Event ID 1001 with source WER-SystemErrorReporting and text “The computer has rebooted from a bugcheck” means Windows hit a blue screen (bug check) and then restarted. Event ID 41 Kernel-Power is the corresponding critical event that records the unexpected restart.
The entry shown:
The bugcheck was: 0x0000001e (0xffffffffc0000096, 0xfffff802a7c31f28, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:\WINDOWS\Minidump\032626-17953-01.dmp.
confirms that a crash dump was written. To find the cause, the minidump files must be analyzed with the Windows debugger tools (WinDbg or KD). In a debugging session, the .bugcheck command can be used to display the bug check data from the dump, and then !analyze can help identify the failing driver or module.
Key points and next steps:
- Confirm the reboot cause in Event Viewer
In Event Viewer → Windows Logs → System, filter for:
- Event ID 1001 (source WER-SystemErrorReporting) – shows the bugcheck code and dump path.
- Event ID 41 (source Kernel-Power) – indicates the system restarted without a clean shutdown.
- Collect the minidumps
The path in the event (C:\WINDOWS\Minidump\*.dmp) contains the crash data. Copy the latest 3–5 .dmp files to a separate folder for analysis.
- Analyze the dumps with WinDbg (high‑level outline)
- Install the Windows debugging tools (WinDbg).
- Open WinDbg and load one of the
.dmp files.
- Run:
-
.bugcheck – to display the bug check code and parameters from the dump.
-
!analyze -v – to get a detailed analysis and see if a specific driver or module is blamed.
- If a driver is implicated
Many bugchecks are caused by faulty or incompatible drivers. Once the problematic driver is identified from the dump analysis, update or remove that driver (for example, display, storage, or other third‑party drivers) using the vendor’s latest version.
If further help is needed, share the output of .bugcheck and !analyze -v from one of the minidumps so that the failing component can be pinpointed more precisely.
References: