PAGE_FAULT_IN_NONPAGED_AREA blue screen in Windows 11: how to fix it

Applies to: Windows 11 (and Windows 10) PCs that restart with the PAGE_FAULT_IN_NONPAGED_AREA stop code, at random, during startup, or soon after a new driver, security product or Windows update. If you only saw a sad face and a QR code, our guide on finding the stop code after a crash shows where Windows records it.

What PAGE_FAULT_IN_NONPAGED_AREA means

Windows splits the memory used by its kernel and drivers into two pools. Paged memory can be moved out to the paging file on disk when RAM runs short. Nonpaged memory must stay in RAM at all times, because the code that uses it may run when Windows can’t stop to read from the disk. When kernel code reaches for an address it expects to be resident and finds nothing valid there, Windows can’t recover safely, so it halts.

Microsoft’s bug check 0x50 reference says that invalid system memory was referenced, usually because the address is wrong or points to memory that has already been freed. In practice that’s almost always a bug in a driver: it kept using a buffer after releasing it, or followed a pointer that was never set. Less often the address itself was damaged by faulty RAM.

The same page names the usual causes: a faulty system service or driver, antivirus software, a corrupted NTFS volume, and new or failing hardware, “usually related to defective RAM.” Microsoft’s advanced stop code troubleshooting article adds that about 70% of all stop errors come from third-party driver code and about 10% from hardware, which is why this guide puts drivers and security software first.

Despite the name, the paging file is rarely the cause. The stop code describes the kind of memory involved, not a broken paging file, though a paging file switched off by a tweak is still worth restoring (Fix 5).

What the four numbers mean

Each crash records four parameters. Microsoft’s table defines them: parameter 1 is the memory address that was referenced, parameter 2 says whether the access was a read, a write or an attempt to run code, parameter 3 is the address of the instruction that made the access (if known), and parameter 4 is the type of fault. Parameter 3 is the useful one for most people, because a debugger can turn it into a driver name.

Match your situation

What you see	Likely cause	Start with
The blue screen, Event Viewer or a dump names a .sys file	That driver	Fix 1, Fix 3
Crashes began after installing antivirus, a VPN, backup or disk encryption software	A filter driver from that product	Fix 4
Crashes began after a driver, new hardware or a Windows update	The new driver or device	Fix 2, Fix 3
The paging file was turned off or set very small	Low commit limit; no room for a crash dump	Fix 5
Disk errors in Event Viewer, or the drive is old or slow	Corrupted NTFS volume or failing drive	Fix 6
Different stop codes each time, or crashes under load with XMP/EXPO on	RAM or memory settings	Fix 7
Windows crashes before or right after sign-in	A driver or service that loads at startup	The section below

If Windows crashes before you can sign in

A boot loop is common with this stop code, because the faulty driver often loads during startup. Safe Mode loads only basic drivers, so it usually keeps a third-party driver or security filter out of the way long enough to remove it.

1. After two failed starts in a row, Windows normally opens the blue Choose an option screen. From the sign-in screen, you can also hold Shift while selecting Power and then Restart.
2. Select Troubleshoot > Advanced options > Startup Settings, then Restart.
3. Press 4 for Safe Mode, or 5 for Safe Mode with Networking if you need to download a driver or a removal tool.

If the recovery screen doesn’t appear, see our WinRE guide on opening recovery when Windows won’t start. If Windows crashes even in Safe Mode, a basic driver, the drive or the RAM is more likely than an add-on, so jump to Fix 6, Fix 7 or System Restore in Fix 9.

Fix 1: Find the file named in the crash

Microsoft’s bug check page starts here: look at the driver name if one was shown on the blue screen, and check the System log for critical errors in the same time window as the crash.

1. On the blue screen, a What failed line under the stop code names the file involved. A name ending in .sys is a driver.
2. In Event Viewer (right-click Start to open it), go to Windows Logs > System. An entry from source BugCheck confirms the crash and lists the stop code 0x00000050 with its four parameters. Errors from a named device, disk or service a few seconds earlier are often more telling.
3. Small crash dumps are saved in %SystemRoot%\Minidump, according to Microsoft’s advanced article. Opening one in WinDbg with !analyze -v, the command the bug check page uses, usually names the driver.

