Using 'Event Viewer' to Find Why a PC Blue-Screened

Why the Blue Screen Itself Isn't Enough

A Blue Screen of Death (BSOD) gives you a stop code like KERNEL_POWER_FAILURE or DPC_WATCHDOG_VIOLATION, but that code alone rarely tells you which driver, service, or hardware component actually caused the crash. Windows logs far more detail than what flashes on screen for half a second before rebooting. Event Viewer is where that detail lives, and cross-referencing it with the memory dump Windows writes on every crash is how you actually diagnose the problem instead of guessing.

Step 1: Confirm Windows Is Actually Saving Dumps

Before you go looking for crash data, make sure Windows is configured to write it. Open the Start menu, search for View advanced system settings, and under the Advanced tab click Settings in the Startup and Recovery section. Confirm Write debugging information is set to at least Small memory dump (256 KB) or Automatic memory dump. If it's set to None, change it — you won't be able to diagnose future crashes without this.

Step 2: Find the Crash in Event Viewer

1. Press Win + R, type eventvwr.msc, and press Enter.
2. In the left pane, expand Windows Logs and click System.
3. Click Filter Current Log in the right-hand Actions pane.
4. Under Event sources, check Microsoft-Windows-Kernel-Power and BugCheck, then click OK.
5. Sort by Date and Time and look for an entry timestamped right around when the crash happened. A kernel power event with Event ID 41 ("The system has rebooted without cleanly shutting down first") is the classic sign of an unplanned reboot or BSOD.

Click on the Event ID 41 entry and check the General tab. If it lists a BugCheck code, that's your stop code in hexadecimal — for example, 0x00000116 corresponds to VIDEO_TDR_FAILURE, usually a GPU driver timing out and recovering (or failing to). Look up a separate Event ID 1001 from source BugCheck as well; it often includes the four crash parameters that narrow down the cause further.

Step 3: Pull the Real Answer From the Minidump

Event Viewer tells you that a crash happened and gives you a bug check code, but the minidump tells you which driver was executing when it happened. Windows writes these to C:\Windows\Minidump\ by default.

1. Install the free WinDbg Preview from the Microsoft Store, or the classic WinDbg from the Windows SDK.
2. Open WinDbg, go to File > Start Debugging > Open Dump File, and select the most recent .dmp file from C:\Windows\Minidump\.
3. Once it loads, type !analyze -v in the command box and press Enter.

0: kd> !analyze -v
*******************************************************************************
*                        Bugcheck Analysis                                    *
*******************************************************************************
KERNEL_POWER_FAILURE (116)
Arg1: ffffc50d8a2b1010, Device object of the display device
Arg2: fffff8054e2a3c40, Miniport driver's DPC watchdog device
...
FAILURE_BUCKET_ID:  0x116_igdkmd64!unknown_function
IMAGE_NAME:  igdkmd64.sys

The IMAGE_NAME line is the payoff: it names the actual driver file involved, in this example an Intel graphics driver. From here, the fix is usually one of the following: update or roll back that specific driver, uninstall a recently installed piece of software that dropped a bad driver, or check the hardware tied to that driver (reseat the GPU, test different RAM sticks, etc.).

Common Bug Check Codes and What They Usually Mean

• 0x0000001E / 0x0000000A (KMODE_EXCEPTION_NOT_HANDLED / IRQL_NOT_LESS_OR_EQUAL) — almost always a faulty driver referencing bad memory. Check the IMAGE_NAME.
• 0x00000116 / 0x00000117 (VIDEO_TDR_FAILURE) — GPU driver timeout. Update or clean-reinstall the GPU driver with DDU (Display Driver Uninstaller) in Safe Mode.
• 0x00000124 (WHEA_UNCORRECTABLE_ERROR) — hardware-level error reported by the CPU: overheating, unstable overclock, or failing hardware. Check temperatures and revert any overclocks first.
• 0x0000007B (INACCESSIBLE_BOOT_DEVICE) — storage controller driver issue, often after cloning a drive or changing SATA mode in BIOS.
• 0x000000EF (CRITICAL_PROCESS_DIED) — a core Windows process was terminated unexpectedly; run sfc /scannow and check for failing storage.

When There's No Dump File

If C:\Windows\Minidump\ is empty despite repeated crashes, the disk may be too full to write the dump, the recovery settings may have reverted, or the crash is severe enough (a total power cut) that nothing gets written before the machine dies. In that case, lean entirely on Event Viewer's System log around the time of the crash — check for Disk, WHEA-Logger, and thermal-related warnings in the minutes leading up to the Event ID 41 entry, since those often show the root cause building up before the actual crash.