Microsoft is rolling a small but practical change into Windows 11 Insider builds: after an unexpected kernel crash (bugcheck), Windows can now offer a one‑click path to schedule a quick RAM check — running the built‑in
Windows Memory Diagnostic on the next reboot — with results surfaced back to the signed‑in user.
Background
Windows has long included a native memory tester (mdsched.exe) that runs in a pre‑boot environment to exercise installed RAM modules and report faults. Until now, most users only run that tool manually when troubleshooting suspected RAM problems because it requires scheduling a reboot and — for deep coverage — extended run times. Microsoft’s new feature, called
Proactive Memory Diagnostics, stitches that existing capability into the post‑crash sign‑in flow so running a short, automated triage pass becomes visible and low‑friction. This capability is currently rolling out to Windows Insiders via the cumulative preview identified as
KB5067109 (Dev Channel Build
26220.6982, Beta Channel Build
26120.6982) and is being piloted with broad telemetry collection to refine triggers over time.
What the new Proactive Memory Diagnostics does
- After Windows detects a bugcheck (unexpected restart/BSOD), the next time you sign in you may see a dismissible notification recommending a “quick memory scan.”
- If you accept, Windows schedules the Windows Memory Diagnostic to run in the pre‑boot environment during the next restart.
- The diagnostic executes a short, default test pass (Microsoft estimates around five minutes or less on average for the triage pass) and then continues booting to the desktop.
- If the scan finds an issue and the system applies any mitigation, Windows surfaces a follow‑up notification after boot. The test result is also written to the Event Viewer under MemoryDiagnostics entries for later inspection.
This is explicitly framed as a
triage step — a lightweight, optional check designed to catch obvious memory faults quickly, not a replacement for extended forensic testing or vendor diagnostics.
Why Microsoft added this (and why it matters)
Random crashes and unexplained instability are among the most time‑consuming support scenarios. Faulty RAM, unstable memory profiles (XMP/EXPO), and marginal memory controllers can produce intermittent failures or silent data corruption that are hard to reproduce. Making a built‑in memory check visible immediately after a crash does three practical things:
- Lowers the barrier to run a canonical first test for RAM issues, saving time for users and support desks.
- Captures diagnostic artifacts close to the failure event, which helps RMA/warranty workflows and evidence gathering.
- Provides telemetry to Microsoft so the company can learn which bugcheck signatures correlate strongly with memory corruption and then refine which crashes should prompt the scan. For the initial flight Microsoft intentionally triggers on all bugcheck codes to collect that data.
This pragmatic, usability‑first approach addresses a real pain point: many casual users never think to run mdsched or lack the knowledge to do so, which extends time‑to‑fix for otherwise straightforward hardware issues.
How the Windows Memory Diagnostic actually works
The proactive flow leverages the long‑standing Windows Memory Diagnostic (mdsched.exe). Key technical facts:
- The tool runs in a minimal pre‑boot environment so the full OS and drivers cannot mask hardware faults.
- It offers a few test mixes commonly known as Basic, Standard, and Extended; the proactive flow schedules a short/default pass aimed at speed, not exhaustive coverage.
- Results are logged to the Event Viewer (System log, MemoryDiagnostics‑Results) where technicians can read time stamps, pass/fail status, and brief detail for triage.
That pre‑boot test excel at catching persistent cell failures and some address line issues, but it is not guaranteed to surface intermittent timing, temperature‑dependent, or stress‑only faults that sometimes require prolonged torture tests.
Known limitations and platform exclusions
Microsoft’s initial rollout includes explicit gating for platform and security configurations:
- Not currently supported on ARM64 devices.
- Suppressed on systems with Administrator Protection enabled (a security model that limits persistent elevated privileges).
- Blocked on systems where BitLocker is active but Secure Boot is not enabled, because the diagnostic runs in a pre‑boot environment and interacts with disk encryption/boot policies.
Additionally, the “mitigation” language Microsoft uses is currently vague — community analysts note that diagnostics typically
report bad memory regions and may enable software to avoid allocating those pages, but they do not physically repair hardware; permanent defects generally require module replacement. Until Microsoft clarifies what “mitigate” means in an enterprise‑actionable way, that term should be treated with caution.
What Proactive Memory Diagnostics will likely catch — and what it may miss
The quick pre‑boot pass is useful for catching:
- Persistent cell errors in DIMMs.
- Clear address decode issues.
- Some controller faults that reproduce on a short sweep.
The quick pass is unlikely to catch:
- Intermittent faults that only appear under extended load or thermal stress.
- Timing issues caused by aggressive XMP/EXPO overclocks that require stress testing across many hours.
- Faults that manifest only under a specific workload or driver combination.
In short: treat the proactive prompt as a fast screening tool. If the quick pass is clean but crashes continue, follow up with deeper testing (Extended Windows Memory Diagnostic, MemTest86, overnight stress tests, or vendor‑recommended utilities).
Enterprise and security considerations
This small OS change raises several management and security questions for IT teams:
- Policy controls: Enterprises will expect Group Policy or MDM options to opt devices in/out, suppress prompts on managed builds, or centralize results telemetry. Microsoft hasn’t yet published management controls for the feature in this preview; admins should watch for Group Policy and Intune controls before enabling fleet‑wide acceptance.
- Telemetry and privacy: The early flight intentionally triggers for all bugcheck codes to gather data. IT teams must understand what crash metadata is sent to Microsoft and how that maps to privacy and compliance policies. Expect further documentation as the preview matures.
