Fix SYSTEM_SERVICE_EXCEPTION BSOD On Windows 11/10 (Step-by-Step With WinDbg)

The SYSTEM_SERVICE_EXCEPTION blue screen (stop code 0x0000003B) is a common Windows 11/10 BSOD that appears when a system service running in kernel mode throws an unexpected exception. You might see messages like “Your device ran into a problem and needs to restart” along with SYSTEM_SERVICE_EXCEPTION, sometimes referencing files like win32kfull.sys, ntfs.sys, dxgmms2.sys, tcpip.sys, or a third-party driver.

This guide goes beyond generic advice. You’ll get a structured, step-by-step troubleshooting plan—from quick health checks and Safe Mode, to minidump analysis using WinDbg, Driver Verifier, and advanced diagnostics—so you can pinpoint the exact cause and fix the SYSTEM_SERVICE_EXCEPTION BSOD on Windows 11 or Windows 10.

Contents show

Understanding the Error

What the stop code means (in plain language)

SYSTEM_SERVICE_EXCEPTION (0x3B) indicates that while executing a system call in kernel mode, Windows hit an exception it couldn’t safely handle. This usually means a kernel-mode driver or system component accessed invalid memory, performed an illegal operation, or was corrupted by bad RAM or disk errors. Windows bugcheck 0x3B has parameters that identify the exception code and the address where it occurred. In WinDbg, these details help you find the failing driver or module.

Typical scenarios that trigger it

Installing a new device or driver (graphics, storage, network, antivirus)
Heavy GPU tasks (gaming, video rendering) or sleep/hibernate transitions
Windows Update or optional driver updates
Corrupted system files or disk corruption
Unstable RAM (XMP profiles) or BIOS/UEFI misconfigurations
Malware or third-party security software filter drivers interfering with kernel operations

Common Causes

Most likely culprits for SYSTEM_SERVICE_EXCEPTION on Windows 11/10:

Faulty/old drivers (especially display, storage, USB, network)
Defective or overclocked RAM; unstable XMP
Disk/SSD corruption or failing media
Corrupted Windows system files or servicing stack
Problematic Windows Update or optional driver update
Third-party antivirus/firewall/VPN filter drivers
BIOS/UEFI bugs; outdated chipset/firmware
Overclocking (CPU/GPU/RAM) or aggressive power/PCIe ASPM settings
Malware/rootkits

Symptoms and hints

win32kfull.sys, dxgmms2.sys, or ntfs.sys in the crash often points to graphics or filesystem issues—but the true cause can still be a third-party driver corrupting memory.
Crashes during gaming or video playback: look at GPU drivers.
Crashes during file copies/backups: check storage drivers, disk health, and RAM.
Crashes after a recent update: consider rolling back the update or driver.

Preliminary Checks

Boot to Safe Mode (if you’re stuck in a crash loop)

Method A (from Windows)

Settings > System > Recovery > Advanced startup > Restart now Troubleshoot > Advanced options > Startup Settings > Restart Press 4 (Safe Mode) or 5 (Safe Mode with Networking).

Hold Shift and select Power > Restart. Troubleshoot > Advanced options > Startup Settings > Restart Press 4 or 5.

Method C (if Windows won’t load)

Interrupt boot 3 times to trigger Windows Recovery Environment (WinRE), then follow the path above.

Back up important data

Use File History, OneDrive, or copy files to an external drive while in Safe Mode. If Windows won’t boot, use WinRE > Troubleshoot > Advanced options > Command Prompt, then copy essential files to another drive.

Run basic health checks

Open an elevated Command Prompt (Administrator) and run:

:: Check disk integrity (online scan)
chkdsk C: /scan

:: System File Checker
sfc /scannow

:: Repair Windows component store
dism /online /cleanup-image /restorehealth

If Windows won’t boot, use offline servicing (replace letters as appropriate):

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
dism /image:C:\ /cleanup-image /restorehealth

If these commands report and fix errors, reboot and test for stability.

Step-by-Step Troubleshooting

Follow these steps in order—from easiest to most advanced.

Undo recent changes

Uninstall recently installed apps/drivers.
Roll back device drivers in Device Manager (devmgmt.msc > device > Properties > Driver > Roll Back).
If the BSOD started after a Windows Update: Settings > Windows Update > Update history > Uninstall updates. Or uninstall a specific KB from elevated Command Prompt:
```
wusa /uninstall /kb:XXXXXXX /quiet /norestart
```

Update or reinstall key drivers

Graphics: Get the latest stable driver directly from NVIDIA/AMD/Intel. If you suspect driver corruption, use Display Driver Uninstaller (DDU) in Safe Mode, then clean install.
Chipset, storage, LAN/Wi-Fi, Bluetooth, USB: Download from your PC/motherboard vendor’s support page. Avoid relying solely on generic Windows drivers.
Avoid Beta drivers unless necessary; prioritize WHQL-certified releases.

