Windows Logs. Five logs live here; only two matter for crashes:
   • System — drivers, services, hardware, shutdowns and boots. This is where crash evidence lives.
   • Application — program crashes and .NET errors.
3. Ignore Security, Setup, and Forwarded Events for this purpose.

Step 2: Start with Reliability Monitor Instead

Before wading into raw logs, use the friendly view built on top of them.

1. Press Windows + R, type perfmon /rel, press Enter.
2. You get a timeline with one column per day and red X marks for failures.
3. Click a red mark to see what failed, then View technical details for the underlying event.
4. This is the fastest way to answer "when did this start?" — look for the day the crashes begin and what was installed or updated immediately before.

Step 3: Find the Crash Itself with Event 41 and 1001

Two event IDs tell you a crash happened and what kind.

1. In Event Viewer, click Windows Logs → System.
2. In the right pane, click Filter Current Log.
3. In Event sources, tick Kernel-Power and BugCheck, then click OK.
4. Read the results:
   • Event ID 41, Kernel-Power — "The system has rebooted without cleanly shutting down first." This means power loss, a hard hang, or a crash where the dump could not be written. Check BugcheckCode in the details: 0 means no blue screen was recorded, which points at power, overheating, or hardware.
   • Event ID 1001, BugCheck — an actual blue screen, with the stop code and parameters recorded.
5. Note the timestamp of the crash. Everything useful happened in the 60 seconds before it.

Step 4: Read What Happened Just Before the Crash

1. Clear the filter (Filter Current Log → Clear), then click the Date and Time column to sort.
2. Scroll to the crash timestamp and read upwards through the minute before it.
3. Look for these sources in particular:
   • disk / Ntfs / volmgr — storage errors. Event ID 7 ("bad block") or 51 means a failing drive: check SSD and hard drive health.
   • WHEA-Logger — hardware reported an error directly: fix WHEA_UNCORRECTABLE_ERROR.
   • Display — a graphics driver reset: fix "display driver stopped responding".
   • Service Control Manager — a service crashed or hung.
   • Application Error / Application Hang (in the Application log) — the faulting module name is the important field.
4. Ignore isolated warnings such as DistributedCOM 10016 and Kernel-EventTracing errors — they appear on healthy PCs and mislead more people than any other entries in the log.

Step 5: Filter to Errors Only and Save a Custom View

Rather than repeat the filtering each time, save it.

1. Right-click Custom Views → Create Custom View.
2. Set Logged to Last 7 days.
3. Tick Error and Critical.
4. Set Event logs to Windows Logs → System and Application.
5. Click OK and name it "Crashes". It now sits at the top of the tree, one click away.

Step 6: Make Sure Crash Dumps Are Being Written

A minidump names the driver that crashed — far more useful than any event entry.

1. Press Windows + R, type sysdm.cpl, press Enter.
2. Advanced tab → Startup and Recovery → Settings.
3. Under Write debugging information, choose Small memory dump (256 KB).
4. Untick Automatically restart so the blue screen stays on screen long enough to read.
5. Confirm the dump path is %SystemRoot%\Minidump and click OK.
6. Dumps only get written if the page file is on C: and large enough — leave virtual memory on System managed size.

Step 7: Read the Minidump to Name the Faulting Driver

1. Browse to C:\Windows\Minidump. Each crash produces one .dmp file named by date.
2. The quickest reader is BlueScreenView from NirSoft — it lists each crash with the stop code and highlights the driver in red.
3. For a proper analysis, install WinDbg from the Microsoft Store, open the dump, and run:

   !analyze -v
   

   Read the MODULE_NAME and IMAGE_NAME lines.
4. A named third-party .sys file is your answer. Common offenders are GPU drivers, network drivers, antivirus filter drivers, and RGB or fan-control utilities.
5. ntoskrnl.exe or hal.dll being named means the crash was reported by the kernel on behalf of something else — usually RAM, storage, or an unstable overclock, not Windows itself.

Step 8: Act on What You Found

1. A named driver — roll it back in Device Manager → device → Properties → Driver → Roll Back Driver, or reinstall from the vendor: how to update outdated drivers.
2. Disk or Ntfs errors — run chkdsk C: /f /r and check SMART data: fix NTFS_FILE_SYSTEM BSOD.
3. Kernel-Power 41 with BugcheckCode 0 — power, heat, or PSU. See fix CPU overheating and thermal throttling and fix a PC that will not turn on.
4. Memory-related codes — run mdsched.exe, then MemTest86: fix MEMORY_MANAGEMENT BSOD.
5. Nothing conclusive — repair Windows: how to run SFC and DISM, then test in Safe Mode: how to enter Safe Mode.

What Not to Do

• Don't chase every red entry. A working PC logs errors constantly. Only entries within a minute of the crash matter.
• Don't clear the logs before you have finished reading them — the history is the evidence.
• Don't paste event text into a search engine and install whatever a forum recommends. Match the source and event ID, not the wording.
• Don't pay for a "log cleaner". Nothing in Event Viewer slows a PC down.

Still Not Working?

If dumps are not being created, check that C: has several GB free and that no cleanup tool is deleting Minidump. If crashes leave no events at all, the machine is losing power instantly — suspect the PSU, a thermal shutdown, or a loose connection rather than Windows.

Related: fix Windows 11 not shutting down or restarting and fix CLOCK_WATCHDOG_TIMEOUT.