Windows Experiences a SYSTEM_SERVICE_EXCEPTION Blue Screen

Scott Lee 20 Reputation points
2026-11-09T16:50:45.1933333+00:00

Enterprise workstations experience SYSTEM_SERVICE_EXCEPTION crashes during normal operation. How can I analyze bugcheck parameters, identify faulty kernel drivers, and correlate crashes with recent system changes?

Windows for business | Windows 365 Enterprise
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hoang Le Huy 1,840 Reputation points Independent Advisor
    2026-11-09T17:27:27.18+00:00

    Hello Scott Lee,

    A SYSTEM_SERVICE_EXCEPTION (BugCheck 0x3B) is most commonly associated with a faulty kernel-mode driver, memory corruption, or a driver calling invalid memory during the transition from user mode to kernel mode. The most reliable approach is to analyze the crash dump located in C:\Windows\Minidump\ or C:\Windows\MEMORY.DMP with WinDbg and run !analyze -v, which will identify the bugcheck parameters, faulting module, exception code, and call stack. Microsoft documents that the exception code in Parameter 1 and the faulting instruction address in Parameter 2 are key indicators for determining the offending driver.

    If the same third-party driver appears repeatedly in the stack trace, verify its version using lmvm <drivername> in WinDbg and compare its installation date with recent changes recorded under Event Viewer > Windows Logs > System, especially around Event IDs 6, 19, 43, 7045, and device installation events. Driver Verifier (verifier.exe) can also be enabled against non-Microsoft drivers to force the defective driver to fail in a controlled manner, making identification significantly easier.

    To correlate crashes with system changes, review recently installed drivers, Windows updates, firmware updates, security products, VPN clients, endpoint protection agents, and hardware additions. Reliability Monitor (perfmon /rel) provides an excellent timeline that often shows the exact software or driver installation that preceded the first crash. If memory corruption is suspected and no consistent driver is identified, test RAM using Windows Memory Diagnostic or vendor-approved hardware diagnostics before replacing drivers.

    If my answer is useful for you, please hit Accept the answer for me please.

    HL.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-11-09T16:51:01.9966667+00:00

    Use a repeatable workflow that captures the stop code details first, then validates the suspected driver or recent change.

    1. Collect the bugcheck parameters
    • Each stop code has four parameters.
    • Get them from one of these sources:
      1. Event Viewer: check the Windows system log and open the bugcheck event properties to see the four parameters.
      2. Crash dump analysis: load the dump file in WinDbg and run !analyze.
      3. Live kernel debugging: if a kernel debugger is attached, the debugger output shows the stop code and its four parameters.
    • For recurring issues, record the exact bugcheck text and the exact actions that led to the crash.
    1. Interpret SYSTEM_SERVICE_EXCEPTION specifically
    • SYSTEM_SERVICE_EXCEPTION is bug check 0x0000003B.
    • Its parameters are:
      • Parameter 1: exception that caused the bug check
      • Parameter 2: address of the instruction that caused the bug check
      • Parameter 3: address of the context record for the exception
      • Parameter 4: not used
    • Common exception codes include:
      • 0x80000003 = breakpoint/assert with no kernel debugger attached
      • 0xC0000005 = access violation
    1. Analyze the dump in WinDbg
    • Start with !analyze to get the initial root-cause clues.
    • For 0x3B, use:
      • !error on Parameter 1 to decode the exception code
      • .cxr with Parameter 3 to display the saved context record
      • kb to display the stack backtrace
    • Review STACK TEXT for what was running when the failure occurred.
    • If multiple dump files exist, compare them for common code paths or repeated modules.
    • Use lm t n to list loaded modules.
    • Use !memusage for general memory state, and !pte or !pool for deeper memory inspection when needed.
    1. Identify the faulty kernel driver
    • If a driver is identified on the blue screen, disable it or check for an updated version.
    • For 0x3B, the responsible driver name can be stored in KiBugCheckDriver. In WinDbg, run:
      • dx KiBugCheckDriver
    • Also check:
      • Device Manager for devices with an exclamation mark
      • the device’s event log in its properties
      • Event Viewer system log entries in the same time window as the crash
    • If multiple crashes point to the same module or stack pattern, that strengthens the driver correlation.
    1. Use Driver Verifier carefully
    • Driver Verifier is built into Windows and can expose faulty drivers by stressing them in real time.
    • Start it by entering verifier at a command prompt.
    • Verify the smallest possible set of suspect drivers because Driver Verifier adds overhead.
    • For 0x3B cases, Driver Verifier is specifically recommended when a driver is suspected, including pool-related issues.
    • Risk: Driver Verifier can increase crash frequency while enabled.
    1. Correlate with recent system changes Check for changes made shortly before the crashes began:
    • recently added or updated device drivers or system services
    • recently added hardware
    • BIOS updates or BIOS memory settings such as caching or shadowing
    • hardware compatibility with the installed Windows version
    • memory issues using Windows Memory Diagnostics
    • critical errors in Event Viewer during the same timeframe
    1. Enterprise triage priorities
    • Compare several dump files from affected workstations for the same exception code, stack pattern, or driver.
    • Prioritize drivers or services that were recently deployed broadly.
    • If a new driver, service, or hardware rollout aligns with the first crash window, remove, replace, or update that component first.
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.