The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
REGISTRY_FILTER_DRIVER_EXCEPTION is Windows bug check 0x00000135: an exception occurred in a registry-filter driver running in kernel mode. It does not, by itself, mean the Windows Registry is damaged, and a blue screen naming WdFilter.sys does not prove Microsoft Defender is the root cause. The right fix depends on the driver and circumstances identified by crash dumps, recent software changes, and hardware checks.
Fastest safe path: back up files if possible; use Safe Mode if Windows will not stay running; install Windows and Defender updates; roll back or uninstall a recently added security or system-level driver; then run DISM followed by SFC. If crashes continue, inspect minidumps and test RAM and storage. Do not delete or replace WdFilter.sys.
What the stop code means
A registry-filter driver monitors or responds to Registry activity through a callback. Windows stops with REGISTRY_FILTER_DRIVER_EXCEPTION when an exception in that driver’s notification routine is not handled. Microsoft identifies the stop code as bug check 0x135.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThis is a kernel-mode driver failure, not an ordinary application crash. The Registry may be healthy. A filter driver can belong to Windows or to security, backup, encryption, virtualization, anti-cheat, or other software that integrates deeply with the operating system. The crash may happen during startup, gaming, browsing, a security scan, shutdown, or idle use; timing alone does not identify the cause.
#1 Best Overall
- Connectivity: Includes WiFi, Bluetooth, and LAN for wireless and wired connections
- Memory: Features 16GB DDR4 RAM for smooth multitasking and performance
- Storage: Combines 500GB SSD and 1TB HDD for ample storage space
- Graphics: Integrated Intel UHD Graphics 630 for crisp visuals and video playback
- Design: Sleek desktop tower with black color and slim profile for modern look
The bug check has four parameters: parameter 1 is the exception code; parameter 2 is the address of the exception context record; parameter 3 is the address of the driver’s callback routine; and parameter 4 is reserved. A dump can help identify the callback involved, but the parameter or displayed filename is a clue to investigate, not always proof of the underlying fault.
If the blue screen says “What failed: WdFilter.sys”
WdFilter.sys is associated with Microsoft Defender. Its appearance means Windows detected it at the time of the crash; it does not conclusively establish that Defender initiated the failure. A third-party filter driver, damaged Windows components, storage trouble, or defective hardware may contribute to a crash involving that module. Microsoft Q&A offers updating Defender as a possible troubleshooting step, not a universal diagnosis (example guidance).
Update Windows and Defender, then look at crash dumps and software changes around the time the crashes began. If you recently installed or updated another antivirus, anti-cheat module, backup or encryption product, virtualization software, or low-level hardware utility, investigate that change too. Do not download a replacement WdFilter.sys from a third-party driver site, and do not delete, rename, or manually replace the system file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Protect your files and record the symptoms
- Back up important files while Windows is usable. If you need recovery media or WinRE, remember that a BitLocker-protected drive may require its recovery key.
- Record the stop-code text, any “What failed” filename, and whether the crash occurs at boot, login, during a scan, under gaming load, after waking from sleep, or at another repeatable point.
- Temporarily disconnect recently added peripherals and external storage to see whether the pattern changes.
- Avoid repeated forced shutdowns unless the PC is completely unresponsive. Do not start by running a Registry cleaner or manually editing filter entries.
Boot Windows 11 into Safe Mode
If Windows remains usable, open Settings → System → Recovery. Under Advanced startup, choose Restart now. Then select Troubleshoot → Advanced options → Startup Settings → Restart. After the restart, press 4 for Safe Mode or 5 for Safe Mode with Networking.
If Windows is stuck in a restart or blue-screen loop, enter Windows Recovery Environment (WinRE) using the recovery screen or Windows installation/recovery media. Choose Repair your computer → Troubleshoot → Advanced options → Startup Settings, restart, and select Safe Mode. Menu wording can vary by build, recovery route, or PC manufacturer. See Microsoft’s Safe Mode instructions.
If the PC stops crashing in Safe Mode, investigate drivers and startup services that load during a normal boot. If it still crashes there, core Windows components, a boot-start driver, storage, firmware, or hardware deserve more attention. Safe Mode narrows the possibilities; it is not itself a repair or proof of a particular driver’s guilt.
Install Windows, Defender, and manufacturer updates
- Open Settings → Windows Update and install pending updates, following any restart prompts.
