PC CRITICAL_PROCESS_DIED (0xEF): Windows' Own Engine Stopped
In plain English: CRITICAL_PROCESS_DIED (0xEF) means an essential Windows process has stopped, so Windows has shut your PC down to protect itself and your files. This is a real stop code, not a warning from a support company, and it carries no phone number to call for help.
First safe step: CRITICAL_PROCESS_DIED, also shown as 0xEF, means one of the processes Windows needs to stay running has ended. That could be a sign-in process or a system startup process.
CRITICAL_PROCESS_DIED (0xEF) means an essential Windows process has stopped, so Windows has shut your PC down to protect itself and your files. This is a real stop code, not a warning from a support company, and it carries no phone number to call for help.
This page is part of our guide to blue screen and black screen stop codes in plain English. Before you try a fix, note when the crash happens: at startup, at random times, or only since an update. Write it down if you can.
That timing matters because one SMART drive check later in this guide separates two very different causes: files damaged by an update, and a drive that is starting to fail. Do not run repairs yet. The right first move depends on that timing and that check, and the wrong repair can waste time or risk files.
Part of the Blue Screen and Black Screen Stop Codes in Plain English series, the pillar guide for this cluster.
What this stop code means, and why the timing matters
CRITICAL_PROCESS_DIED, also shown as 0xEF, means one of the processes Windows needs to stay running has ended. That could be a sign-in process or a system startup process. Windows cannot carry on safely without it, so it stops the whole PC and shows the blue screen instead.
Before you try any repair, write down when it happens. Note whether it appears on every startup, at random while you use the PC, or only since a recent update. If you know which update came just before it started, write that name down too. Keep the note, because that timing is the first clue to the cause.
Check the screen carefully, too. A real screen shows CRITICAL_PROCESS_DIED or 0xEF and no phone number to call. If a phone number appears, read how to tell a fake blue screen with a phone number from a real one before you act. If you see the similar sign-in crash coded 0xc000021a, note it exactly. That is a different problem.
Your files are not automatically lost when this code appears. The crash means Windows stopped, not that everything on the drive was erased. Do not run a repair yet. Wait for the drive check below, because it helps separate damaged Windows files from a drive that is starting to fail.
Get back in safely when the crash keeps repeating
Try one normal restart first, and watch how far Windows gets before CRITICAL_PROCESS_DIED (0xEF) returns. Does it stop before sign-in, reach the desktop for a minute, or work for longer and then fail? Write down that stage and how long it lasted, alongside the timing you noted earlier. One clear restart gives you useful facts without extra strain.
If Windows fails again on that restart, do not keep forcing the power off to try again. Use the guide on starting Windows in Safe Mode when a PC will not boot to reach Safe Mode or the Advanced options screen instead. Follow that guide only as far as one of those screens, then stop and wait for the drive check.
Keep the PC plugged in for every attempt, especially if it is a laptop with a low or unreliable battery. Leave external drives, USB sticks and memory cards unplugged for now, even if one holds your backups. An external drive is only needed later, if the drive check shows that saving files has to come first.
If you reach Safe Mode and the same code crashes it within a few minutes, stop there and do not start repairs. A crash that quickly, even in Safe Mode, makes the failing drive path more likely than update damage on its own. Protect your files first, and use any short stable spell to copy the files you cannot replace.
Run one SMART check to split a bad update from a failing drive
Run this check in Safe Mode, or on the desktop if Windows stays up long enough. It uses a tool already in Windows, with nothing to download. The command asks for the drive's SMART report, the health information the drive records about itself, and that one result decides which path you take next.
- Select the
Start menu, type PowerShell, and select 'Run as administrator;'. If a permission box appears, select 'Yes;'. Wait for the PowerShell window to open before you type anything. - In the PowerShell window, type
Get-PhysicalDiskand press Enter. A short table appears. Find the row for your main Windows drive, which is usually the first drive listed, and read the word underHealthStatuson that row.
If the word is 'Healthy;', the drive has reported no warning. Damaged Windows files then become the working cause, especially if the crashes began after an update. Close PowerShell and continue to the next section, which repairs those files in order.
If the word is 'Warning;' or 'Unhealthy;', stop here and do not start the file repairs. Long repair scans read large parts of the drive and can stress a drive that is already failing. Skip the next section and go to the backup first path, so photos, documents, and other files you cannot replace are saved before any more work.
If Windows crashes before you can read the result, do not keep repeating the check. A PC that cannot stay in Safe Mode long enough for this short command fits the warning side more than the repair side. Protect your files first, using the backup first path, and treat any later repair as secondary.
