DRIVER_IRQL_NOT_LESS_OR_EQUAL: Step-by-Step Diagnosis (2026 Updated Guide)

Quick answer

DRIVER_IRQL_NOT_LESS_OR_EQUAL (stop code 0x000000D1) means a specific kernel driver tried to access memory at the wrong privilege level. It is not the same as IRQL_NOT_LESS_OR_EQUAL (stop code 0x0000000A), and the fix path is different. The minidump file Windows wrote when it crashed names the driver responsible — read that name, update or remove that one driver, and you’ve solved the case 80% of the time.

Before you start

Do not install a “driver updater” or “driver booster” tool. Search results for this stop code are saturated with them. They are unhelpful at best — installing drivers from a third party that aren’t signed for your specific hardware can introduce new instability — and at worst they’re potentially unwanted programs that bundle adware. The driver you actually need comes from your hardware vendor: NVIDIA, AMD, Intel, Realtek, your motherboard manufacturer, or your laptop OEM. Anyone selling a one-click solution is selling you the icon, not the function.

If you’re seeing this stop code on a corporate-managed device, stop and contact your IT helpdesk. Your organisation has driver baselines and crash telemetry; trying to fix it yourself can break compliance.

If the crashes are repeating, back up your data before any advanced repair work — particularly before anything that touches the storage controller driver.

Reboots between diagnostic steps are not optional. Driver changes don’t fully apply until restart, and reading minidumps from a crash that hasn’t completed gives you misleading information.

What this error means

DRIVER_IRQL_NOT_LESS_OR_EQUAL is a kernel-mode protection violation. Windows runs at multiple Interrupt Request Levels (IRQLs); some operations are only safe at low IRQLs, and accessing pageable memory while running at a high IRQL is forbidden. When a driver violates that rule, Windows raises stop code 0xD1 and crashes to protect the system from corrupted memory state.

The “DRIVER_” prefix is the important part. There are two stop codes here that look similar and sound identical when read aloud:

0x0000000A — IRQL_NOT_LESS_OR_EQUAL. A general kernel-mode violation. Could be a driver, could be the kernel itself, could be hardware.
0x000000D1 — DRIVER_IRQL_NOT_LESS_OR_EQUAL. Specifically a driver-caused violation. The driver that did it is named in the minidump.

Most online guides treat these as one error. They aren’t. The 0xD1 variant is significantly easier to diagnose because Windows tells you exactly which driver crashed. The fix path follows from that name.

If your blue screen actually said IRQL_NOT_LESS_OR_EQUAL without the DRIVER_ prefix, the cause is more open-ended — RAM, an overclocking issue, the storage subsystem, or any driver. The diagnostic logic still starts with the minidump, but the candidate causes are wider.

Where this error appears

DRIVER_IRQL_NOT_LESS_OR_EQUAL most often shows up:

At idle, intermittently. A background driver — usually network or audio — failing periodically.
When connecting or disconnecting a USB device. Points firmly at the USB controller driver or a chipset driver.
On wake from sleep. Power-state transitions are where buggy drivers fail; this is one of the most common patterns.
During gaming or graphics-intensive work. Almost always the GPU driver.
During heavy network activity. A WiFi or Ethernet driver — common with Intel WiFi 6E and AX-series adapters in 2025–2026.
Shortly after a Windows feature update. Cumulative updates that change kernel APIs sometimes break older third-party drivers that haven’t been updated.

The pattern matters. A crash that only happens during gaming and never during web browsing isn’t a system-wide problem; it’s a GPU driver problem.

Common causes

In rough order of frequency in 2025–2026:

Network drivers — especially Intel WiFi adapters. A long-running cause of 0xD1 reports on Windows 11. Update through Intel’s Driver & Support Assistant from Intel’s site, or through your laptop OEM’s support utility.
Graphics drivers. NVIDIA nvlddmkm.sys and AMD amdkmdag.sys are the two filenames you’ll most often see in the minidump.
Recently installed third-party software with a kernel driver. VPN clients, antivirus, hardware-monitoring tools (RGB controllers, fan-control utilities), peripheral software (gaming mice, headset configurators).
Storage drivers. Less common than graphics or network, but more dangerous when they happen — corrupted writes can damage data.
A bad BIOS/UEFI version. Particularly on systems where the platform firmware hasn’t kept pace with Windows updates. Check the manufacturer’s site for the most recent stable BIOS.
Overclocked or unstable RAM. XMP/EXPO profiles that work for most boots but fail under specific load patterns produce intermittent IRQL crashes.

