[QUICK SOLUTION] How to Find Out the Cause of BSODs Using the Event Viewer

Blue Screen of Death (BSOD) issues are scary Windows errors that can make even professional PC technicians panic. They primarily point to hardware glitches that the operating system can’t resolve by itself. However, software problems, such as a device driver or system file corruption, could also be responsible.

BSODs are fairly common in Windows 10 PCs. While some happen due to minor issues, others signal serious underlying problems.

Troubleshooting these kinds of errors can be complicated, especially when you don’t know the cause. But don’t worry!

In this article, we’ll be showing you how to use the Event Viewer to find out the reason behind a BSOD.

How to Find Blue Screen Error Logs on Windows 10

Follow these steps:

• Click on the magnifying glass in the taskbar to open the search box. You can also press Windows + S to summon the search function.
• Once the search box opens, type Event Viewer and click on the first search result.

• Once the Event Viewer opens, go to the left pane and expand Windows Logs.
• Under Windows Logs, click on System.

• Go to the right-hand side of the window and click on Create Custom View under System.
• Once the Create Custom View window appears, stay in the Filter tab.
• Go to the Logged drop-down menu and select Custom Range.

• Next, choose the date and time range the BSOD occurred once the Custom Range dialog shows up.
• Click OK in the Custom Range dialog box.

• Go to Event Level in the Create Custom View dialog window and check the boxes for Critical, Warning, and Error.

• Click on OK, enter a name for the Custom View you just created, and then click on OK again.

• In the main Event Viewer window, you’ll now see the list of Warning, Critical, and Error events that occurred in the time range you selected.
• Double-click an event log and refer to the Details tab to check the details of that event.

If you don’t understand the description of the Event ID, Google it, and you’ll find help with what to do.

Also Read: Windows Stop Code: How to Check Causes of Windows BSOD?

What if Your System Is Always Restarting?

Some blue screen errors will throw your PC into an infinite loop of reboots. Your best course of action in this scenario is to check the Event Viewer in Safe Mode.

You have two ways to get into Safe Mode:

1. Go through the automatic repair environment

This method involves tricking your computer into believing that something has gone wrong with the boot process to trigger the automatic repair feature.

BSODs typically don’t affect the early boot process. So, Windows will likely not realize that anything is wrong until it’s time to load your startup applications.

Follow these steps to enter the Windows recovery environment:

• Press and hold your power button to force your PC to shut down.
• Turn on the computer and force it to shut down again after your system’s manufacturer logo shows up.
• Repeat Step 2 twice, and you’ll see the Please wait message. If you don’t see the message, repeat the steps. If nothing happens, skip to the next guide to use bootable media.
• When you see the Automatic Repair screen, click on the Advanced Options button.
• On the Choose an Option screen, click on Troubleshoot.
• Now, click on Advanced Options under Troubleshoot, and then click on Startup Settings once the Advanced Options screen opens.
• Click the Restart button on the Startup Settings screen, and when your system reboots to the Startup Options page, hit the number beside Safe Mode or Safe Mode with Networking (if you want to use the Internet).
• Once your PC boots into Safe Mode, open the Event Viewer to check for the cause of the BSOD.

Also Read: [FIXED] How to fix the Inaccessible Boot Device Error in Windows 10?

2. Use bootable media

Even the automatic repair feature can be broken. In such a case, you’ll have to use bootable media.

Bootable media allows you to load the Windows installation and repair environment even if your system isn’t booting. It could be a USB flash drive or DVD. If you don’t have a Windows 10 DVD, you can use another computer to create bootable media.

You can use a third-party tool, Rufus, or Microsoft’s Media Creation tool. We’ll show you how to use both programs.

Also Read: [FIXED] How to Fix “Windows 10 Won’t Boot” Problem Easily

Creating a Bootable Windows 10 USB Using Rufus

Rufus is a free third-party program for creating bootable media. All you need is your USB flash drive and the latest ISO image file of Windows 10, which you can download from Microsoft’s website.

Before you use any program, make sure you have downloaded your ISO file from Microsoft’s site.

Follow these steps:

• Download Rufus from the Internet.
• Right-click on the Rufus.exe file and run it as an administrator. The application will automatically detect the drive that is connected to your computer.
• Make sure the name of your USB flash drive is displayed under the Device drop-down.
• Choose Disk or ISO image from the Boot selection drop-down and then click on the Select button.
• Navigate to the directory where your ISO file is located, click on the file, and then click on the Open button.
• Next, choose MBR from the Partition scheme drop-down, then select BIOS or UEFI under the Target system.
• Now, under Advanced Drive Properties, check the box associated with Add fixes for old BIOSes.
• Go to the Advanced Format Options in the Format Options segment and tick the Quick Format and Create extended label and icon files checkboxes.
• Click on the Start button and follow the progress bar under Status.
• The progress bar will show a ready message once the process is complete.

