CRITICAL PROCESS DIED Stop Code 0xEF Causes and Fix Order
Windows keeps a short list of processes it refuses to live without. When one of them dies - csrss, wininit, winlogon, services - Windows stops on purpose rather than run in a state it cannot trust. The process is the victim; this fix order hunts what killed it.
Watch the video for the full stop-code master guide - this code explained live with its fix order
Read 0xEF as damage inside Windows itself until proven otherwise. Its causes are practical: system files corrupted, a drive quietly dropping data, a driver faulting inside a critical process, or an update that landed badly. Be ready for one honest difficulty - this code frequently leaves no dump file behind, because the components needed to write the dump are among the casualties. So this page works by elimination from the recovery menu: repair the files, prove the drive, remove what changed, scan deep.
Blue screen - CRITICAL_PROCESS_DIED (what it means)
CRITICAL_PROCESS_DIED
Stop code value: 0x000000EF
A process Windows cannot run without has ended:
csrss.exe - wininit.exe - winlogon.exe - services.exe - smss.exe
The critical processes behind this code. Windows bug-checks by design when one of them ends unexpectedly - the crash is a protection, and the real fault is whatever damaged the process.
1
What This Code Actually Means
A handful of processes are so essential that Windows is designed to stop deliberately if one of them dies - the user-session manager (smss.exe), the client-server runtime (csrss.exe), the boot and logon processes (wininit.exe, winlogon.exe), and the service controller (services.exe). If any of them terminates unexpectedly, Windows raises this bug check instead of limping on in a state it cannot trust. The process did not usually commit suicide: it was killed by corrupted system files, by a driver faulting inside it, by malware, or by a failing drive handing it damaged data. One honest frustration with this code: a memory dump is often not written, because the machinery that writes the dump depends on processes and storage that may be exactly what just died. You may have to fix this one by method, not by dump.
2
Fix 1 - Repair Windows From the Recovery Menu
If Windows will not boot reliably, interrupt the boot twice (hold power as the spinner appears) to reach the recovery menu, then Troubleshoot, Advanced options, Command Prompt
Find your Windows drive letter in recovery - it is often not C: there. Run dir C:, dir D: until you see the Windows folder, then repair offline: sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows (use your letter)
Follow with DISM /Online /Cleanup-Image /RestoreHealth once Windows boots, or from recovery with an install USB as the source
Also in Advanced options: try Startup Repair, and System Restore to a point before the crashes began - restore is built for exactly this kind of damage
3
Fix 2 - Interrogate the Drive
Run chkdsk C: /r from the recovery Command Prompt and let it finish - it hunts bad sectors and recovers readable data
Check the drive's health with its maker's tool or CrystalDiskInfo from a bootable environment. A drive reporting reallocated sectors or falling health percentage explains this code better than any software theory - replace it
If the PC has recently been cloned to a new SSD or the SSD was moved, reseat it and check the firmware is current
4
Fix 3 - Remove What Changed, Scan for Malware
From the recovery menu, use Uninstall Updates to remove the latest quality and feature updates if the crashes started with one
Run a full scan with Microsoft Defender, then the Microsoft Defender Offline scan from Virus and threat protection, Scan options - critical processes are a favourite malware target
Roll back drivers installed in the days before the first crash, graphics and storage first
If Windows still dies after clean files, a healthy drive and a restore: use Reset this PC, Keep my files from the recovery menu. For this code, a rebuild after proven-good hardware is a legitimate endpoint, not a shortcut
Watch the Complete Video Guide
The full BSOD master guide - every major stop error explained with its fix, shown live, step-by-step.
Why is there no minidump file for my CRITICAL_PROCESS_DIED crash?
Because writing a dump needs working processes and a working storage path - and with this code, the dead process may be part of that machinery. Microsoft documents that dump creation can fail for this bug check. Fix by method instead: offline SFC, drive check, restore point, update removal, in that order.
The PC crashes with this code before Windows even finishes booting. Where do I start?
In the recovery menu. Interrupt the boot twice to reach it, then open Advanced options: run Startup Repair, try System Restore to an earlier point, and use Command Prompt for offline SFC and chkdsk. Everything in the first two fixes of this guide can be done from there without Windows loading.
Could a failing SSD really cause CRITICAL_PROCESS_DIED?
Yes - it is one of the classic causes. Critical processes load their code and data from the drive continuously; a drive that returns corrupt data or drops out mid-read kills them. Check health honestly: if the drive reports reallocated sectors or a worn-out percentage, replace it before spending more days on software repairs.
This guide is based on the Technical Anshu BSOD master guide video - stuck on any step, ask in the video comments and you will get an answer.