Remove or disable third-party antivirus/firewall/VPN temporarily

Security suites install kernel drivers and can cause SYSTEM_SERVICE_EXCEPTION. Uninstall with the vendor’s cleanup tool if available, then reboot and test. Windows Security (Defender) will auto-activate.

Toggle Memory Integrity (Core Isolation) and Fast Startup (for testing)

Memory Integrity: Windows Security > Device security > Core isolation details > Memory integrity. Turn off for testing if you recently enabled it; incompatible drivers can crash. Turn back on once drivers are updated.
Fast Startup: Control Panel > Power Options > Choose what the power buttons do > Change settings that are currently unavailable > uncheck Turn on fast startup.

BIOS/UEFI sanity check

Load Optimized Defaults to remove risky overclocks or tightened memory timings.
Disable XMP (temporarily). If stability returns, your RAM profile may be too aggressive.
Update BIOS/UEFI only if your vendor’s release notes mention stability/fixes relevant to crashes.

Run Windows Memory Diagnostic, then consider MemTest86

Press Win+R, type mdsched.exe, choose Restart now and check for problems.
If issues persist, run MemTest86 (USB boot) for several passes. Any errors indicate RAM or controller issues; test sticks one at a time and in different slots.

Check storage health and file system

Quick SMART check (PowerShell as Admin):

Get-PhysicalDisk | Get-StorageReliabilityCounter | ft FriendlyName, Wear, ReadErrorsTotal, WriteErrorsTotal, Temperature

If SMART shows problems or chkdsk reports bad sectors, back up immediately and replace the drive.

System Restore or known-good restore point

WinRE > Troubleshoot > Advanced options > System Restore > choose a restore point from before the crashes started.
From Windows: Control Panel > Recovery > Open System Restore.

Minidump analysis (WinDbg or BlueScreenView)

If the error persists, analyze crash dumps to identify the culprit.

A) Ensure minidumps are enabled

Win+R > sysdm.cpl > Advanced tab > Startup and Recovery Settings:

Write debugging information: Small memory dump (256 KB)
Dump file: %SystemRoot%\Minidump Ensure the Minidump folder exists (C:\Windows\Minidump).

B) Locate dump files

C:\Windows\Minidump*.dmp (small dumps)
C:\Windows\MEMORY.DMP (if configured; large)

C) Quick read with BlueScreenView (NirSoft)

Install and open BlueScreenView.
It lists “Bug Check String”, “Bug Check Code”, and “Caused By Driver”.
Note the “Caused By Driver” and stack items. This is a hint, not proof—ntoskrnl.exe is often listed but rarely the true cause.

D) Deep analysis with WinDbg (recommended)

Install WinDbg (Preview) from Microsoft Store.
Launch WinDbg (Preview) > File > Open dump file > select latest .dmp.
Set symbol path to Microsoft’s public symbols:
```
.symfix
.reload
```
Run analysis:
```
!analyze -v
```
Interpret results:
- Look for “BugCheck 3B” and the “Probably caused by” line.
- Note MODULE_NAME and IMAGE_NAME fields.
- If a third-party driver is named, check its timestamp with:
```
lmvm drivername
```

Useful commands: kv (stack trace with parameters), .ecxr (switch to context record), r (registers), !thread, !irp (I/O packets) Persistent symbol path (example): File > Settings > Debugging > Symbols: srv*C:\Symbols*https://msdl.microsoft.com/download/symbols then reopen the dump and run .reload.

Action based on findings

If a specific third-party driver is flagged (e.g., nvlddmkm.sys, rt640x64.sys, aswMonFlt.sys), update, roll back, or uninstall that software/driver.
If a Windows component (e.g., win32kfull.sys) is named, suspect a lower-level driver corrupting memory, unstable RAM, or disk corruption. Proceed to Driver Verifier and memory/storage tests.

Driver Verifier (advanced; use with caution)

Driver Verifier stresses non-Microsoft drivers to provoke failures and catch bad behavior. It can cause additional BSODs by design.

Prepare

Create a restore point.
Ensure dumps are configured.
Back up critical data.

Enable Driver Verifier for non-Microsoft drivers

verifier /standard /all

Or selectively: Run verifier, choose Create standard settings > Next, then Automatically select unsigned drivers OR Select driver names from a list and check non-Microsoft drivers. Finish and reboot. Use the system normally until it blue screens; analyze the new dump.

Turn off Driver Verifier when done

verifier /reset

If you get into a boot loop

Boot into Safe Mode and run verifier /reset, or from WinRE > Command Prompt:

reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v VerifyDrivers /t REG_SZ /d "" /f
reg add "HKLM\System\CurrentControlSet\Control\Session Manager\Memory Management" /v VerifyDriverLevel /t REG_DWORD /d 0 /f

Clean boot to isolate software conflicts

msconfig > Services tab > Hide all Microsoft services > Disable all. Startup tab > Open Task Manager > Disable all startup apps. Reboot and test. If stable, re-enable services/startups in batches to find the culprit.

Update BIOS/UEFI and firmware (carefully)

Check your PC/motherboard support site for BIOS updates that mention stability, memory compatibility, or microcode fixes.
Update SSD firmware if release notes mention stability or power-state fixes.