Using the Windows Media Creation Tool

Follow these steps to create the bootable media using the Media Creation tool:

• Head to Microsoft’s website and download the Media Creation Tool.
• Run it on your computer.
• Select the Create installation media for another PC radio button when the Windows 10 Setup window opens, and then click Next.
• On the next page, choose your language, Windows 10 edition (Home, Pro, or Enterprise), and operating system architecture (64 Bit or 32 Bit).
• Select the USB flash drive option under Choose which media to use, and then click Next.
• Allow the tool to complete the process.

After creating the bootable USB, insert it into your system and reboot. Make sure you change your boot order accordingly. Once your computer comes up, press any key if you’re prompted. When the Windows setup screen appears, click on Repair Your Computer in the lower-left corner.

The “Choose an option” screen should now open. Click on Troubleshoot. Once the Troubleshoot screen appears, click on the Advanced Options tile.

Now, click on Startup settings once the Advanced Options screen opens. Click on Restart. After your computer boots into the Startup Options screen, tap the number beside Safe Mode and wait for your PC to reboot into Safe Mode.

You can now use the Event Viewer in Safe Mode to check for the cause of the BSOD.

Also Read: How to Get And Use Windows 10 Media Creation Tool

Other Ways to Check the Causes of Blue Screen Errors

The Event Viewer isn’t the only program that logs the reasons why your system crashes. You can also use the Reliability Monitor and read a dump file.

1. Using the reliability monitor

The Windows Reliability Monitor is an application that tracks software issues and keeps a detailed log of events, especially when a crash occurs. The interface is user-friendly and works quite well on Windows 10.

There are different ways to open the Windows Reliability Monitor.

• To open the program via the Control Panel, launch Control Panel, then click on System and Security.

• Click on Review your computer’s status and resolve issues under Security and Maintenance.

• On the next page, expand the Maintenance section and click on View Reliability History.

The Reliability Monitor arranges its findings by days. You can change the log to preview events by weeks, but we recommend that you go for days. The dates in the right column are the most recent. A red circle X mark indicates a system failure that led to a crash.

Click on the day’s column where the red mark is, then check the Reliability Details section to get an overview of what happened. Double-click an event to find out more about it.

Normally, there’ll be a link at the bottom of the main Reliability Monitor window describing “Check for solutions to all problems.” While you can try it out, don’t get your hopes up, as the feature doesn’t always help.

Also Read: How to View Reliability History on Windows 10?

2. Reading a dump file

Windows traditionally creates a dump file in the system memory that displays applications that were running before the crash occurred. The information you find here could help you troubleshoot the blue screen, especially if a program is triggering it.

There are two main ways to analyze the dump file: using the Windows Driver kit and using a third-party, free-to-use program. We’ll cover both methods.

Using the Windows drivers kit to analyze the dump file

The Windows Driver Kit, or WDK for short, is a toolset used to develop, debug, test, and deploy Windows drivers. One of its debugging functions is reading dump files where driver errors can be discovered.

The kit was primarily designed for developers who create drivers for system devices. However, you can use it to check for causes of Blue Screen errors.

Here’s a step-by-step guide on how to use the Windows Driver Kit:

Installing the Windows Driver Kit

• Go to Microsoft’s website and download the Windows Driver Kit for your operating system. It’s a large ISO file that you must extract.
• Once you’ve downloaded the kit, open the ISO file using File Explorer. You can choose to burn it to a DVD if you wish.
• Navigate to the Debuggers folder to install the debugging tool first. Make sure you download the right one for your system. Choose setup_amd64.exe if you use a 64-bit operating system and setup_x86.exe if your OS is 32-bit.
• Next, run the wdksetup.exe file.
• After the installation is complete, go to the Start menu and search for Command Prompt. Once the program appears in the results, right-click it and select Run as Administrator. Click on Yes in the User Account Control pop-up.
• When the Command Prompt opens, type C:\Program Files (x86)\Windows Kits\10\Debuggers\x86 and hit the Enter key to switch to the WDK folder.
• After that, type windbg.exe -IA”and hit Enter. Then, click on OK in the prompt that shows up. Windows debugger will now open DMP (dump) files automatically.

Setting the symbol path in Windows Debugger

• Go to the Start menu and search for windbg. Click on WinDbg in the search results to open Windows Debugger.
• Once the Windows Debugger window shows up, go to the upper-left corner and click on Symbol File Path… .
• Type SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols into the Symbol Path box and click on OK.

