Critical Process Died (0xEF): How to Fix It Without Losing Files

Windows crashes to a blue screen with the stop code CRITICAL_PROCESS_DIED. Sometimes it happens once after an update; sometimes it happens on every boot and you can’t get to the desktop at all. The critical process died error is a broad one, so the fix depends on why it happened. Here’s what it means, how to work through the repairs in a safe order, and how to protect your files before you try anything that could erase them.

What “critical process died” means

Windows runs a handful of processes it can’t live without, such as the parts that manage sessions, logons, and core services. Stop code 0xEF (CRITICAL_PROCESS_DIED) means one of those essential processes stopped unexpectedly. Windows can’t safely continue without it, so it halts the whole system.

The error tells you that a critical process died, not why. The usual reasons are:

1. Corrupted system files, often after an interrupted update, a forced shutdown, or a power cut.
2. A bad driver or Windows update, especially if the crashes started right after one installed.
3. A failing drive. If bad sectors sit under system files, Windows can’t load them reliably, and the process that needs them crashes.
4. Malware that tampers with or kills system processes.
5. Faulty RAM, which can corrupt data a process depends on.

Step 1: Get into Safe Mode or WinRE

If Windows still starts, even briefly, do the repairs from inside Windows or Safe Mode. If it crashes on every boot, use the Windows Recovery Environment (WinRE).

• Windows starts: go to Settings → System → Recovery and click Restart now next to Advanced startup. Or hold Shift while clicking Restart.
• Windows won’t start: after two or three failed boots, Windows usually opens Automatic Repair on its own. If it doesn’t, turn the PC on and hold the power button to shut it off as soon as the Windows logo appears. Do this two or three times, and the next boot should open recovery.

From the blue Choose an option screen, go to Troubleshoot → Advanced options. That’s where the tools below live. To boot into Safe Mode, choose Startup Settings → Restart, then press 4 (Safe Mode) or 5 (Safe Mode with Networking).

If your drive is encrypted with BitLocker, WinRE may ask for the 48-digit recovery key. See how to find your BitLocker recovery key if you don’t have it handy.

Step 2: Back up your files before repairs

Most of the fixes below don’t touch your files, but some can, and a failing drive can get worse with every boot. If you can reach the desktop or Safe Mode, copy your important files to an external drive first.

If you can only reach WinRE, there’s a workaround: open Troubleshoot → Advanced options → Command Prompt, type notepad, and press Enter. In Notepad, choose File → Open, set the file type to All Files, and you can browse your drives and copy folders to a USB drive with right-click Copy and Paste. Drive letters in WinRE often differ from normal, so your Windows drive may be D: instead of C:.

If the PC won’t get that far, you can remove the drive and read it from another computer.

Step 3: Try the safe repairs first

Startup Repair

In Troubleshoot → Advanced options, choose Startup Repair. It checks for common boot problems and fixes what it can. It doesn’t delete personal files.

Uninstall the latest update

If the crashes started after an update, choose Uninstall Updates, then Uninstall latest quality update. If that doesn’t help, try Uninstall latest feature update. You can also roll back a recently updated driver from Device Manager in Safe Mode: right-click the device, choose Properties → Driver → Roll Back Driver.

System Restore

System Restore rolls system files, drivers, and settings back to a restore point from before the problem. It doesn’t change your documents or photos, though apps installed after the restore point will be removed. It only works if restore points were being created.

Step 4: Repair system files with SFC and DISM

If you can get to Windows or Safe Mode, open Command Prompt as administrator and run:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

DISM repairs the Windows component store that SFC uses as its source, so running it first gives SFC a better chance of fixing what it finds. Restart when both finish.

If you can only reach WinRE, run SFC against your offline Windows installation instead. First confirm which letter your Windows drive has (dir C:\ and dir D:\ will show you which one contains a Windows folder), then run:

sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Replace C: with the right letter if Windows is on a different drive.

Step 5: Check drive health before chkdsk /r

A lot of guides tell you to run chkdsk /r next. Don’t do that until you know the drive is healthy. On a failing drive, /r reads every sector and retries the weak ones, which can take hours and put heavy stress on hardware that’s already struggling.

Check SMART health first with a tool like CrystalDiskInfo, from Windows or with the drive connected to another PC. Our guide on how to check hard drive health explains what to look for. If the status is Caution or Bad, or there are pending or reallocated sectors, treat the drive as failing: back up and skip chkdsk.

If the drive is healthy and your files are backed up, chkdsk C: /f fixes file system errors, and chkdsk C: /r adds a surface scan. If chkdsk hangs for hours, see Windows stuck repairing disk errors.

Step 6: Rule out malware and RAM

• Malware: in Windows, open Windows Security → Virus & threat protection → Scan options and run Microsoft Defender Antivirus (offline scan). It restarts the PC and scans before Windows fully loads.
• RAM: press Win + R, type mdsched.exe, and choose Restart now and check for problems. Any errors mean a memory module needs replacing.

Last resort: Reset this PC

If nothing else works, Reset this PC reinstalls Windows. You’ll find it in Settings → System → Recovery, or in WinRE under Troubleshoot → Reset this PC. It offers two choices:

• Keep my files: removes apps and settings but keeps your personal files.
• Remove everything: deletes your personal files, apps, and settings.

Even with Keep my files, back up first. A reset on a failing drive can fail partway through, and files kept outside your user folders may not survive. If the critical process died error comes back after a reset, the cause is almost certainly hardware, most often the drive or RAM.

The bottom line

The critical process died error means an essential Windows process stopped. Start with Startup Repair, uninstalling the latest update, and System Restore, then repair system files with DISM and sfc /scannow. Check the drive’s SMART health before running chkdsk /r, rule out malware and RAM, and back up your files before any reset. Related stop codes like INACCESSIBLE_BOOT_DEVICE often point to the same underlying drive problems.

If the crashes have locked you out of a computer with files you can’t lose, our desktop and PC data recovery service recovers data from failing drives for one flat $1,200 price for a single device. Shipping is free and prepaid, and you pay nothing unless the recovery succeeds.