If Windows shows ntoskrnl.exe on a blue screen, treat it as a clue—not proof that this Windows component caused the crash. A stop screen may show the stop code and, when available, the module that was executing; hardware, drivers, and software can all contribute. Record the exact stop code, any “What failed” text, and what changed shortly before the problem began. High CPU usage also needs investigation of the activity using CPU and recent changes; the available Microsoft blue-screen guidance does not establish ntoskrnl.exe itself as the cause of high CPU.
What the ntoskrnl.exe name does—and does not—tell you
ntoskrnl.exe is the Windows kernel image, but seeing its name in crash information does not identify the underlying fault by itself. Microsoft describes a blue screen as potentially identifying a stop code and, if available, the module that was executing when the error occurred. The failure may involve a device driver, hardware, or software rather than the named module. See Microsoft’s guide to analyzing bug-check stop-code data.
As an Amazon Associate I earn from qualifying purchases.
Microsoft reports that, in its analysis of stop-error crashes, 70% were attributed to third-party driver code, 10% to hardware issues, 5% to Microsoft code, and 15% could not be determined because the memory was too corrupted to analyze. These are broad proportions from Microsoft’s crash analysis, not the odds for a particular PC or for crashes that mention ntoskrnl.exe. The cited page does not state a publication year. Microsoft’s stop-code troubleshooting overview explains the categories.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to record before changing anything
- The exact stop code, including any number or punctuation.
- The full text after “What failed,” if it appears. Do not assume the name shown is the root cause.
- When the crashes or high CPU began, and what was happening at the time.
- Recently installed hardware, drivers, applications, and Windows updates.
- For high CPU, the process or activity shown in Task Manager when the spike occurs, if Windows remains usable.
This information helps distinguish a one-time event from a repeatable failure and makes later support or dump analysis more useful. Microsoft’s unexpected restart and stop-code guidance also recommends noting recent changes.
Try the least disruptive checks first
Undo a recent hardware or software change
If the problem began just after installing hardware, shut down the PC and remove the new component if it is safe and practical to do so. If a driver or application was installed or updated immediately before the issue, consider reverting or uninstalling that specific change. Avoid replacing parts based only on the ntoskrnl.exe label.
Use Safe Mode if Windows will not start normally
When normal startup repeatedly fails, use Windows Recovery Environment to reach Startup Settings and start in Safe Mode. Safe Mode loads a limited set of drivers and services, which can make it possible to remove a recent driver or application change. Follow Microsoft’s blue-screen troubleshooting steps; the exact recovery screens can differ by Windows version and device.
Review devices, updates, and disk space
- Open Device Manager and look for devices marked with a warning icon. Check for an appropriate driver update. If updating does not help, Microsoft advises disabling or uninstalling the affected device as a troubleshooting step; avoid removing devices you need to start or operate the PC unless you know how to restore them.
- Install relevant updates from Settings > Windows Update, then restart. If Windows Update itself fails, use Microsoft’s Windows Update troubleshooter.
- Check available space on the Windows drive. Microsoft says the amount needed varies by system configuration and gives a general recommendation to keep 10%–15% free. This is a general recommendation, not a guaranteed threshold for preventing crashes. Microsoft’s blue-screen guidance covers this check.
- Open Event Viewer and inspect the Windows Logs > System log around the time of the failure. Look for critical events that coincide with the crash; timing is useful evidence, but an event entry alone may not establish the cause.
Repair Windows system files if corruption is plausible
For suspected Windows component corruption, Microsoft’s recommended order is DISM first, then System File Checker. These commands repair Windows images and protected system files; they are not a guaranteed fix for a faulty driver, hardware problem, or high CPU usage.
- Open Start, search for Command Prompt, choose Run as administrator, and approve the prompt.
- Run
DISM.exe /Online /Cleanup-image /Restorehealthand wait for it to finish. By default, DISM can obtain repair files through Windows Update. - After DISM completes, run
sfc /scannow. Let verification finish; do not close the window or interrupt the scan before it reports its result. - Restart if prompted and check whether the same symptom returns.
If Windows Update cannot provide the files DISM needs, Microsoft documents using a separate repair source, including removable media. The source must be suitable for the Windows installation being repaired. See Microsoft’s DISM and System File Checker instructions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check memory with Windows Memory Diagnostic
A memory test can provide evidence about possible RAM problems, but a clean result does not prove that every hardware issue has been ruled out.
- Save your work, press Windows key + R, type
mdsched, and press Enter. - Choose the option to restart and check for problems. The PC will reboot and run Windows Memory Diagnostic.
- After Windows starts again, check the result in Event Viewer. Search the System log for the Windows Memory Diagnostic result if it is not shown as a notification.
An extended test takes longer than the standard test. Microsoft provides these instructions in its guidance for IRQL_NOT_LESS_OR_EQUAL errors.
When recurring crashes call for dump analysis
If the same stop error keeps returning after basic checks, compare the exact code and the circumstances of each crash. A memory dump may help identify the fault, but analyzing it with debugging tools is an advanced troubleshooting task—not a necessary first step for everyone. Microsoft describes dump analysis as an advanced method, and its debugger documentation explains how dump files preserve crash information. See Microsoft’s blue-screen troubleshooting page and Microsoft Learn’s guide to kernel-mode dump files, last updated December 11, 2024.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →If you are not comfortable handling crash dumps, ask the PC manufacturer or a qualified technician to examine the stop code, event records, and dump. Bring the details you recorded rather than relying on the module name alone.
Windows 10 support status
Microsoft says Windows 10 support ended on October 14, 2025. After that date, Microsoft no longer provides free Windows Update software updates, technical assistance, or security fixes for Windows 10. This lifecycle change matters for keeping a Windows 10 PC supported, but it does not explain or diagnose a particular blue screen or CPU spike. Windows 11 users should follow the Windows 11-specific options presented by Windows Update and their device maker. See Microsoft’s Windows Update guidance.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
