PAGE_FAULT_IN_NONPAGED_AREA is Windows stop code 0x00000050 (0x50). Microsoft defines it as "invalid system memory has been referenced," adding that "typically the memory address is wrong or the memory address is pointing at freed memory." Microsoft's page names five kinds of cause: a faulty system service, faulty driver code, antivirus software, a corrupted NTFS volume, and faulty or failing hardware, usually defective RAM. It then gives seven checks in a set order. This page lays out those seven checks, what the four on-screen numbers mean, and where the developer-only material starts.
Source: the Microsoft Learn page "Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA," read on 12 October 2026 and checked against the Microsoft Docs source file. As with every bug check page, Microsoft marks it as written for programmers and points customers to its blue screen help page at https://www.windows.com/stopcode. Where the page is silent, we say so.
What does "page fault in nonpaged area" mean?
Windows keeps some kernel memory permanently in RAM: the nonpaged area. Code is allowed to assume that memory is always there. A page fault in that area means something asked for an address that should have been resident and valid, and it was not. Microsoft says the address is usually just wrong, or it points at memory that has already been freed. In the debugger output Microsoft quotes, the stop is described as something that "cannot be protected by try-except," which is why Windows halts instead of recovering.
If the driver responsible can be identified, Microsoft says its name is printed on the blue screen. That one line of text is often the most useful thing on the screen, so photograph it before restarting.
Which causes does Microsoft name?
The "Cause" section lists them in two sentences:
- installation of a faulty system service or faulty driver code
- antivirus software
- a corrupted NTFS volume
- installation of faulty hardware, or failure of installed hardware, "usually related to defective RAM, be it main memory, L2 RAM cache, or video RAM"
Microsoft does not rank these by likelihood. The checks below are ordered the way the page orders them, not by how often each one is the answer.
The 7 checks Microsoft lists, in its order
| # | Check | What Microsoft says to do |
|---|---|---|
| 1 | Event Log | Look in the System Log in Event Viewer for critical errors in the same time window as the blue screen |
| 2 | Faulty driver | Note the driver name from the blue screen or event log; ask the vendor for an updated driver |
| 3 | Faulty system service | Disable the service and confirm; if that fixes it, ask the maker for an update |
| 4 | Antivirus software | Disable the program and confirm; if that fixes it, ask the maker for an update |
| 5 | Corrupted NTFS volume | Run Chkdsk /f /r; ask the drive maker about its diagnostic tools |
| 6 | Memory | Run Windows Memory Diagnostics and read the result in Event Viewer |
| 7 | Faulty hardware | Remove recently added hardware; replace failed parts; run the manufacturer's diagnostics |
1. Read the Event Log first
Open Event Viewer, then Windows Logs, System. Find the time of the crash and look for critical errors logged around it. Microsoft says these "might help pinpoint the device or driver that is causing the error." The same log also holds the bug check event with the four parameters, according to Microsoft's general guide to blue screen data.
2. A faulty driver
Examine the driver name if it appeared on the blue screen or in the event log, then contact the driver vendor to see whether an updated driver is available. Microsoft's page does not tell you to roll back or uninstall in this step; it says to look for an update.
3. A faulty system service
Disable the service and confirm that this resolves the error. If it does, contact the maker of the service about a possible update. If the error happens during startup, Microsoft points to the Windows repair options in its recovery options article, https://support.microsoft.com/help/12415/windows-10-recovery-options.
4. Antivirus software
Same pattern: disable the program, see whether the error stops, and if it does, contact the maker about an update.
5. A corrupted NTFS volume
Run Chkdsk /f /r to detect and repair disk errors. Microsoft notes that on a system partition you must restart before the disk scan begins. It also suggests contacting the maker of the drive to find any diagnostic tools they provide.
6. Windows Memory Diagnostics
Microsoft's steps: select Start, open Control Panel, type Memory in the search box, and select Diagnose your computer's memory problems. After the test runs, open Event Viewer, go to the System log and look for the MemoryDiagnostics-Results entry. The page does not say how long the test takes or how to read a partial failure.
7. Faulty hardware
If hardware was added recently, remove it to see whether the error recurs. If existing hardware has failed, remove or replace the faulty component, and run the hardware diagnostics supplied by the system manufacturer. Microsoft refers you to your computer's owner's manual for the procedure.
