Fix CRITICAL_PROCESS_DIED on Windows 10/11 (Exact Commands)

The fast answer. CRITICAL_PROCESS_DIED (stop code 0x000000EF) means a process Windows can't run without — wininit.exe, csrss.exe, smss.exe, services.exe — crashed or was killed. The usual culprits are corrupted system files, a bad driver (storage and antivirus drivers top the list), or disk errors. If Windows still boots between crashes, run these from an administrator Command Prompt:

dism /online /cleanup-image /restorehealth
sfc /scannow
chkdsk C: /f /r

chkdsk will ask to schedule at the next restart — type Y and reboot. If Windows won't boot at all, do the same repairs from WinRE with the offline commands in Steps 4–5 below.

Why this happens

Corrupted system files — a bad update, unclean shutdown, or disk glitch damaged files a critical process depends on. The most common cause.
Bad or incompatible driver — storage drivers and third-party antivirus drivers are the usual offenders, often right after a driver update.
Recent Windows Update — a cumulative update that didn't install cleanly can take a critical service down with it.
Disk errors or a failing drive — if the disk can't return the pages a critical process needs, the process dies. Repeated crashes with disk noise or slow reads point at hardware.
Failing RAM — less common, but memory corruption kills critical processes at random and no software fix will hold.

Step-by-step fix

Step 1 — If Windows still boots, repair online first

Random crashes but you can reach the desktop? Open Command Prompt as administrator and run, in this order:

dism /online /cleanup-image /restorehealth
sfc /scannow
chkdsk C: /f /r

DISM repairs the component store SFC pulls clean files from, so run it first. Accept the chkdsk reboot prompt with Y and restart. If the crashes stop, you're done. If Windows won't boot at all, continue below.

Step 2 — Get into Windows Recovery (WinRE)

Force three failed boots (power on, then hold the power button to kill it as the Windows logo appears, three times) and Windows opens Automatic Repair. Or boot from a Windows 10/11 install USB and choose Repair your computer. Then go to Troubleshoot → Advanced options.

Step 3 — Try Safe Mode and roll back the bad driver

In Advanced options → Startup Settings → Restart, press 4 for Safe Mode (or 5 with networking). If the machine is stable in Safe Mode, a third-party driver or app is the cause. Open Device Manager, find any device whose driver updated recently (storage controllers and graphics first), right-click → Properties → Driver → Roll Back Driver. Uninstall any recently added antivirus or system utility while you're there. Reboot normally and test.

Step 4 — If it started after an update, uninstall the update

In Advanced options, choose Uninstall Updates → Uninstall latest quality update. This reverses most update-triggered cases without touching your data. Reboot and test before doing anything else.

Step 5 — Repair system files offline

In Advanced options → Command Prompt, run SFC against the offline Windows installation. Drive letters can differ inside WinRE — run diskpart then list volume first to confirm which letter holds Windows, and substitute it for C::

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

If SFC reports it found errors it could not fix, repair the component store from a Windows install USB (here D: is the USB — check its letter the same way):

dism /image:C:\ /cleanup-image /restorehealth /source:wim:D:\sources\install.wim:1 /limitaccess

Then run the SFC command again. If the install USB has install.esd instead of install.wim, swap wim: for esd: in the source path.

Step 6 — Check the disk

Still failing? Repair the file system and map out bad sectors (same drive-letter caveat):

chkdsk C: /f /r

If chkdsk reports a growing list of bad sectors, or the crash count climbs day over day, stop treating this as a software problem — the drive is dying. Image it now and replace it.

Step 7 — Test the RAM and drive hardware

If every software fix holds for a day and then the crashes return, test the hardware. From Windows or Safe Mode, run mdsched.exe (Windows Memory Diagnostic) and let it reboot and scan. Check drive health from PowerShell:

Get-PhysicalDisk

Anything other than Healthy in the HealthStatus column means back up and replace the drive. For a deeper verdict, run the drive vendor's own diagnostic tool. No command fixes failing hardware — don't burn hours reinstalling Windows onto a bad disk.

Data safety: If the files on this machine matter and you don't have a backup, image the drive before you run repairs. CRITICAL_PROCESS_DIED is often a symptom of a failing disk, and chkdsk /r stresses a dying drive hard — it can be the push that takes marginal sectors from readable to gone. Take a full sector image to a known-good external disk first, and never run repairs on the only copy of irreplaceable data.

GRAM tip: CRITICAL_PROCESS_DIED machines usually still reach the desktop between crashes — that's exactly where GRAM works. It's a free portable repair toolkit that runs from a USB inside Windows: its crash-dump analyzer reads the BSOD history, the disk health check catches a dying drive, and the AI agent pinpoints whether a driver, an update, or the hardware is killing the process.

Download GRAM free See AI pricing →

FAQ

Can I fix this without a second working computer?

Yes. You only need to reach Windows Recovery (WinRE), which lives on the broken PC itself — force three failed boots to trigger Automatic Repair, or boot from any Windows install USB. No second computer is required. And if the machine still reaches the desktop between crashes, you can run GRAM there (it's a portable toolkit that runs inside Windows) to analyze the crash dumps and disk health directly.

Will SFC or chkdsk erase my files?

No. sfc replaces only protected Windows system files, not your data. chkdsk /f /r repairs the file system and can occasionally move damaged file fragments to FOUND.000 folders, but it does not wipe the drive. The real risk is running chkdsk /r on a physically failing disk — image the drive first if the data is irreplaceable.

It crashes randomly — how do I find which driver is doing it?

Boot into Safe Mode and use the machine for a while. Stable in Safe Mode means a third-party driver or app is the cause, because Safe Mode loads only Microsoft's core drivers. Then check Event Viewer → Windows Logs → System for BugCheck entries (Event ID 1001) around each crash, and roll back whichever driver updated most recently — storage and antivirus drivers are the usual suspects.

Is CRITICAL_PROCESS_DIED a sign of failing hardware?

Sometimes. If SFC, DISM, and an update rollback don't hold, suspect the disk or RAM. Run chkdsk, check Get-PhysicalDisk HealthStatus, run the Windows Memory Diagnostic, and use the drive vendor's diagnostic for a final verdict. A machine that keeps producing this stop code after clean software repairs almost always has a dying drive or bad memory module.