The pattern in the dump file usually nails it. Don’t guess; read.

Fixes to try first

1. Read the minidump and identify the driver.

This is the single most useful step on this page. Open File Explorer and navigate to C:\Windows\Minidump. The file names are dates and times — the most recent one is your most recent crash.

You don’t need a debugger to get useful information. The file C:\Windows\MEMORY.DMP (the larger kernel dump, if your system is configured to write one) and the minidumps both contain a string near the beginning that names the driver in IMAGE_NAME format. The simplest reading approach without installing anything:

Right-click the .dmp file → Open with → choose Notepad
Use Ctrl+F to search for .sys
The first .sys file referenced is usually the driver Windows blamed

That said, the proper tool is WinDbg Preview, free in the Microsoft Store. Install it, open the .dmp file, run !analyze -v, and look at the MODULE_NAME and IMAGE_NAME fields. That’s your suspect.

Common driver name translations:

nvlddmkm.sys → NVIDIA graphics
amdkmdag.sys or atikmdag.sys → AMD/ATI graphics
igdkmd64.sys → Intel integrated graphics
iastorvd.sys or iastora.sys → Intel Rapid Storage Technology
Netwtw06.sys, Netwtw08.sys, Netwtw10.sys → Intel WiFi
bcmwl63a.sys, bcmwl63ax.sys → Broadcom WiFi
Killer*.sys → Killer Networking (now part of Intel)
RtsUStor.sys → Realtek card reader
ndis.sys → Windows networking core (the actual cause is usually a network driver, not ndis itself)

2. Update the named driver — from the right source.

Find your hardware vendor’s website. NVIDIA, AMD, and Intel each have official driver download pages. Don’t use third-party “driver finder” sites. For laptop hardware (WiFi cards, audio chips, fingerprint readers), use the laptop OEM’s support page rather than the chip vendor’s — OEMs sometimes ship customised drivers that the generic chip-vendor version doesn’t replicate.

If the most recent driver from the vendor matches what you’ve already got installed, try the previous stable version. Vendors don’t always make older versions easy to find, but they exist on archive pages — search the vendor site for “previous drivers” or “driver archive.”

3. Roll back the driver if it updated recently.

Open Device Manager (Windows + X → Device Manager), find the device, right-click → Properties → Driver tab → Roll Back Driver. If the button is greyed out, the previous version is no longer cached. In that case, uninstall the driver (Properties → Driver → Uninstall device, with “Attempt to remove the driver software” ticked), then reboot — Windows will reinstall a generic Microsoft driver, which is usually stable even if not optimal.

4. Test in Safe Mode.

Hold Shift while clicking Restart from the Start menu. Choose Troubleshoot → Advanced options → Startup Settings → Restart, then press 4. Use the system in Safe Mode for 15–30 minutes. If DRIVER_IRQL_NOT_LESS_OR_EQUAL stops, the problem is a third-party driver — confirmed. If it persists, the problem is a Microsoft-shipped driver, the kernel itself, or hardware.

5. Run system file integrity checks.

Once you’ve ruled out the obvious driver culprits, run a clean DISM and SFC pass. The DISM and SFC guide explains why DISM goes first and what to watch for.

Advanced fixes

Update BIOS or UEFI firmware.

Check your motherboard or laptop manufacturer’s site for BIOS updates released in the last six months. Read the changelog before applying — you’re looking for entries about Windows 11 stability, power management, or chipset compatibility. Apply BIOS updates carefully, with the laptop on AC power or the desktop on a UPS. A failed BIOS update produces a brick.

Test RAM with Windows Memory Diagnostic.

Settings → Search → “Windows Memory Diagnostic” → Restart now and check for problems. The test takes 10–30 minutes and reports any errors. For a more thorough test, MemTest86 (free, runs from a USB stick) tests RAM more aggressively and catches problems Microsoft’s tool can miss. Either way, intermittent IRQL crashes that nothing else explains are often RAM.

Check whether you’re running an XMP/EXPO RAM profile.