- In the Windows Security app, check for Microsoft Defender security intelligence updates. Windows Update may also deliver Defender updates.
- Check the PC or motherboard manufacturer’s support page for relevant chipset, storage-controller, network, graphics, and firmware updates. Use the package for your exact model.
- If the crashes began immediately after a device-driver update, open Device Manager → device → Properties → Driver → Roll Back Driver, if that button is available.
Review software installed or updated just before the first crash. Temporarily uninstall a recent third-party antivirus or system-level utility to test whether stability changes; use the vendor’s official removal procedure when available. Consider recent backup, encryption, virtualization, anti-cheat, or hardware-monitoring software if the evidence points to it. On an enterprise-managed PC, consult the administrator before removing security or monitoring software. Avoid generic driver-updater applications; get drivers from Microsoft, the PC or motherboard manufacturer, or the component vendor.
Recommended Free Tools
Rank #2
- [INTEL POWERED CONTENT] - Built with a 8th Generation Hexa-Core Intel i5 and 32GB of DDR4 RAM; Modern, Windows 11 ready, with 4K support, Executive multitasking, media streaming and smooth, multi-tab web browsing; Perfect as an all-purpose multimedia computer; built for content creators; Plenty of RAM and Mass storage for photo and video editing powered by Intel HD 630
- [LATEST WIRELESS TECH] - This Dell Desktop Computer easily connects to the internet through the Built In WiFi / Bluetooth
- [SOLID STATE STORAGE] - This Dell Computer setup comes with an ultra-fast 1TB Solid State Drive (SSD); Setup as the primary boot device; Boot and load programs with lightning speed ; Additional expansion available
- [BUY & OWN WITH CONFIDENCE] - From the world's largest Microsoft Authorized Refurbisher; Quality Guarantee and Free Tech Support; Award-winning Customer Service; | Support Sustainable Business
- [MODERN HI-SPEED PORTS] - USB 3.0 (x4) | USB 2.0 (x4) | DisplayPort (x1) | HDMI Port (x1) | Audio Combo Jack (x1) | Audio Out (x1) | RJ-45 Ethernet (x1) | Internal SATA (x3)
Repair Windows components with DISM and SFC
If you can open an elevated Command Prompt or Windows Terminal, run these commands in order. Restart if prompted after DISM.
DISM /Online /Cleanup-Image /RestoreHealthsfc /scannowInterpret the SFC result:
- “Windows Resource Protection did not find any integrity violations” means SFC found no protected-system-file violations. It does not rule out a third-party driver, firmware, or hardware fault.
- “Found corrupt files and successfully repaired them” means Windows repaired protected files. Restart and watch for another crash; this does not identify the driver responsible.
- “Found corrupt files but was unable to fix some of them” means further repair may be needed. Rerun SFC after DISM, review the CBS log, or use recovery-media/offline repair if Windows cannot boot.
Microsoft documents the System File Checker procedure. DISM and SFC can repair Windows component corruption; they cannot repair defective RAM, an overheating or failing SSD, an incompatible firmware setting, or a third-party kernel driver. In WinRE, do not paste the /Online command blindly: drive letters and the Windows directory can differ from a normal boot. Identify the correct Windows volume before attempting offline repair.
Use crash dumps to identify recurring evidence
Look for small dumps in C:WindowsMinidump and a full or kernel dump at C:WindowsMEMORY.DMP. If no dump is being created, configure one while Windows is stable: open Control Panel → System → Advanced system settings → Advanced → Startup and Recovery → Settings. Set Write debugging information to Small memory dump and confirm the directory is %SystemRoot%Minidump.
A dump may be missing or incomplete if the system drive is failing, the crash occurs before dump initialization, the page file is disabled or misconfigured, power is lost instead of Windows bug-checking, or storage, encryption, or firmware problems interfere with writing it. A machine stuck at 0% during dump collection is another reason to investigate storage and dump configuration. No dump does not mean there was no cause.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →For analysis, install and open WinDbg, load a dump, and run:
!analyze -vTo inspect a named module, use:
lmvm drivernameWinDbg documentation explains the debugger. Treat !analyze -v as a starting point, not an infallible verdict: compare several dumps, their timestamps and stack traces, module versions, and recurring third-party modules. A driver shown in a report may have been executing when another component corrupted memory or supplied invalid data. Microsoft notes that parameter 3 of bug check 0x135 can help identify the callback involved (0x135 reference).