Reading the dump file

• Right-click on the Start button and select Run.
• Type %systemroot% into the text box of the Run dialog box and hit the Enter keyboard button.
• Once the folder opens, go to the View tab at the top of the window and check the Hidden items checkbox.
• You can also open the dump file by going to C:\Windows\Minidump. Another way to open it is to click on File in WinDbg and click on Open Dump Files.

Once Windows Debugger opens the file, you should see a list of programs that were running before the blue screen struck.

3. Using the BlueScreenView utility

BlueScreenView is a third-party program that is free to use. Its sole purpose is to find the causes of blue screen errors by displaying the content of dump files. It will show you a list of programs that were running before the Blue Screen error occurred.

The steps below will show you how to use it

• Go to the taskbar and click on the magnifying glass to open the search function.
• Type view advanced system settings into the search box.
• Click on the first result.
• Once the System Properties dialog window opens in the Advanced tab, go to the Startup and Recovery section, and click on Settings.
• After the Startup and Recovery dialog window opens, go to the Write debugging information drop-down menu and select Small Memory Dump.
• Click on OK. This allows lightweight programs such as BlueScreenView to read dump files in the future.
• Now, download BlueScreenView and install it.
• Once the installation is complete, ensure that the Run NirSoft BlueScreenView checkbox is selected.
• You should be able to see your dump file in the upper section of the window. The details of each file will appear in the lower half of the window. You’ll find all the applications that were running before the crash occurred.

How to View BSOD Error Log in Event Viewer on Windows 11?

Now that you know how to get access to your BSOD error logs on Windows 10, you may be wondering how to do the same on Windows 11. After all, the new OS comes with a number of upgrades and changes.

For instance, Windows 11 comes with new Designs for the Start Menu and Taskbar. As with most Windows upgrades, you also have fixes for some of the most commonly reported bugs, therefore, a generally smoother performance.

However, when it comes to viewing BSOD error logs, the steps you will need to take on Windows 11 are not essentially different from what you need to do on Windows 10.

But let’s recap and see how to see the event viewer logs in Windows 11 using Event Viewer:

• First, use the Win + S key combo on your PC to bring up the search feature.
• Run a search for event viewer and select the first result.
• In the Event Viewer, navigate to the left pane and go to Windows Logs.
• Once here, click System.
• Next, go to the right side of the window and select Create Custom View (you will find this option under System).
• Here you will see the Create Custom View option. Make sure to stay in the Filter tab.
• Next, head to the Logged drop-down menu and click Custom Range.
• Select the date and time range for which you want to see your BSOD logs.
• When ready, press the OK button in the Custom Range dialog box.
• In the Create Custom View dialog, head to Event Level. Make sure to check the voices for the following options: Critical, Warning, and Error.
• Click OK.
• Type in the name for the Custom View you’ve just made.
• Click OK.
• Next, go back to the Event Viewer main window.
• Here, you will see a full list of events that occurred during the period you’ve specified. They will be categorized in Warning, Critical, and Error events.
• Double-click the event log and go to the Details tab to see more information about a specific event.

However, just like with Windows 10, in some cases, blue screen errors can throw your computer into a loop of reboots, which will prevent you from using the steps above.

If this happens, the best thing to do would be to try to access the Event Viewer in Safe Mode.

To take your Windows 11 PC into Safe Mode, you can use Bootable Media or go via Automatic Repair Environment.

Blue screen errors generally don’t affect the early boot process — and the methods above will “trick” your computer into launching the automatic repair feature.

To get to the recovery screen, go through the following steps:

• First, force shut down your PC.
• Turn your PC back on and then force shut it down three more times.
• You will then see the “Please wait” message.
• On the Automatic Repair screen, go to Advanced Options.
• Navigate to Troubleshoot.
• Under Troubleshoot, go to Advanced Options and then Startup Settings.
• Press the Restart button.
• Your system will now reboot to the Startup Options page.
• Select Safe Mode and go to the Event Viewer to check the error logs for the blue screen errors.

Also Read: Computer Keeps Restarting: How to Fix?

Once you know what has caused BSOD errors on your Windows 11 PC, you can try different solutions to resolve these problems.

Conclusion

One way to prevent BSODs is to keep malicious programs out of your system. To do that, get an effective security application such as Auslogics Anti-Malware. The tool’s great feature is that it can be used alongside your main antivirus program and even Windows Security.

Hopefully, you won’t have to refer to this article in the future. Let us know what you think about BSODs in the comments section below. You’re also welcome to ask us questions.

FAQ