KMODE_EXCEPTION_NOT_HANDLED BSOD Fix on Windows 11

For a kmode_exception_not_handled bsod fix on Windows 11, use this order to reduce guesswork: capture the crash clue, test whether Safe Mode is stable, roll back or remove the recent driver if timing points to one, run SFC and DISM if Windows files may be damaged, then test RAM and hardware-related issues if the clue keeps changing or Safe Mode also crashes.

KMODE_EXCEPTION_NOT_HANDLED is bug check 0x0000001E. Officially, it means a kernel-mode program generated an exception that the error handler did not catch. Official guidance also says a faulty device driver or system service can cause it, and hardware issues such as BIOS incompatibilities, memory conflicts, and IRQ conflicts can also generate it. Safe Mode also matters because it starts Windows with a minimal set of drivers and services, which helps separate a normal-boot driver problem from a wider stability problem. (vividrepairs.co.uk)

Start with the strongest crash clue

What to capture before changing anything

The best clue is the file named on the blue screen, then the Event Viewer entry at the crash time, then the newest file in C:\Windows\Minidump. If Windows names a .sys file, treat that as the first lead, not automatic proof, and then check whether Safe Mode changes the behavior.

1. If the blue screen stays visible long enough, write down the exact .sys filename if one appears, and write down the full stop code shown on the screen.
2. If the system reboots too fast, boot to Settings > System > Recovery > Advanced startup > Restart now > Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode or 5 for Safe Mode with Networking.
3. In Safe Mode, open File Explorer and go to C:\Windows\Minidump. If prompted for permission, select Continue. Switch to Details view and note the newest .dmp file and its timestamp.
4. If the crash started right after a Windows update, GPU driver update, VPN install, RGB utility install, or BIOS change, note that too.

A named driver file can be a useful starting clue, especially before driver rollback or removal. (source)

Which causes are most likely, in order?

Most cases still start with a third-party driver or a software layer attached to one, especially if the first crash followed an update or a new install. After that, check damaged Windows files, then RAM or CPU instability when the blamed file changes between crashes, and then hardware-related issues such as BIOS compatibility or device conflicts. That order matches the official driver-first guidance better than going straight to a full reinstall.

1) Third-party drivers

Check drivers before anything else. Official guidance says a faulty device driver or system service might cause this error, and if a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates. Graphics drivers, network drivers, storage controller drivers, virtualization drivers, RGB software, VPN clients, antivirus filter drivers, and anti-cheat tools all fit the pattern because they add code that runs close to the kernel.

2) Corrupted Windows files

After repeated blue screens, Windows files can also need repair, especially after an interrupted update or failed driver install. That moves sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth higher in the order, but only after the likely driver path has been checked. These are standard Windows repair tools for system files and the component store.

3) RAM or CPU instability

When one crash points to storage, the next to graphics, and the next to networking, the named file may be where the fault surfaced rather than where it started. In practice, that is the point to stop chasing single drivers and start checking unstable memory settings, bad DIMM slots, overclocking, undervolting, or recent firmware changes.

4) Hardware compatibility or device conflicts

If Windows crashes during install, very early boot, or while applying updates, hardware-related issues move up the list. Official guidance specifically includes BIOS incompatibilities, memory conflicts, and IRQ conflicts as possible causes, so early-boot or install-time failures should be checked differently from a crash that only appears after the full desktop loads.

How do I find the .sys file or crash clue?

Look first on the blue screen itself, then in Event Viewer under Windows Logs > System, then in the newest minidump if the screen flashed too quickly. That order is fast and usually enough to separate a likely driver case from a memory or hardware case.

Read the blue screen and minidump

1. At the next crash, note any filename ending in .sys exactly as shown, including the full name such as nvlddmkm.sys or ndis.sys.
2. If no file appears, boot into Safe Mode and open File Explorer > C:\Windows\Minidump.
3. Click View > Details if needed, then click the Date modified column to sort newest first. Save or copy the newest .dmp file to another folder, such as the Desktop or Documents, before making changes.

Check Event Viewer

1. Press Win + X > Event Viewer.
2. Open Windows Logs > System.
3. Select Filter Current Log in the right pane, tick Critical and Error, then set the time range around the exact minute of the crash if you know it.
4. Open each likely entry from that time and look for a driver filename, device name, storage warning, or service failure.

Event Viewer is rarely perfect, but it often narrows the layer. If a driver is named in the bug check message, official guidance is to disable or remove that driver, or check with the manufacturer for updates.

Driver-first fixes when a .sys file, update, or Safe Mode points to a driver

Roll back first when the crash started after an update

1. Right-click Start and open Device Manager.
2. Check Display adapters, Network adapters, and Storage controllers first.
3. Open the suspect device > Properties > Driver.
4. Select Roll Back Driver if available.
5. Restart and test.

Rollback is usually the best first move when the timing is obvious. If Windows Update or a vendor updater ran just before the crashes started, return to the previous known-good driver first.