CRITICAL_PROCESS_DIED Blue Screen 0xEF: The 9 Checks Microsoft Lists

If your PC stopped on a blue screen that says CRITICAL_PROCESS_DIED, the stop code is 0x000000EF (often written 0xEF). Microsoft's own reference describes it in one sentence: a critical system process terminated, and because Windows cannot run safely without that process, it halts the whole system on purpose.

This guide sticks to what Microsoft documents for this exact code. Everything below comes from the Microsoft Learn page "Bug Check 0xEF: CRITICAL_PROCESS_DIED" and the bug check code reference, both read on 9 October 2026. Where the page is silent, we say so instead of filling the gap with guesses. One honest warning up front: Microsoft labels that page as written for programmers, and it points everyday users to a separate help page. We cover both paths and tell you which one you are on.

What does CRITICAL_PROCESS_DIED actually mean?

Windows marks a handful of its own processes as critical. If one of them ends unexpectedly, Windows forces a bug check, the technical name for the blue screen. Microsoft explains the reason plainly: these processes are essential to how Windows runs, so when one dies the operating system's integrity is in question, and stopping is safer than carrying on.

Microsoft lists the built-in critical services by name: csrss.exe, wininit.exe, logonui.exe, smss.exe, services.exe, conhost.exe and winlogon.exe. The check happens when the state of such a process is corrupted or damaged.

There is a second, less obvious source. A developer can create a service and set its recovery option to Restart the Computer. A failing service configured that way can also end in this stop code. So the name of the stop code tells you *what* happened (a protected process ended), not *which* process or *why*.

What do the four numbers on the screen mean?

The blue screen and the crash dump carry four parameters. Microsoft defines them like this:

Parameter	Meaning (Microsoft Learn)
1	The process object
2	0 = a process terminated, 1 = a thread terminated
3	Reserved
4	Reserved

Parameter 2 is the useful one. Microsoft's resolution steps start by using it to decide whether a dying process or a dying thread caused the stop, because the follow-up tools differ.

Are you a regular user or a developer?

Microsoft splits the audience, and so do we.

• Regular users are sent to Microsoft's blue screen help page at https://www.windows.com/stopcode. If the PC restarts normally afterwards and the error does not come back, there may be nothing further to do. If it repeats, the general checks in the next section are the ones Microsoft lists for people who cannot use a debugger.
• Developers and IT staff are told that finding the cause "typically requires the use of the debugger." The page recommends looking at several dump files to see whether the stop has similar characteristics each time, and examining a user-mode dump first when one exists, since a kernel dump can miss paged-out data.

The 9 general checks Microsoft lists, in its own order

For anyone who cannot work with the debugger, the Microsoft page gives general troubleshooting tips. Here they are, in the order the page lists them. We have not added any.

• Recently added hardware. Try removing or replacing it, and check with the manufacturer for patches.
• Recently added drivers or system services. Try removing or updating them, and work out what changed just before the stop code appeared.
• Event Viewer, System Log. Look for critical errors in the same time window as the blue screen; they can point to the device or driver involved.
• BIOS or firmware. Check with the manufacturer whether an update is available.
• Hardware diagnostics. Run the diagnostics supplied by the system manufacturer.
• Compatibility. Confirm that newly installed hardware is compatible with your version of Windows.
• Virus scan. Run a virus detection program, and make sure it checks the Master Boot Record. Microsoft notes that disk corruption caused by viruses can generate bug check codes.
• System File Checker. Run SFC /scannow from an elevated command prompt to scan for and restore corrupted Windows system files. Microsoft's support article on the tool is at https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system.
• Device Manager. Look for devices marked with an exclamation point, review the driver's event log, and try updating the related driver.

How to read the System Log around the crash

Check 3 is the one that most often turns a vague stop code into a name, so it is worth a closer look. Open Event Viewer (type "Event Viewer" in the Start menu search), then go to Windows Logs, System. Sort by date and scroll to the minute the blue screen appeared. Microsoft's advice is to look for critical errors in the same time window as the crash; entries just before the stop are the interesting ones, because they can name the service, driver or device that failed first.

Two practical notes. First, the log keeps entries from earlier restarts too, so match the time carefully rather than reading the newest line. Second, a single warning is not proof of a cause. Microsoft frames the log as something that "might help pinpoint" the device or driver, not as a verdict. If the same driver or service shows up before several crashes, that pattern is the stronger lead, and it fits Microsoft's broader advice to compare more than one dump.

Quick checklist before you start

• Write down the stop code and the four parameters (a phone photo is enough)
• Note what changed recently: new hardware, a new driver, a new service or app that installs a service
• Check whether the blue screen repeats or happened once
• Back up anything important before changing drivers or firmware
• Keep the Event Viewer time window of the crash handy

What developers check next

The Microsoft page continues past the general tips for people who can debug:

• Use parameter 2 to tell a dying process from a dying thread.
• For a process, use the !process debugger command to look at the process before and after the point of failure; the Sysinternals Process Explorer utility can show parent and child relationships.
• For a thread, use the !thread command, and see Microsoft's notes on changing contexts in kernel mode.
• Check the event log for errors leading up to the stop, then set a breakpoint in the related code and single-step through it, watching the variables that control the code flow.
• Run !analyze -show 0xEF in WinDbg to print Microsoft's description of the code, as the bug check reference explains.

What this guide does not cover

• A promise that one step fixes it. Microsoft does not rank its general tips by success rate, and neither do we.
• Registry edits, third-party "fixer" tools or reinstall shortcuts. None of them appear on the Microsoft page for this code.
• Other stop codes. Each code has its own Microsoft page. Our PC and phone fix index lists the guides we have so far, searchable by code or symptom.

Sources and how to verify

• Bug Check 0xEF: CRITICAL_PROCESS_DIED, Microsoft Learn: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xef--critical-process-died
• Bug check code reference, Microsoft Learn: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
• Resolving blue screen errors (for regular users): https://www.windows.com/stopcode
• Source: Microsoft Learn, as of 9 October 2026. Checked against the Microsoft Docs source files. Microsoft documentation is licensed under Creative Commons Attribution 4.0 (CC BY 4.0); this article adapts and summarises it with credit to Microsoft and links to the originals. Microsoft does not endorse this site.

Editor's note

Checked: the meaning of 0xEF, the seven named critical services, the four parameters, the nine general tips and their order, all against the Microsoft Learn page source.

Not checked: which of the nine tips works most often. Microsoft does not say, and we have not tested it on hardware.

Left out on purpose: registry tweaks, paid repair tools and anything not on the Microsoft page for this code.