Use Driver Verifier only as a controlled diagnostic
Driver Verifier deliberately stresses drivers and can provoke additional blue screens or prevent normal startup. Do not use it as a first fix or enable it for every driver indefinitely. Consider it only after reviewing dumps and recent changes, and generally target a suspected third-party driver. Record which drivers and settings you selected before restarting. See Microsoft’s Driver Verifier documentation.
Rank #3
- Model: Dell OptiPlex 7050 Small Form Factor (SFF)
- Processor: Intel Core i7-7700 3.60 GHz
- Memory: 32GB DDR4 Ram
- Storage: 1TB Solid State Drive (SSD) Fast Boot + Storage
- Operating System: Windows 11 Pro (64-bit)
If Verifier causes a boot loop, enter Safe Mode or WinRE, open an elevated Command Prompt, and run:
verifier /resetRestart afterwards. If the reset does not work, use System Restore or recovery options rather than repeatedly forcing a normal startup. Do not leave Verifier enabled permanently.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test RAM, storage, firmware, and thermals
Shift toward hardware checks if several unrelated stop codes appear, dumps name different modules each time, Windows Setup or Safe Mode also crashes, files become corrupt, dumps cannot be written, or the problem began after a RAM, SSD, GPU, or peripheral change. A crash limited to sleep/wake, battery operation, storage activity, or gaming load may point toward power management, OEM firmware, graphics, temperature, or power stability rather than Registry corruption.
- Use Windows Memory Diagnostic as an initial screen. For intermittent faults, a longer bootable memory test can be more revealing. A clean result from one test does not eliminate RAM problems.
- Check SSD/NVMe health, temperature, firmware, and manufacturer diagnostics. A health percentage or one clean scan is not conclusive. If the drive disappears intermittently from UEFI, prioritize data recovery and hardware service rather than software troubleshooting.
- Return BIOS/UEFI settings to defaults for testing, especially if overclocking, XMP/EXPO, undervolting, or aggressive memory timings are enabled. Check temperatures and power stability under the conditions that trigger the crash.
- Reseat recently installed RAM or expansion cards. Where appropriate and safe, test one memory module at a time. If you are not comfortable opening the PC, use a qualified technician.
A clean Windows Memory Diagnostic run or apparently healthy drive reading cannot conclusively prove hardware is good. Multiple unrelated stop codes, crashes during setup, or repeated failure after software repair are reasons to stop repeating the same software commands and test hardware.
If Windows remains stuck in a crash loop
- In WinRE, try Troubleshoot → Advanced options → Startup Repair.
- If the timing matches a recent Windows update, use Uninstall Updates; try the latest quality update first, and consider a feature update if the crashes began right after it.
- Use System Restore if a suitable restore point exists.
- Boot Safe Mode and remove or roll back a recent driver, security product, or system utility.
- Consider offline DISM/SFC only after identifying the correct Windows volume and understanding the recovery drive letters.
- Copy important data from WinRE or external media before major recovery steps if it is not backed up.
- If Windows can start, an in-place repair installation may preserve files and apps while replacing Windows components. Reset or clean installation is a later option after backup and hardware checks.
A clean reinstall is not a diagnosis. A faulty RAM module, failing SSD, firmware problem, or driver that is immediately reinstalled can make the blue screen return. If the PC is managed by an organization, or the drive is intermittently absent, stop before removing managed software or performing a destructive reinstall and seek administrator or hardware support.
Common mistakes to avoid
- Blaming
WdFilter.syssolely because it appears on the blue screen. - Deleting, renaming, or replacing a Windows system driver using a file downloaded from an untrusted site.
- Manually editing Registry filter entries without a known vendor procedure and a recoverable backup.
- Running SFC repeatedly after it reports no integrity violations, without investigating drivers or hardware.
- Leaving antivirus disabled permanently instead of conducting a controlled uninstall-and-test.
- Assuming Kernel-Power Event 41 in Event Viewer identifies the cause; it generally records an unexpected shutdown, not its root cause.
- Reinstalling Windows before checking recent hardware, RAM, SSD, and firmware settings.
Repeated or mixed stop codes are a reason to broaden diagnosis. Microsoft Q&A examples document cases involving multiple stop codes or different suspected modules (multiple-code case; repeated-crash case). Community cases are examples, not proof of what is happening on any particular PC.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
