Page Fault in Nonpaged Area on Windows 11: Diagnose and Fix 0x50

Microsoft's consumer stop-error guide recommends recording the stop code and any module listed after What failed. Capture these before a cleaner, reset or reinstall removes useful evidence:

1. The complete stop code: PAGE_FAULT_IN_NONPAGED_AREA and, when shown, 0x50.
2. The exact .sys filename after What failed.
3. What the PC was doing: starting, waking, gaming, scanning, copying files, updating or sitting idle.
4. The newest driver, Windows update, antivirus/VPN, anti-cheat, tuning utility, peripheral or hardware change.

If %SystemRoot%\Minidump contains recent .dmp files, copy them to a private folder before cleanup or recovery. On a standard installation this is normally C:\Windows\Minidump. Dumps can contain system or memory details, so do not post them publicly.

Shut down and disconnect only nonessential hardware added before the first crash: a dock, capture device, external drive, USB audio device, controller, Bluetooth adapter or second display. Keep the keyboard, mouse, primary display and system drive connected.

• If the crash stops, reconnect one item at a time and use that device maker's exact driver or firmware page.
• If the issue began after installing a VPN, antivirus, anti-cheat, RGB, monitoring or tuning tool, update that exact product first. If necessary, use its official clean-uninstall instructions for one comparison test.
• Return CPU, GPU, RAM, XMP or EXPO tuning to the PC or motherboard maker's supported defaults while testing.
• Do not reset the BIOS, flash firmware or change storage-controller mode just to see what happens.

Open Settings → Windows Update, install current supported updates, and restart. Keep adequate free space on the Windows drive so updates and dumps can complete.

• Install the standard cumulative and security updates first.
• Do not install every optional driver at once. Use one only when it matches the device branch you are testing.
• If the first crash followed an update, record that timeline before installing another version; the rollback branch below may be more informative.

If the stop screen or repeated dumps name a third-party .sys file, identify which installed device or product owns it. Right-click Start → Device Manager, open the matching category, then record the device's Driver Provider, date and version under Properties → Driver.

• If the crashes began immediately after that driver changed, use Roll Back Driver when Windows offers it.
• Otherwise, use Windows Update or the exact PC, motherboard, GPU, network, storage, dock or device maker's official support page.
• For a third-party antivirus, VPN, backup filter, anti-cheat or hardware utility, use the product vendor's supported update or removal path.
• Do not download a loose .sys file, delete the named file, or use a bulk driver-updater app.

Microsoft's driver instructions document both update and rollback. If a Windows component such as ntoskrnl.exe, ntfs.sys or another core module is named, do not replace it. A core module can be where bad data became visible rather than the original source.

Open Settings → System → Recovery → Advanced startup → Restart now. In Windows Recovery, choose Troubleshoot → Advanced options → Startup Settings → Restart, then select Safe Mode. If Windows cannot reach the desktop, use Startup Settings from the recovery screen.

• If Safe Mode is stable, a third-party driver, service, startup component or optional device becomes more likely.
• Use Safe Mode to roll back the exact recent driver or uninstall the exact recent software change.
• If the problem followed a Windows update and Windows cannot start normally, review the supported update-removal and System Restore choices in Windows Recovery Environment.
• Safe Mode stability narrows the branch; it does not identify the guilty component by itself.

Use this branch when no driver repeats, crashes show several different modules or stop codes, the PC fails under varied workloads, or the issue began after a RAM change.

1. Save your work, press Win + R, enter mdsched.exe, and choose Restart now and check for problems.
2. After Windows restarts, open Event Viewer and search the System log for MemoryDiagnostics-Results.
3. If the diagnostic reports an error, stop software repair attempts and use the PC or memory maker's hardware support path.
4. If it passes, do not treat that as proof that every memory component is perfect. Compare several dumps and triggers before buying parts.

Microsoft includes Windows Memory Diagnostic in its 0x50 guidance because defective main memory, cache and video memory can produce invalid references. Test at supported hardware settings; do not increase voltage or change memory timings as a general fix.

Press Win + R, enter perfmon /rel, and review the day of each crash. Then open eventvwr.msc and check Windows Logs → System around the recorded time.

• Record the source, event ID, time and full message for repeating device, display, network, security, storage or file-system events.
• Kernel-Power Event ID 41 confirms that Windows did not shut down cleanly; it does not identify the original cause.
• Compare at least two crashes. The same nearby device event plus the same trigger is more useful than a single unrelated warning.

For repeating crashes, install Microsoft's current WinDbg, open a copied dump from %SystemRoot%\Minidump, and enter !analyze -v. Microsoft's small-dump guide explains that a dump includes the stop message, parameters, loaded drivers and the stopped thread's kernel stack.

• Record the bug-check code, MODULE_NAME, IMAGE_NAME, FAILURE_BUCKET_ID and the first clearly named third-party modules when present.
• Compare two or more dumps. A repeated third-party module is more persuasive than a different name in every crash.
• Do not delete a file because WinDbg mentions it. Confirm which product owns it and whether its trigger and update date fit.
• If the output names only a Windows core component, keep investigating the stack and timeline rather than replacing Windows files manually.

Windows-file branch

If Windows Update also fails, protected Windows files are damaged, or logs point to component corruption, open Terminal (Admin) and use Microsoft's documented order:

1. Run DISM.exe /Online /Cleanup-Image /RestoreHealth.
2. After DISM completes successfully, run sfc /scannow.
3. Restart and repeat the original safe trigger.

Microsoft's DISM and SFC instructions use DISM first so SFC has a healthy repair source. These tools repair Windows components; they do not identify defective RAM or a faulty third-party driver.

Storage or NTFS branch

Use this branch only when the crash aligns with file copies, storage events, corrupted files, a disappearing drive or a Windows storage warning. Back up readable data first. Start with chkdsk C: /scan; reserve repair and surface-scan options for actual evidence and a safe backup.

If Windows shows a critical storage warning, Microsoft recommends backing up immediately and reviewing the device's health details. Repeated long scans are not a substitute for hardware support.

If the crash began after a known installation and targeted rollback is unavailable, review Microsoft's Windows recovery options and choose the least destructive match. Confirm that important files and the BitLocker recovery key are safe first.

• System Restore can undo a recent system-level change when a suitable restore point exists.
• An in-place reinstall started from a running Windows session can preserve files and apps when the correct option is selected. Booting from installation media is a different, destructive path.
• Reset or clean installation is a last resort. A crash that continues during recovery or Windows setup raises the need for hardware, firmware or boot-driver diagnosis.