In-place repair upgrade (keeps files and apps)

Download the latest Windows 11/10 ISO from Microsoft.
Run setup.exe from within Windows.
Choose Keep personal files and apps. This refreshes Windows system files and components without wiping data.

Reset this PC (last resort)

Settings > System > Recovery > Reset this PC. Choose Keep my files (removes apps and drivers) or Remove everything (factory reset). Ensure you have backups first.

Advanced Diagnostics

Use Event Viewer to correlate crashes

Event Viewer > Windows Logs > System: Look for Event ID 1001 (BugCheck) and 41 (Kernel-Power). Note the time and any warnings/errors immediately before the crash (disk, driver timeouts, etc.).

Audit device drivers and versions

Device Manager > View > Devices by driver to spot third-party drivers. Check C:\Windows\System32\drivers for third-party .sys files with old timestamps.

Stress/target suspect areas

GPU: Run a stable game or 3D benchmark; watch for crashes/TDRs.
Storage: Copy large files; monitor Event Viewer for disk/NTFS errors.
Network: Disable VPNs/security suites; test with built-in drivers.

Check power/thermal issues

Ensure adequate cooling and stable power. Overheating can lead to erratic driver behavior and exceptions. Return CPU/GPU to stock clocks and voltages.

Full memory dump for elusive issues

System Properties > Advanced > Startup and Recovery Settings: Write debugging information: Kernel memory dump or Complete memory dump (requires page file on system drive). After next crash, analyze C:\Windows\MEMORY.DMP with WinDbg for more context.

When to Seek Professional Help

Persistent memory errors in MemTest86: Replace RAM; if errors persist with known-good RAM, motherboard could be faulty.
SMART attributes or repeated chkdsk errors: Replace the storage device.
Corrosion, liquid damage, bent CPU pins, power instability: Consult a technician.
BSODs continue after clean Windows install with only essential drivers: likely hardware fault.

Prevention Tips

Keep drivers current—prefer stable, WHQL-certified versions from the vendor site.
Create regular restore points and system images before major updates.
Avoid aggressive overclocks; validate XMP profiles with stress tests.
Let Windows Update install security and cumulative fixes; defer optional drivers unless needed.
Use one reputable security suite or Windows Security; avoid stacking multiple AV/VPN/filter drivers.
Periodically run sfc /scannow and dism /online /cleanup-image /restorehealth.
Back up important files (File History, OneDrive, or periodic disk images).

Conclusion

SYSTEM_SERVICE_EXCEPTION (stop code 0x3B) looks intimidating, but most cases are fixable with a methodical approach. Start with Safe Mode and basic health checks, update or roll back drivers, and remove problematic software. If the issue persists, analyze minidumps with WinDbg, use Driver Verifier to catch misbehaving drivers, validate RAM and storage health, and consider BIOS/firmware updates. In stubborn cases, an in-place repair or a clean reset can restore stability. With steady, step-by-step troubleshooting, you can eliminate this BSOD and get your Windows 11/10 system back to reliable operation.

FAQ

Can I ignore the SYSTEM_SERVICE_EXCEPTION BSOD?

No. While you may temporarily continue after a reboot, the underlying cause—often a faulty driver, RAM instability, or disk corruption—can lead to data loss or more frequent crashes. Investigate and fix it.

Does SYSTEM_SERVICE_EXCEPTION mean my hardware is failing?

Not necessarily. Many cases are driver-related. However, if you see memory/disk errors, SMART warnings, or crashes persist through a clean Windows install, hardware (RAM, storage, motherboard, GPU) becomes more likely.

WinDbg says “Probably caused by: ntoskrnl.exe.” Is Windows itself broken?

Not usually. ntoskrnl.exe often appears because it’s the Windows kernel managing everything—it’s rarely the root cause. Look deeper into the call stack, loaded modules, and use Driver Verifier to identify the specific third-party driver responsible.

Is Driver Verifier safe?

Yes, but it’s a diagnostic tool that intentionally stresses drivers and can trigger additional BSODs. Enable it only temporarily, target non-Microsoft drivers, ensure minidumps are enabled, and disable it after capturing useful crash data (verifier /reset).

Should I update BIOS/UEFI to fix this BSOD?

Only if your vendor notes stability or compatibility fixes relevant to your issue, or after you’ve ruled out drivers and OS corruption. Flashing BIOS has risk—follow the vendor’s instructions carefully and avoid power loss during the update.

Useful Commands (copy/paste)

Quick health

sfc /scannow
dism /online /cleanup-image /restorehealth
chkdsk C: /scan

Offline repair (WinRE Command Prompt)

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
dism /image:C:\ /cleanup-image /restorehealth

Driver Verifier

verifier /standard /all
verifier /reset

Set symbol path in WinDbg

.symfix
.reload

You’ve got this—most SYSTEM_SERVICE_EXCEPTION BSODs are solvable with careful, structured troubleshooting. If you get stuck, capture a fresh minidump, note any driver names in the analysis, and proceed step by step.