0x00000050: kernel-mode code referenced invalid memory—often an address that is plainly wrong or points to memory that has already been freed. Faulty drivers, antivirus or other low-level software, storage corruption, newly installed hardware, and defective RAM can all produce that symptom.The important practical point is that the stop-code text does not prove a DIMM has failed. A bad driver can corrupt memory and make the crash resemble a RAM failure; failing RAM can make an otherwise legitimate driver appear guilty. The fastest safe approach is to establish what changed, preserve the evidence Windows already has, and reverse one variable at a time.
If Windows is restarting too quickly to read the code, photograph the screen if possible. Record whether it says PAGE_FAULT_IN_NONPAGED_AREA, whether it includes a driver file name ending in .sys, and what you were doing immediately before it happened. A crash during a game, while waking from sleep, when connecting a USB dock, or shortly after installing a graphics, storage, network, VPN, RGB-control, or security product gives the investigation a useful starting point.
Use Reliability Monitor to find the change point
Open the Run dialog with Windows + R, type perfmon /rel, and press Enter. Microsoft documents /rel as the switch that launches Reliability Monitor on Windows 10 and Windows 11. The graph is useful because it puts application failures, Windows failures, hardware errors, installs, and updates on a calendar rather than scattering them through several Event Viewer logs.
Start with the first day on which the stability line drops or the first red Windows failure appears. Select that date and look for entries such as “Windows stopped working,” “Hardware error,” a failed driver or application installation, or a Windows Update event. Then work backward: did the problem begin immediately after a GPU driver package, a motherboard chipset update, a new peripheral, additional memory, an SSD, a docking station, or an antivirus installation?
Reliability Monitor is a timeline, not a verdict. A crash entry confirms when Windows recorded a failure, but an application failure listed on the same date may merely be collateral damage from the restart. Give greater weight to a repeatable pattern: the same driver installation followed by the first blue screen, or crashes that consistently occur only when a particular USB device, game, virtual-machine product, or network adapter is in use.
For a more detailed record, open Event Viewer and check Windows Logs > System around the exact crash time. Microsoft’s debugging guidance specifically recommends looking there for critical events that may identify the implicated device or driver. A blue-screen restart is commonly logged as Kernel-Power Event ID 41, but that entry says Windows did not shut down cleanly; it does not identify the underlying cause. Look instead for driver, disk, controller, or device errors immediately before it.
Test RAM, but read the result correctly
Windows Memory Diagnostic is the built-in first test for physical memory. Save open work, press Windows + R, enter mdsched, and choose Restart now and check for problems. The PC reboots into the diagnostic environment, runs the test, and then returns to Windows.
Microsoft’s current troubleshooting instructions say the result can be found in Event Viewer if the post-restart notification disappears before you can read it. Navigate to Applications and Services Logs > Microsoft > Windows > MemoryDiagnostics-Results > Debug. Microsoft notes that Event ID 2001 means the diagnostic detected no memory errors.
An error result is actionable: stop pursuing driver theory first and address the physical memory configuration. Shut down fully, disconnect AC power, and—on a laptop where the memory is user-serviceable—follow the manufacturer’s service instructions rather than prying into sealed hardware. Reseat the memory modules, make sure paired modules occupy the motherboard-recommended slots, and test again. If the PC has multiple sticks, test one module at a time in the recommended slot, documenting which module and slot were used for each test. Do not swap parts while the computer is powered or merely asleep.
A clean Windows Memory Diagnostic run is valuable, but it does not conclusively clear RAM. The built-in test runs for a finite period and an intermittent fault may only show under a particular temperature, memory load, EXPO/XMP profile, or module combination. Treat “no errors” as evidence that supports moving to drivers and recent changes—not as grounds to ignore a repeatable crash after adding RAM or enabling an overclocked memory profile.
If this blue screen started after installing or upgrading memory, return the machine to its last known-good configuration before changing Windows settings. Remove the newly added module, or temporarily disable XMP/EXPO or other memory overclocking in firmware if it was newly enabled. A stable result in the old configuration narrows the fault to the new memory, its settings, or compatibility with the motherboard’s firmware. For a business laptop or prebuilt desktop, use the manufacturer’s diagnostics before opening the chassis; service policies and captive hardware designs differ.
Roll back the driver that changed
If the first crashes line up with a driver update, use Device Manager’s rollback function before downloading a random “driver updater.” Microsoft’s support guidance says rollback is specifically intended for problems that begin after a recent driver update, including those delivered through Windows Update.
