Share via

how to fix Critical_process_died (0xEF)

RF Modine 20 Reputation points
2026-05-13T22:06:16.0066667+00:00

I am seeing this happen too many times. The system crashes with this message. I just installed the latest patches. Not sure how to resolve it. I have run sfc /scannow, and dism /online /cleanup-image /restorehealth but the problem still continues.

Windows for home | Windows 11 | Performance and system failures
0 comments

Answer accepted by question author

Lester Bernard Reyes 81,845 Reputation points Independent Advisor
2026-05-14T04:08:55.3466667+00:00

Hi, thank you for patiently waiting. As per checking and analyzing the DMP files, there are multiple errors in Dell SupportAssist. I recommend uninstalling the app, then checking the device again.

Press the Windows key + R, then type in:

 

appwiz.cpl

 

Then hit OK

 

Look for Dell SupportAssist software, then right-click and uninstall it.

 

Restart the PC and check.

Note: If the issue persists, could you please check the System logs on the PC so I can further examine the root cause?

 

To share the System logs, please follow the steps in the link below:

 

Press the Windows key + X, then select "Event Viewer"

Click the drop-down of "Windows logs"

Right-click System > click Filter Current logs > Check: Critical, Warning, and Error > Hit OK

On the right pane, click "Save Filtered Log File As..."

Save the System logs file to your desktop and share it by following the steps from the link:

https://support.microsoft.com/en-us/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

 

Note: You can also use your preferred cloud storage to upload and share the logs.

Was this answer helpful?

2 people found this answer helpful.

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Lester Bernard Reyes 81,845 Reputation points Independent Advisor
    2026-05-14T04:07:02.5733333+00:00

    Hi, thank you for patiently waiting. As per checking and analyzing the DMP files, there are multiple errors in Dell SupportAssist. I recommend uninstalling the app, then checking the device again.

    Press the Windows key + R, then type in:

     

    appwiz.cpl

     

    Then hit OK

     

    Look for Dell SupportAssist software, then right-click and uninstall it.

     

    Restart the PC and check.

    Note: If the issue persists, can you please check the System logs on the PC so I can further examine the root cause of the issue?

     

    To share the System logs, please follow the steps in the link below:

     

    Press the Windows key + X, then select "Event Viewer"

    Click the drop-down of "Windows logs"

    Right-click System > click Filter Current logs > Check: Critical, Warning, and Error > Hit OK

    On the right pane, click "Save Filtered Log File As..."

    Save the System logs file to your desktop and share it by following the steps from the link:

    https://support.microsoft.com/en-us/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

     

    Note: You can also use your preferred cloud storage to upload and share the logs.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Lester Bernard Reyes 81,845 Reputation points Independent Advisor
    2026-05-13T22:58:59.48+00:00

    Hi, thank you for replying. Kindly share the OneDrive link here. You may follow the steps in the link below.

    https://support.microsoft.com/en-us/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    Was this answer helpful?

    1 person found this answer helpful.
  3. Lester Bernard Reyes 81,845 Reputation points Independent Advisor
    2026-05-13T22:38:37.1633333+00:00

    Hi, I'm Bernard. I'm happy to help!

    Just to confirm, can you still use the affected device? If so, I need to analyze the error. Can you please check if you have Minidump files on the PC so I can further examine the root cause of the issue?

     

    Press Windows key + E (To open File Explorer)

     

    Click "This PC" > then follow the file path:

     

    C:\Windows\Minidump

     

    Copy the Minidump files and save them to another location, like the Desktop or Documents.

     

    Then please upload it to Cloud storage like OneDrive or any cloud storage you are using, and please share the shareable link here.

    To upload and share the link using OneDrive:

    Go to this link: https://onedrive.live.com/, then upload the file.

    Then, provide the shareable link by following the steps from this link: https://support.microsoft.com/en-us/office/share-onedrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    Note: This is a public forum. I may respond shortly, but I apologize in advance for any delays. I am simply a fellow user trying to provide helpful insights and information.

    Was this answer helpful?

    1 person found this answer helpful.

  4. AI answer

    2026-05-13T22:06:44.1366667+00:00

    The stop code CRITICAL_PROCESS_DIED (0xEF) indicates that a critical Windows system process (for example, csrss.exe, wininit.exe, smss.exe, services.exe, winlogon.exe) terminated or its state became corrupted. Since System File Checker and DISM did not resolve it, use a combination of general OS troubleshooting and, if possible, crash-dump analysis.

    1. Check what changed recently
    • Uninstall or roll back any recently installed device drivers, system services, or low-level utilities (AV, disk tools, VPN, overclocking tools) that were added around the time the crashes started.
    • If new hardware was added, temporarily remove or replace it and see if the crashes stop.
    1. Review Event Viewer
    • Open Event Viewer → Windows Logs → System.
    • Look for Critical or Error events that occur just before each 0xEF bug check. These can point to a specific driver, service, or hardware component.
    1. Verify drivers and devices
    • Open Device Manager and look for any devices with a yellow exclamation mark.
    • For any flagged devices, open Properties → Events to see driver issues, then update or roll back the driver.
    1. Update firmware/BIOS and run hardware diagnostics
    • Check the PC or motherboard vendor for updated BIOS/firmware and apply it if available.
    • Run the OEM’s hardware diagnostics (especially memory and storage) to rule out failing hardware.
    1. Run SFC again (already done) and confirm no corruption
    • SFC /scannow is already run; if it reports no issues now, system files are likely intact.
    1. Scan for malware
    • Run a full antivirus scan and ensure the Master Boot Record is checked, as disk corruption from malware can cause bug checks.
    1. Analyze crash dumps (if comfortable with debugging)
    • Ensure the system is configured to create memory dumps.
    • Use WinDbg and the !analyze extension to inspect the crash dumps:
      • Identify whether parameter 2 is 0 (process) or 1 (thread).
      • If it is a process, use !process to inspect the process before/after failure and look for abnormal behavior.
      • If it is a thread, use !thread to inspect the failing thread.
    • Examine multiple dumps to see if the same driver, module, or code path appears.
    • Once the suspect code or driver is identified, set a breakpoint before it runs and single-step through to find logic errors or invalid assumptions.
    1. If running in Azure (VM scenario)
    • If this is an Azure Windows VM, follow the offline repair approach:
      • Use a repair VM to attach the OS disk.
      • Run offline SFC:
        • sfc /scannow /offbootdir=<BOOT DISK DRIVE>:\ /offwindir=<BROKEN DISK DRIVE>:\Windows
      • Reassemble the VM and test boot.
      • If still failing, collect and analyze the memory dump as described in the Azure guidance.

    If none of the above identifies the cause, collect several crash dumps and escalate to support with those dumps and the associated Event Viewer logs so the failing component can be pinpointed.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.