What do the four numbers mean?
| Parameter | Meaning (Microsoft Learn) |
|---|---|
| 1 | Memory address referenced |
| 2 | Type of access: read, write or execute (values differ by CPU type and Windows version) |
| 3 | Address that referenced memory, if known |
| 4 | Type of page fault, for example 0x0 freed page table entry, 0x2 no valid page table entry |
Parameter 2 is the one most people misread, because the code depends on the processor. Since Windows 1507, x64 and x86 systems use 0 for read, 2 for write and 10 for execute; Arm systems use 0, 1 and 8. Before 1507, x64 and x86 used 0 for read and 1 for write. Parameter 4 has more values than we show: Microsoft also lists 0x03 (a session address used from a process with no session, last used in Windows 10 RS3), 0x04 (a non-canonical, illegal address) and 0xF (kernel code touching a user-mode address when that is not allowed).
Checklist before you start
- Photo of the blue screen, including any driver name
- The four parameters from the System Log bug check event
- What changed recently: driver, service, antivirus, new hardware or RAM
- Backup of important files before running Chkdsk or changing drivers
- Time of the crash, to match against Event Viewer entries
- Whether the blue screen repeats, and whether parameter 1 changes each time
What developers do next
Microsoft is clear that finding the exact cause and writing a code fix needs "programming experience and access to the source code of the faulting module." The page then walks through a debugger session: !analyze -v for the summary; MODULE_NAME and FAULTING_MODULE to see which code made the bad reference; STACK TEXT, compared across several dumps if available; .trap to set context; kb, lm t n, the d* memory display commands on parameters 1 and 3; !address and u on parameter 3; r for registers; and !pte, !pool and !memusage for the state of memory. The page also says the driver name is stored at KiBugCheckDriver and can be shown with dx KiBugCheckDriver, and it recommends Driver Verifier, started by typing Verifier at a command prompt.
What this page does not cover
- A promise that one check fixes it. Microsoft lists seven and ranks none.
- Paging file or registry changes. The Microsoft page does not mention them for 0x50, so we do not either.
- Third-party RAM testers or "PC repair" tools. Microsoft names only its own Windows Memory Diagnostics and the system maker's diagnostics.
- Other stop codes. Our PC and phone fix index lists the stop code guides we have, searchable by code name or hex value.
Sources and how to check
- Bug Check 0x50: PAGE_FAULT_IN_NONPAGED_AREA, Microsoft Learn: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x50--page-fault-in-nonpaged-area
- Analyze bug check (stop code error) data, Microsoft Learn: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/blue-screen-data
- Recovery options in Windows (linked from the 0x50 page): https://support.microsoft.com/help/12415/windows-10-recovery-options
- Troubleshoot blue screen errors (for regular users): https://www.windows.com/stopcode
- Source: Microsoft Learn, as of 12 October 2026. Checked against the Microsoft Docs source files (MicrosoftDocs/windows-driver-docs). Microsoft documentation is licensed under Creative Commons Attribution 4.0 (CC BY 4.0); this article adapts and summarises it with credit to Microsoft and links to the originals. Microsoft does not endorse this site.
Editor's note
Checked: the 0x50 meaning sentence, the named causes, the seven checks and their order, the Chkdsk and Memory Diagnostics instructions, and the parameter tables including the per-architecture values of parameter 2, all against the Microsoft source file on 12 October 2026.
Not checked: which cause is most common for 0x50. Microsoft gives no figure, and nothing here was tested on hardware.
Left out on purpose: registry and paging file tweaks, third-party tools and any step that is not on the Microsoft page.
Frequently Asked Questions
What is stop code 0x50?
It is PAGE_FAULT_IN_NONPAGED_AREA (0x00000050). Microsoft says invalid system memory was referenced, typically a wrong address or one pointing at freed memory.
Is 0x50 caused by bad RAM?
It can be. Microsoft lists faulty or failing hardware, usually defective RAM, alongside faulty drivers or services, antivirus software and a corrupted NTFS volume.
Which Chkdsk command does Microsoft give?
Chkdsk /f /r. Microsoft notes you must restart before the scan begins on a system partition.
Where do I see the memory test result?
In Event Viewer, System log, under the MemoryDiagnostics-Results entry.
What does parameter 2 mean on a 0x50 blue screen?
The type of access. Since Windows 1507, x64 and x86 use 0 read, 2 write, 10 execute; Arm uses 0, 1 and 8.