Where is the log of the blue screen caused by Exploit Protection of Windows Secutiry

Question

This is not urgent.

Since I enabled the Exploit Protection of Windows Security (Windows 10 Home 20H2), I experienced the blue screen sometimes. It happens when running programs or just after sign-in. As for programs, I can add the program to the exception list. But for the blue screen just after signing in, I cannot decipher. The blue screen shows the cause like BAD_POOL_CALLER, but "by what?" The blue screen soon restarts Windows automatically and I cannot remember its details. It cannot be reproduced, a rare case, so it is not an urgent problem.

Where is the log of the blue screen?
I appreciate any suggestions.

Answer 1

Hi noellapin,

Welcome to Microsoft Q&A.

Please check if there is Event ID 1001, please note the time point when the problem occurred. You can find the dump file under C:\Windows\MEMORY.DMP , and below is the steps of analyzing the dump file:
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg

Usually, unexplained reboots are caused by the following.

Unstable hardware devices, expired device drivers, interference from three-party programs, and system abnormalities.

Has any special operation been done during this time? For example, certain drivers were installed, certain patches were updated/certain software was installed. It is recommended that you can undo the previous changes step by step.

Best regards,
Molly

--------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thank you for your helpful explanation.