One limit matters. A 'Healthy;' result does not prove a drive is perfect, but a warning is strong enough to change the order of every fix. The same caution applies to the freeze-first crash that can also point to storage trouble, because a failing drive can first look like a Windows file problem.
If the drive is healthy, repair the files an update damaged
Start by checking which update lines up with the first crash. Open Settings, go to Windows Update, then Update history. Look for an update marked as failed, or one installed on the day the crashes began, and write down its KB number and the install date exactly as shown. The guide to reading update history to find a failed update and its code can help match the dates.
Now repair the files in this order. Open Command Prompt as administrator, type DISM /Online /Cleanup-Image /RestoreHealth, and press Enter. DISM repairs the store of backup system files. When it finishes, type SFC /scannow in the same window and press Enter, so SFC can replace damaged live files from that repaired store. Read the final message from each check before you move on.
Together, the two runs can take 20 to 60 minutes on an older PC. Do not close the window or shut the PC down while either check is running. When both are done, restart normally and test a full startup and some normal use. Open the programs you use most during that test, and note whether CRITICAL_PROCESS_DIED returns, even if a message said files were repaired.
If the crashes clearly began with one update and the repair does not hold, remove that update next. Follow the steps for uninstalling a bad Windows update without inviting it straight back, using the KB number you wrote down. Another option is System Restore, choosing a restore point dated before that update. Restart after either change and test again before trying anything else.
Skip registry cleaners and driver updater tools for this problem. They cannot repair Windows system files, and a long list of supposed errors from a scan is not proof that the tool can fix this stop code. Stick to the tools that come with Windows for this repair.
If the drive check warns, save your files before anything else
Stop here. Do not run repair scans, and do not keep restarting to test the PC. A drive that has warned can get worse with each long scan and each crash, and the files on it matter more than another attempt to fix Windows. Use the time the PC still runs to save files, not to chase a Windows repair.
Copy your files first, in this order: photos, documents, and anything else you cannot replace, such as scans of papers or saved family videos. Copy them to an external drive or to another PC, and check that a few files open on the new copy before you do anything else. Copy, do not move, so the original stays put until the copy is checked.
Move faster if you hear clicking or grinding, if Windows freezes before the crash, or if the drive sometimes does not appear on setup screens. That freezing pattern matches the freeze-first crash that can also point to storage trouble. A drive that vanishes at startup can also lead to the code that means Windows cannot reach its own drive at startup.
Reinstalling Windows on this same drive will not fix failing hardware, so the crashes will return. The next step is the drive maker's own diagnostics, or a repair shop for a drive replacement. Take the SMART result and your note of the crash timing with you, so the shop starts from the same facts. Do that only after the backup, even if the shop could start sooner.
If it still crashes after both paths
In Safe Mode, uninstall a program or driver you added just before the crashes began, then restart once and note whether the code returns. Change only one thing at a time, so you can tell what helped. If nothing was added, skip this step.
If the code changes on some crashes, stop repeating these fixes and follow the new code instead. Note it exactly, especially the stop code that points to memory, or to something acting like memory and the freeze-first crash that can also point to storage trouble.
Only after your files are backed up, consider Reset This PC or a repair install as the last resort. Before you choose, read what Keep My Files and Remove Everything really do. If neither path held, starting again on a healthy drive is more honest than repeating repairs.
If you take the PC to a repair shop, bring a short note with CRITICAL_PROCESS_DIED (0xEF), when the crashes happen, any update installed near the first crash, and the SMART result. Add the result of removing a program or driver, too.
Frequently asked questions
What if this stop code happened only once and the PC started normally?
Write down the date and what you were doing, back up your important files while Windows is running, and then use the PC normally. If CRITICAL_PROCESS_DIED returns, treat that second crash as a pattern and check the timing and drive health before repairs.
Does CRITICAL_PROCESS_DIED mean my personal files are gone?
No. The code means Windows stopped to protect itself, and personal files are not automatically lost. Recover or copy your files before any reset or drive replacement, especially if the drive check reported a warning.
The blue screen shows a phone number. Should I call it?
No. A real screen for 0xEF carries no phone number to call. A number, voice warning, or urgent instruction to buy help points to a fake screen, so close it without calling or paying.
Conclusion
For CRITICAL_PROCESS_DIED (0xEF), the order you work in matters more than how quickly you start a repair. The timing you noted and the one drive result point to two different problems, and treating a failing drive like a damaged update can make file loss more likely, not less.
If the PC now starts and stays running through normal use, keep a current backup and stop changing settings to chase a crash that has stopped. If the code returns, stop guessing from the name alone and use the new timing and any changed code as fresh evidence.