Our IRQL_NOT_LESS_OR_EQUAL guide walks through finding the driver behind a crash in more detail, with common file names. If every dump names only ntoskrnl.exe or another Windows file, the real culprit hasn’t been identified yet; work through Fix 2 to Fix 7 in order.

Fix 2: Undo recent changes

For hardware, Microsoft’s advice is to remove anything added recently and see whether the error comes back. The same reasoning applies to software and updates.

1. Shut down and disconnect hardware added shortly before the crashes began: a graphics card, RAM, USB network or cellular adapter, dock or capture device. Microsoft’s advanced article includes a 0x50 example where a USB mobile broadband driver was the faulting module.
2. Uninstall software installed around the same time that adds its own driver or service, such as security suites, VPN clients, RGB lighting and fan tools, virtual drive or backup software. Use Settings > Apps > Installed apps.
3. If the crashes started right after a monthly Windows update, remove it under Settings > Windows Update > Update history > Uninstall updates while you wait for a fix.

If the crashes stop, put things back one at a time. When the stop code returns, you’ve found the product to update or replace.

Fix 3: Update, roll back or remove the driver

Microsoft’s guidance for this stop code is direct: if a driver is named, contact its maker for an update, and if none exists, disable the driver and watch whether the PC stays stable. Which way you go depends on timing. A crash that began after a driver update points to a rollback; an old driver on a recently upgraded Windows points to an update.

1. Install anything offered under Settings > Windows Update > Advanced options > Optional updates and restart.
2. If that has nothing new, download the driver from the PC or device maker’s support page. Laptop makers often ship their own graphics, chipset and storage drivers, so start there on a laptop.
3. To go back a version, open Device Manager, open the device’s Properties and select Roll Back Driver on the Driver tab. If the button is grayed out, Windows kept no older copy; install an earlier release from the maker instead.
4. To take a device out of the picture, right-click it in Device Manager and choose Disable device, or Uninstall device and tick the option to remove the driver if it’s offered.

If the file isn’t tied to a device in Device Manager, it probably belongs to an app or service. Open its Properties in C:\Windows\System32\drivers and check the Details tab for the company and product name, then update or uninstall that product. For a service, Microsoft suggests disabling it, confirming the error stops, and asking the maker for a fixed version.

Fix 4: Rule out antivirus and other filter drivers

Antivirus is one of the few product types Microsoft names in the cause section for 0x50. Security tools work by inserting filter drivers into the path every file read and write takes, so a bug in one can crash the whole system rather than just the app. Backup, encryption, cloud sync and some VPN tools use filter drivers too.

See which filters are loaded

Open Terminal (Admin) and run:

fltmc filters

The list shows each file system filter driver with its altitude, a number that sets its place in the stack. Microsoft’s list of load order groups and altitudes reserves the range 320000 to 329999 for antivirus filters, so a third-party name in that range is your security product. Names you don’t recognize can be looked up in the Details tab of the matching file in C:\Windows\System32\drivers. Compare them with any file named in Fix 1.

Take the security product out for a test

Microsoft’s advice is to disable the program and confirm whether the error stops. In practice, turning off real-time protection in a third-party suite often leaves its drivers loaded, so a clean uninstall is the more reliable test.

Warning: you’re briefly relying on the protection built into Windows. Uninstall only security software you can reinstall, and keep the PC off untrusted sites and downloads until you’re done.

1. Uninstall the product from Settings > Apps > Installed apps and restart. Do it in Safe Mode if Windows won’t stay up.
2. If the maker offers a dedicated removal tool, run it as well; it clears drivers and services a normal uninstall can leave behind.
3. Check that Windows Security has turned Microsoft Defender Antivirus back on. It normally does this by itself once no other antivirus is registered.
4. Use the PC as usual for a few days. If the crashes stop, install the latest version of the product or switch to another one, and report the crash to its maker.

A related warning sign is Memory integrity being turned off because of incompatible drivers. Those drivers often come from old security, anti-cheat or hardware utilities, and the list Windows Security shows there is a useful second source of driver names to check.

Fix 5: Put the paging file back to system-managed

Microsoft doesn’t list the paging file as a cause of 0x50, and some guides suggest turning off automatic paging file management as a fix. Microsoft’s guidance points the other way. Its introduction to page files explains that the system commit limit is RAM plus all page files, and that reaching that limit “can cause freezing, crashing, and other malfunctions.” A system-managed paging file can grow when memory demand rises, and page files also back crash dumps, which you need for Fix 1.