If you’ve enabled XMP (Intel) or EXPO (AMD) for higher-than-stock RAM speeds, disable it temporarily in BIOS and run at default JEDEC speeds. Some RAM kits aren’t fully stable at their advertised XMP speeds with all combinations of motherboard, CPU, and BIOS. If the crashes stop at default speed, the kit is unstable at XMP — either accept the lower speed, manually tune timings, or RMA the kit.

Check for kernel-mode software conflicts.

Open Settings → Apps → Installed apps. Look for: VPN clients, third-party antivirus, hardware-monitoring or RGB control software, gaming peripheral configurators, “system tweaker” tools. Anything kernel-level that you installed in the last few weeks. Uninstall the most recent additions one at a time, rebooting between each, and watch whether the crashes stop. A surprising number of 0xD1 cases trace back to RGB software.

If you are on a work or school device

Stop. Don’t update drivers, don’t uninstall software, don’t change BIOS settings. Open a ticket with IT and tell them: when the crashes started, what changed beforehand, what driver name appears in C:\Windows\Minidump\ if you can get to it, and whether Safe Mode is stable.

Your organisation has driver baselines for a reason. Updating to a newer driver from a vendor site can break things their managed configuration depends on.

When to stop

Stop your own troubleshooting when:

Crashes are accelerating in frequency. Hardware failure starts mild and gets worse; back up your data immediately and stop using the system as your main machine.
The minidump consistently names a driver you’ve already updated to the most recent version, and the previous version also crashes. The fault is probably hardware, not software — the driver is just the messenger.
BitLocker is active and you don’t have your recovery key. Don’t run anything that touches storage drivers without the key in hand. Find it at aka.ms/myrecoverykey first.
You’re being told to “scan with [tool] to find driver problems” by anything that isn’t your hardware vendor’s official utility. Close the tab.
You’ve worked through every step above and the cause is unclear. At that point, hands-on hardware diagnosis is more productive than continuing software work.

CRITICAL_PROCESS_DIED: Safe Diagnostic Steps — when the same diagnostic logic applies to a different stop code
How to Run DISM and SFC Safely — the system file integrity tools, run in the right order

Official references

FAQ

What’s the difference between IRQL_NOT_LESS_OR_EQUAL and DRIVER_IRQL_NOT_LESS_OR_EQUAL?

The first (stop code 0xA) is a general kernel-mode memory access violation — could be any kernel-mode component including drivers, the kernel itself, or hardware errors. The second (stop code 0xD1) is specifically a driver violation, with the driver name available in the minidump. The diagnostic path for 0xD1 is more direct because Windows tells you which driver to investigate.

Can a virus cause DRIVER_IRQL_NOT_LESS_OR_EQUAL?

Almost never on a system with current Microsoft Defender or comparable protection. The stop code names a driver, not malicious code. If your antivirus is up to date and shows clean, this isn’t your cause. Don’t pay for “advanced removal tools” that claim to fix BSODs — that’s a common scam pattern.

Should I use a driver-updater program?

No. The recommendation isn’t from caution, it’s from accuracy: third-party driver updaters install generic drivers that may not match your exact hardware, and they regularly install drivers that are older than the versions your hardware vendor or Windows Update would provide. Several are flagged as potentially unwanted programs by Defender. Use the manufacturer’s official site or Windows Update.

What if WinDbg or Notepad won’t open the minidump file?

Make sure you’re opening the file in C:\Windows\Minidump\ (the small dumps), not C:\Windows\MEMORY.DMP — the latter requires the full debugger. Some antivirus products block .dmp file access; temporarily allow access if needed. If you genuinely can’t open it, BlueScreenView (NirSoft, free, signed) reads minidumps and shows the driver name in a clean table. It’s one of the few legitimate third-party tools in this space.

The minidump names ntoskrnl.exe — what does that mean?

ntoskrnl.exe is the Windows kernel itself. When it appears as the failing module, the kernel is reporting on a problem caused by something else — usually the previous frame in the call stack names the actual culprit. Run !analyze -v in WinDbg and look at the full stack rather than just the top entry. If the stack genuinely points only at ntoskrnl with no third-party driver in sight, RAM or storage hardware is the next thing to test.

Will an in-place upgrade fix this?

Sometimes — if the cause is a corrupted Microsoft-shipped driver. If the cause is a third-party driver, RAM, or BIOS firmware, an in-place upgrade won’t help because those persist through the upgrade. Try driver work first; in-place upgrade as a fallback.

↑ Back to top