- Disk encryption and boot security: Because the diagnostic runs pre‑OS, BitLocker and Secure Boot interplay matters — systems that don’t meet the Secure Boot requirement are excluded from the experience. That limits early enterprise uptake on devices with custom boot policies or non‑standard encryption setups.
IT shops should pilot the feature on a small set of devices, monitor prompt accuracy (noise vs. signal), and demand clearer documentation on what constitutes a “mitigation” before updating support playbooks to treat the proactive check as a formal troubleshooting step.
For enthusiasts, builders, and overclockers
PC builders and enthusiasts should pay attention to two practical points:
- XMP/EXPO and manual overclocks are common causes of intermittent memory instability. A quick pre‑boot pass may miss timing‑dependent failures, so if you run XMP/EXPO aggressively, treat a successful quick scan as only a first sign — run Extended tests or MemTest86 under loaded conditions to be sure.
- The proactive test can be a useful early signal for RMA cases: If the diagnostic finds persistent errors, preserve Event Viewer logs and diagnostic timestamps to support warranty claims.
Practical guidance: what to do when you see the prompt
If Windows prompts you to “Schedule a quick memory scan” after a crash, follow this pragmatic sequence:
- Accept the scheduled scan — it’s optional and low friction, and it runs before the next desktop session.
- After the reboot completes, check for the post‑boot notification. If Windows reports issues, open Event Viewer and search the System log for MemoryDiagnostics‑Results entries to capture the diagnostic artifact.
- If the quick pass reports errors, power down and reseat DIMMs, try alternate slots, and re‑run the test. If errors persist, consider replacement or RMA.
- If the quick pass is clean but crashes persist, run a deeper test: select the Extended test in Windows Memory Diagnostic (manually via the tool) or boot a dedicated tool like MemTest86 and run several full passes, preferably under stress or with overnight runs.
- Update motherboard BIOS/UEFI and memory module firmware (if available), and test at stock memory timings before re‑enabling XMP/EXPO to determine whether stability returns.
How to run Windows Memory Diagnostic manually (quick steps)
- Open Start, type Windows Memory Diagnostic, and select the app.
- Choose Restart now and check for problems (recommended) to schedule the pre‑boot test.
- On the blue diagnostic screen you can press F1 (or follow prompts) to select Basic, Standard, or Extended tests. Extended takes much longer but has better coverage.
After reboot, read results in Event Viewer > Windows Logs > System and look for entries from the
MemoryDiagnostics‑Results provider.
Risks, unanswered questions, and what to watch for
- Noise vs. signal: Because the initial rollout triggers on all bugcheck codes, users may receive prompts after crashes that are unlikely to be memory‑related, creating prompt fatigue. Microsoft plans to refine triggers using telemetry, but early participants should expect noise.
- “Mitigation” semantics: It’s currently unclear what automated remediations Microsoft may apply if the diagnostic “mitigates” an issue. Historically, diagnostics identify bad pages and may let the OS avoid them, but hardware replacement remains the ultimate fix. Administrators need clear guidance before treating “mitigated” as resolved.
- Coverage gaps: The quick pass is a reasonable first screen but cannot replace vendor stress tests, channel swap procedures, and extended memory validation on suspect systems.
- Management controls: Enterprises will want declarative controls (Group Policy/MDM) and centralized reporting; the preview lacks those formal management knobs today. Admins should plan pilots rather than broad rollouts.
Verdict — practical, not revolutionary
Proactive Memory Diagnostics is a welcome, pragmatic UX improvement: it makes a sensible, existing diagnostic step discoverable and convenient at the moment it matters most — immediately after a crash. For many home users and small help desks, this will shorten the path to identifying faulty RAM and reduce unnecessary driver/OS rework.
However, it’s not a cure‑all. The feature is intentionally a triage tool, not a replacement for deep testing or vendor diagnostics. Microsoft’s early “all bugcheck” telemetry approach and vague language about mitigations mean the experience will require refinement, clearer documentation, and enterprise controls before it can be treated as a formal troubleshooting step across large fleets. For now, accept the scan when convenient, use Event Viewer to gather artifacts, and follow up with Extended tests or MemTest86 when problems persist.
Final recommendations (for users and IT)
- Home users: Accept the prompt — it’s a fast, low‑cost check. If it finds nothing but crashes continue, run Extended tests or MemTest86.
- Enthusiasts/overclockers: Use the proactive scan as an early triage signal, but rely on longer stress tests to validate stability under XMP/EXPO or manual overclocks.
- IT administrators: Pilot the feature on non‑critical systems, monitor prompt accuracy and telemetry, and withhold fleet‑wide deployment until Microsoft publishes management controls and clarifies mitigation semantics.
Microsoft's staged rollout via
KB5067109 (Build 26220.6982 / 26120.6982) makes this a controlled experiment for now; the feature’s real value will depend on sharper trigger rules, better documentation of remediation behavior, and enterprise management options as the preview progresses.
Proactive Memory Diagnostics is not glamorous, but it targets a persistent pain point with a practical fix: catching RAM faults sooner with less friction. For users and technicians alike, the change is a welcomed nudge toward better hardware triage — provided the community and Microsoft work together to refine triggers and management before wide deployment.
Source: KitGuru
Windows 11 will now proactively ask you to check for RAM issues after a crash - KitGuru