Fix Windows 10/11 Blue Screen (BSOD): Collect Minidumps & Analyze with WinDbg

Fix Windows 10/11 Blue Screen (BSOD): Collect Minidumps & Analyze with WinDbg​

Prerequisites​

• Windows 10 or Windows 11 (any supported version; steps may vary slightly by UI)
• Administrator access
• A recent BSOD (or willingness to wait for the next one)
• Internet connection (for downloading WinDbg and symbols)
• Optional but helpful:
  • A second PC/phone to view this guide if your system is unstable
  • 1–2 GB free disk space (symbols can grow over time)

Step-by-Step: Ensure Windows is Creating Minidumps​

Minidumps are small crash logs stored in C:\Windows\Minidump. They’re ideal for forum troubleshooting because they’re compact and easy to share.

Click to expand...

1) Confirm crash dump settings (Windows 10/11)​

1. Right-click Start → System.
   • Windows 11: you may need Settings → System → About.
2. Select Advanced system settings (on the right side in many builds).
3. Under Startup and Recovery, click Settings…
4. In Write debugging information, select:
   • Small memory dump (256 KB) (recommended for most users)
5. Confirm the Small dump directory is set to:
   • %SystemRoot%\Minidump
6. Check Automatically restart (optional).
   • If you want time to read the BSOD screen, uncheck it.
7. Click OK to apply.

2) Verify your page file isn’t disabled​

1. Open System Properties again → Advanced tab.
2. Under Performance, click Settings… → Advanced tab.
3. Under Virtual memory, click Change…
4. Ensure:
   • Automatically manage paging file size for all drives is enabled
     or
   • Your C: drive has a page file configured (System managed is fine).
5. Click OK and reboot if prompted.

Step-by-Step: Find and Collect Minidumps​

3) Locate the minidump files​

1. Open File Explorer
2. Go to:
   • C:\Windows\Minidump
3. Look for files like:
   • 120123-12345-01.dmp

• You may not have had a BSOD since enabling minidumps.
• The crash may be too severe to write a dump (power loss/hardware lock).
• Storage cleanup tools may be removing them.

4) Copy dumps to a safe location (don’t work from C:\Windows)​

1. Create a folder like:
   • C:\BSOD
2. Copy the .dmp files from C:\Windows\Minidump into C:\BSOD

5) Zip the dumps for sharing (recommended for forum posts)​

1. Select the .dmp files in C:\BSOD
2. Right-click → Send to → Compressed (zipped) folder
3. Name it something like:
   • Minidumps-Jan2026.zip

Step-by-Step: Install WinDbg (Preview) and Set Up Symbols​

6) Install WinDbg from Microsoft Store​

1. Open Microsoft Store
2. Search for WinDbg Preview
3. Click Install

7) Configure the symbol path (critical for useful results)​

1. Launch WinDbg Preview
2. Go to File → Settings (or the gear icon)
3. Find Symbols settings and set the symbol path to Microsoft’s symbol server. A common, reliable path is:

1. Create the folder C:\Symbols if it doesn’t exist.
2. Apply/save settings.

Step-by-Step: Analyze a Minidump with WinDbg​

8) Open the dump file​

1. In WinDbg Preview: File → Open dump file
2. Select one .dmp from C:\BSOD
3. Wait for WinDbg to load it (status messages appear at the bottom/top)

9) Run the basic analysis command​

• BugCheck code (the BSOD “stop code”)
• Likely cause / “Probably caused by”
• Call stack and involved modules

10) Identify the likely driver/module​

• BUGCHECK_CODE or BugCheck
• MODULE_NAME
• IMAGE_NAME
• Probably caused by

• IMAGE_NAME: nvlddmkm.sys (NVIDIA graphics driver)
• IMAGE_NAME: amdkmdag.sys (AMD graphics driver)
• IMAGE_NAME: iaStorAC.sys (Intel storage/RST)
• IMAGE_NAME: Wdf01000.sys (often a framework involved; not always the true culprit)

11) Get more info about a suspicious driver​

• Driver path
• Timestamp (useful for spotting outdated drivers)
• Company name

12) Check for common red flags in the output​

• Very old driver timestamps (years old)
• Security/antivirus filter drivers
• Overclocking/monitoring tools (some hook deeply into the kernel)
• Storage and chipset drivers
• Repeated crashes with the same module across multiple dumps

Tips and Troubleshooting Notes​

If no minidumps are being created​

1. Confirm Small memory dump is selected (Step 1).
2. Ensure C:\Windows\Minidump exists and the system drive has space.
3. Re-enable the page file on C: (Step 2).
4. Temporarily disable “cleanup” utilities that might delete dumps.
5. Check Event Viewer:
   • Start → search Event Viewer
   • Windows Logs → System
   • Look for BugCheck or Kernel-Power events around the crash time

If WinDbg output is mostly “Unknown” or missing names​

• Your symbol path is wrong or symbols didn’t download.
• Re-check Step 7 and ensure WinDbg can access the internet.
• Try running:

.reload
!analyze -v

What to post on WindowsForum.com for help​

• The zipped minidumps (Minidumps-*.zip)
• Your system specs (CPU, GPU, RAM, motherboard, PSU, storage)
• Windows version (Settings → System → About → OS build)
• What changed recently (drivers, updates, new hardware, overclocking)
• Any repeated stop codes or patterns (gaming, idle, sleep/wake, etc.

Safe next steps after identifying a driver​

• Update the driver from the hardware vendor (GPU/Chipset/Storage)
• If the newest driver started the problem, try a clean rollback
• Remove or update low-level utilities (RGB tools, overclocking, “tuning” apps)
• Run basic integrity checks:
  • sfc /scannow
  • DISM /Online /Cleanup-Image /RestoreHealth
• If dumps suggest memory corruption, consider memory testing (e.g., Windows Memory Diagnostic or MemTest86)

Conclusion​

• Minidumps (C:\Windows\Minidump) are the fastest, most shareable BSOD evidence for Windows 10/11 troubleshooting.
• WinDbg Preview + correct symbol path (srv*C:\Symbols*[Symbol information](https://msdl.microsoft.com/download/symbols)) makes crash output readable and actionable.
• Use !analyze -v and lmvm <driver> to identify likely faulty drivers and confirm their details.
• Multiple dumps + system details posted on the forum greatly increases the chance of an accurate diagnosis.