So if you or a tuning tool turned the paging file off, set a fixed small size or moved it to another drive, put it back:

1. Press Windows + R, type sysdm.cpl and press Enter.
2. On the Advanced tab, select Settings under Performance, open that window’s Advanced tab and select Change under Virtual memory.
3. Tick Automatically manage paging file size for all drives, select OK and restart.

If the paging file lives on a drive that’s failing or nearly full, Fix 6 matters more. Microsoft’s advanced article recommends keeping about 10 to 15 percent of the system drive free.

Fix 6: Repair the drive and Windows files

Microsoft names a corrupted NTFS volume as a cause and recommends chkdsk with the /f (fix) and /r (find bad sectors) options. On the system drive, the scan runs at the next restart.

Warning: on a large or failing drive, /r can take hours, and it puts extra load on a disk that may be close to failing. Back up your important files first if you can, and don’t turn the PC off while the scan runs.

1. Open Terminal (Admin) and run the command below.
2. Type Y when asked whether to schedule the check, then restart and let it finish.

chkdsk C: /f /r

Microsoft also suggests running any diagnostic tool the drive maker provides; many SSD makers offer one with a health readout. Then repair Windows system files, in this order, one command at a time:

DISM /Online /Cleanup-Image /RestoreHealth

sfc /scannow

DISM repairs the Windows image that SFC copies from, so it goes first. Our SFC and DISM guide explains the messages each tool can show.

Fix 7: Rule out faulty RAM

Microsoft’s cause list ends with failing hardware, “usually related to defective RAM,” and that includes graphics card memory. Faulty RAM tends to produce a mix of stop codes rather than the same one each time, and crashes that come under load or with a memory profile turned on.

Run Windows Memory Diagnostic (mdsched), turn off XMP or EXPO and any overclock for a few days, and test one module at a time if errors appear. Our MEMORY_MANAGEMENT guide covers testing your RAM step by step, including the Extended test and where Windows logs the result, so it isn’t repeated here.

Fix 8: Driver Verifier (advanced)

If crashes continue and no dump names a driver, Microsoft’s bug check page suggests Driver Verifier, a built-in tool that checks drivers as they run and makes a misbehaving one fail in a way that names it. It’s meant for testing and does make crashes more likely while it runs, so set a restore point, back up, and know how to turn it off before you start.

Our IRQL guide has the full Driver Verifier walkthrough, including how to select only non-Microsoft drivers and how to switch it off from Safe Mode with verifier /reset if Windows won’t start.

Fix 9: System Restore or reset

System Restore

A restore point from before the first crash rolls back drivers, updates and settings while keeping your files. Search Start for Create a restore point and select System Restore. If Windows won’t start, the same tool is under Troubleshoot > Advanced options > System Restore in recovery.

Reset this PC

Warning: Reset this PC removes installed apps and third-party drivers, even with Keep my files. Remove everything also deletes your personal files. Back up first either way.

Go to Settings > System > Recovery > Reset PC. A reset clears out any third-party driver or security filter at fault. If the stop code returns on a fresh reset, before you install any extra software, the cause is almost certainly hardware: retest the RAM, check the drive and contact the PC maker if it’s under warranty.

Known issues

As of November 2026, Microsoft’s Windows 11, version 25H2 release health page lists no known issue that causes PAGE_FAULT_IN_NONPAGED_AREA or other stop errors. If many PCs start crashing with it after the same update, check that page, where Microsoft posts confirmed problems and workarounds.

Related guides

• Your PC ran into a problem and needs to restart: how to fix it
• MEMORY_MANAGEMENT blue screen in Windows 11: how to fix it
• IRQL_NOT_LESS_OR_EQUAL blue screen in Windows 11: how to fix it
• KERNEL_SECURITY_CHECK_FAILURE: what it means and how to fix it
• SYSTEM_PTE_MISUSE blue screen in Windows: causes and fixes
• Memory integrity is off because of incompatible drivers: how to fix it
• How to run sfc /scannow in Windows 11 and 10 (and read the results)
• WinRE: what the Windows Recovery Environment is and how to open it

Official sources

• Microsoft: Bug check 0x50 PAGE_FAULT_IN_NONPAGED_AREA
• Microsoft: Advanced troubleshooting for stop code errors
• Microsoft: Introduction to page files