Right-click Start and choose Device Manager. Expand the category that matches the recent change—Display adapters for graphics, Network adapters for Wi-Fi or Ethernet, Storage controllers for storage drivers, Sound, video and game controllers for audio, or Universal Serial Bus controllers for docks and accessories. Right-click the device, select Properties, open the Driver tab, and choose Roll Back Driver. You need an administrator account, and the option is unavailable when Windows has no prior driver package stored locally.
Restart after the rollback and use the PC normally enough to recreate the old conditions. If the blue screen stops, keep the older driver until the PC maker or component vendor publishes a newer package that explicitly supports the installed version of Windows. Do not assume that the driver returned by Device Manager’s automatic search is newer than the manufacturer’s current release; Microsoft’s own guidance directs users to the device maker when Windows Update does not resolve the problem.
If the Roll Back button is unavailable, update only the device that has evidence against it. In Device Manager, look for yellow exclamation points and inspect the device status in Properties. Update first through Windows Update, including optional driver updates where appropriate, then use the PC manufacturer’s support package for laptops and prebuilt desktops. For a self-built system, prefer the motherboard vendor for chipset, storage, Wi-Fi, Bluetooth, and LAN drivers; use NVIDIA, AMD, or Intel only for the discrete graphics driver when that is the component under investigation.
Avoid updating every driver in one session. Bulk updates remove the ability to tell which change helped or hurt, and third-party update utilities can substitute generic packages for OEM-tuned drivers. Make one change, restart, and check Reliability Monitor again after enough use to make the previous failure pattern meaningful.
Remove recent hardware before reinstalling Windows
Microsoft’s stop-error guidance puts newly added hardware near the top of its own triage list: power down, remove the new hardware, and try again. This is the right next move if PAGE_FAULT_IN_NONPAGED_AREA began after an SSD, RAM kit, PCIe card, USB hub, capture device, dock, external drive, or even a new display adapter entered the setup.
Disconnect nonessential peripherals first: external storage, docks, hubs, controllers, webcams, printers, and USB audio devices. Leave only the keyboard, mouse, display, and boot drive connected. If the crashes stop, reconnect one device at a time across normal work sessions. This is slower than changing five settings at once, but it creates evidence rather than guesses.
For internal hardware, revert to the known-good configuration. Check that power and data cables are secure, PCIe cards are seated correctly, and new devices have the firmware and driver package recommended by their manufacturer. If the error coincides with storage trouble, Microsoft’s bug-check documentation also flags a corrupted NTFS volume as a possible cause. Back up important files before running repair operations, especially if Event Viewer contains disk or controller errors; a blue screen paired with storage warnings is a data-protection problem before it is a tuning project.
If Windows cannot remain running long enough to complete these steps, enter Safe Mode. From the sign-in screen, hold Shift while selecting Restart, then choose Troubleshoot > Advanced options > Startup Settings > Restart and select Safe Mode with Networking. Microsoft notes that Safe Mode starts Windows with a reduced driver set, making it a useful environment for rolling back or uninstalling the suspect driver. You will need an account password rather than a PIN or biometric sign-in in many Safe Mode configurations.
Preserve a dump for the case that survives basic fixes
When the same blue screen persists after the recent hardware and driver changes have been reversed, stop reinstalling drivers at random and preserve the crash evidence. Microsoft’s Windows debugging documentation says a small memory dump includes the stop message, parameters, loaded-driver list, processor context, and kernel-mode call stack. Those files are ordinarily stored in %SystemRoot%\Minidump.
Search for Advanced system settings, open Startup and Recovery > Settings, and make sure Windows is configured to write an Automatic memory dump or Small memory dump. Microsoft warns that a paging file on the boot volume is required for dump creation; an aggressively disabled page file can leave you with no useful record after the next crash.
A dump can identify the faulting module, but treat names carefully. ntoskrnl.exe commonly appears because it is the Windows kernel handling the failure, not because replacing Windows kernel files is the remedy. A recurring third-party .sys driver, a driver tied to a recently changed device, or a dump that points repeatedly to storage, network, graphics, or security software is the evidence that should drive the next removal, rollback, or vendor support case.
For Windows 10 machines, there is an additional maintenance reality: Microsoft ended normal free security updates and technical support for Windows 10 on October 14, 2025. A PC that is stable only on an old, vulnerable driver should not be left in that state indefinitely. The immediate goal is to stop the PAGE_FAULT crashes; the durable outcome is a supported Windows version and a driver set supplied for the actual hardware configuration.