Skip to content
PCDecoder
Event ID 1001BugCheck: the computer has rebooted from a bugcheckEvent IDWidely reported

Event ID 1001 BugCheck: the computer has rebooted from a bugcheck

Updated Oct 23, 2026 · Checked against Microsoft documentation · How this page is made

Quick answer

Event ID 1001 is recorded by Windows Error Reporting after your PC experiences a blue screen crash (bug check) and restarts. It captures the crash code and notes where the diagnostic memory dump was saved. The first step is to check the bug check code recorded in the event log and inspect recent driver or system updates.

What it means

When Windows encounters a critical problem from which it cannot safely recover, it halts the operating system to prevent data corruption. This condition is known as a bug check or Stop error, commonly seen as a blue screen. Once the computer restarts, the Windows Error Reporting system writes Event ID 1001 to the System event log.

The message typically reads: "The computer has rebooted from a bugcheck. The bugcheck was: 0xXXXXXXXX. A dump was saved in: C:\Windows\MEMORY.DMP." This event confirms that the previous shutdown was not planned and provides diagnostic details.

Understanding the Event Log Details

Event ID 1001 logs the specific bug check hex code alongside four parameters in parentheses, followed by the file path to the saved dump file and a Report ID GUID. The bug check code reveals the specific category of the failure. For example, a code like 0x0000009F indicates a driver power state failure. Windows saves crash state details directly into C:\Windows\MEMORY.DMP or a smaller minidump file so the failure can be investigated.

How Event ID 1001 Connects to Other Events

An unexpected reboot generates a sequence of related event log entries. While Event ID 1001 provides the specific crash code and confirms the memory dump creation, Event ID 41 from Kernel-Power is logged because the PC did not shut down cleanly first. Furthermore, Event ID 6008 indicates that the previous shutdown was unexpected.

In contrast, an orderly shutdown involves Event ID 1074, which specifies the process that requested the shutdown, along with Event ID 13 when the kernel begins shutting down. When troubleshooting Event ID 1001, reviewing earlier events—such as Event ID 19 (Windows Update installations) or Event ID 7045 (new service installations)—can reveal if a recent driver update or software installation triggered the crash.

Common causes

  • A faulty, corrupted, or recently installed device driver triggered a kernel Stop error.
  • A recent Windows cumulative update or software installation introduced instability.
  • Hardware instability, such as failing memory chips or hardware overheating.
  • Power delivery failure or an insufficient power supply unable to handle system demands.
  • Improper hardware overclocking settings causing operational faults.

How to fix it

Safest and most likely fixes first. Readers' answers to "Did this fix it?" reorder this list over time.

  1. Roll back or remove recently installed drivers

    Use when the bug check began shortly after updating a driver or when Event ID 7045 shows a newly installed driver service.

    1. Right-click the Start menu and select Device Manager.
    2. Locate the category of the device updated prior to the crashes.
    3. Right-click the device and select Properties.
    4. Select the Driver tab.
    5. Click Roll Back Driver if the option is available, then restart the PC.
    Did this fix it?

  2. Filter the System log to find crash triggers

    Use to review the exact bug check code and check what system changes occurred immediately before the crash.

    1. Press the Windows key, type Event Viewer, and press Enter.
    2. Expand Windows Logs and select System.
    3. Click Filter Current Log in the Actions panel on the right.
    4. In the Event IDs field, enter: 12, 13, 19, 41, 1001, 1074, 6008, 6009, 7045.
    5. Click OK to inspect events leading up to the unexpected shutdown timestamp.
    Did this fix it?

  3. Disable system overclocking

    Use if your processor or memory has been overclocked beyond standard factory speeds.

    1. Restart your computer and enter your motherboard BIOS or UEFI setup menu.
    2. Locate the overclocking, frequency, or performance configuration settings.
    3. Set CPU and RAM frequencies and voltages back to their default or standard specifications.
    4. Save changes and reboot into Windows to verify system stability.
    Did this fix it?

  4. Prevent automatic restarts to capture error details

    Use if your computer crashes and restarts so quickly that you cannot read the blue screen error code.

    1. Open Settings, navigate to System, and select About.
    2. Click Advanced system settings to open the System Properties window.
    3. Under the Advanced tab, click Settings in the Startup and Recovery section.
    4. Clear the check box next to Automatically restart.
    5. Click OK to apply the change.
    Did this fix it?

  5. Check system memory health

    Use when bug check codes are inconsistent or point to memory corruption.

    1. Press the Windows key, type Windows Memory Diagnostic, and press Enter.
    2. Select Restart now and check for problems.
    3. Allow the diagnostic test to complete fully upon system restart.
    4. Log back into Windows and inspect the diagnostic results in Event Viewer.
    Did this fix it?

Is it just you?

25+ Microsoft Q&A threads discuss this. Most recent activity:

Checked Oct 22, 2026. Refreshed automatically every few days.

Sources

Frequently asked questions

What is the difference between Event ID 1001 and Event ID 41?

Event ID 41 is logged by Kernel-Power simply to report that the computer restarted without a clean shutdown. Event ID 1001 is recorded by Windows Error Reporting and provides the exact bug check code and the path to the memory dump.

Where is the memory dump file saved after Event ID 1001?

The event description details the exact save location, which by default is saved as C:\Windows\MEMORY.DMP.

Why does Event ID 41 show zero for the bug check code while Event ID 1001 exists?

Windows may fail to record the code in Event ID 41 if the power cut immediately or if disk writing was blocked. Event ID 1001 specifically logs the bug check data once Windows Error Reporting initializes upon restart.

More event ids decoded