When the machine crashes once a week and the dump names nothing useful, Driver Verifier makes the offending driver fail immediately instead of silently corrupting memory.
Run **verifier /standard /all**, reboot and reproduce the crash, then read the dump. Always set **verifier /bootmode resetonbootfail** first so a boot loop ends by itself.
Verifier makes bad drivers crash on purpose, and a driver that loads during boot can crash before the desktop. A **restore point** and a known recovery path are part of the procedure, not optional.
Checkpoint-Computer -Description 'Before Driver Verifier' -RestorePointType MODIFY_SETTINGS
Get-ComputerRestorePoint | Select-Object -Last 1 SequenceNumber,Description**resetonbootfail** disables Verifier automatically after a failed boot. Without it a single bad driver turns the machine into a boot loop you have to repair from outside.
verifier /bootmode resetonbootfail
verifier /querysettings**/standard** covers the rules that catch real bugs without the noise of the full set. **/all** applies it to every third-party driver, which is thorough and slow.
verifier /standard /all
verifier /querysettings | Select-String -Pattern 'Standard|Verify|Drivers'Nothing happens until the driver is loaded and used. Work normally, run the app that crashes, and let it fail. The intended outcome is a blue screen with the driver name in it.
shutdown /r /t 0
:: after the crash and reboot
Get-WinEvent -FilterHashtable @{LogName='System'; Id=1001} -MaxEvents 3 | Select-Object TimeCreated,MessageVerifier writes a dump that names the driver and the rule it broke. The minidump folder holds the file; the bugcheck event names the code.
Get-ChildItem C:\Windows\Minidump | Sort-Object LastWriteTime -Descending | Select-Object -First 3 Name,Length,LastWriteTime
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41} -MaxEvents 1 | Select-Object TimeCreated,MessageLeave it on and the machine runs slowly forever. **/reset** clears the settings, and the boot mode returns to normal after the next successful start.
verifier /reset
verifier /querysettings
bcdedit /deletevalue {default} bootstatuspolicyThat is what resetonbootfail is for; it disables Verifier after one failure. If it does not, boot into Safe Mode and run verifier /reset there.
The faulty driver is not being exercised. Enable Verifier for one suspect driver at a time with /standard /driver name.sys and use the hardware or app that fails.
Expected. Verifier checks every pool operation; leave it active only until you have the dump.
Usually the victim, not the cause. Look at the stack and at third-party filter drivers loaded around it, and update those first.
It can force a crash that would have happened anyway, and it makes the crash immediate and attributable. With a restore point and the boot mode set, the risk is manageable.
The bugcheck event names the code and often the driver. For the full stack you need the Windows debugging tools and a symbol path.
Run verifier /reset, delete the bootstatuspolicy value with bcdedit /deletevalue {default} bootstatuspolicy, and reboot. If the machine is already in a boot loop, use the restore point.
Free · no account needed · tracks your progress