Kmode exception not handled windows server 2016

In this latest installment of a continuing series that digs into various Windows stop errors or bug checks – also known as BSODs for “Blue Screen of Death” – we delve into the KMODE EXCEPTION NOT HANDLED error. It takes an error code value of 0X0000001E (also written as 0X1E with leading zeros between the X and larger numbers dropped). This particular error is something of a catch-all. In fact, its Microsoft Docs page (opens in new tab) observes that when this error occurs, it “indicates that a kernel-mode program generated an exception that the error handler did not catch.” Thus it represents a fall-back error handler that signals some kind of unexpected and unplanned-for exception has occurred. 

 Windows Kernel-Mode Is Where the OS Action Is

Through no coincidence whatsoever, my go-to reference for Windows internals is an MS Press book with that very name – in this case, Windows Internals, Part 1 (opens in new tab) (Mark Russinovich, David Solomon and Alex Ionescu, 6th edition, 2015). Kernel mode comes up for discussion early on this book, and I’m summarizing what’s covered there on pages 17 through 20.

First, here’s a definition for kernel mode: “…a mode of execution in a processor that grants access to all system memory and all CPU instructions.” In other words, this mode of access provides a no-holds-barred, anything-goes level of access and control over the run-time environment, the CPU, and all attached devices. In short, this is the level of access that only the most important components of the Windows OS enjoy. 

Oh, there’s one more important kind of kernel mode resident: “the kernel-mode operating system and device driver code share a single virtual address space.” That is, they run together and share the same address space and resources. This goes a long way to explaining why drivers pop up so often when discussing BSODs: there are thousands of them for Windows, and each one is a potential source of problems. Alas, sometimes that potential gets realized, and BSODs occur.

The book emphasizes the “need to take care when loading a third-party device driver.” Why? Because once it’s loaded, its code has total access to operating system data. The book labels this design explicitly as a “weakness” and observes that it explains the necessity for “the driver-signing mechanism introduced in Windows, which warns…the use if an attempt is made to add an unsigned … driver.”

Drivers Can Cause KMODE EXCEPTION NOT HANDLED 

Although not all errors that provoke this BSOD can be directly or indirectly traced back to a driver problem, most of them relate to device or firmware issues. Thus, when the BSOD labeled as KMODE EXCEPTION NOT HANDLED occurs, it may sometimes be trailed by additional explanatory text. Each such text item points you in a specific direction for further investigation, if and when it occurs: 

• Filename (e.g. ntfs.sys, netio.sys, ndis.sys, tcpip.sys, iastora.sys, and so forth). This provides information about the name of some file from which the error originated. It points to system aspects or components where further investigation will help. Ntfs.sys points to the NT File System, and thus to disk drives and file access. Ndis.sys points to the Windows Network Driver Interface Specification and thus to network interfaces and access. TCP/IP is the network protocol of choice on Windows networks and for Internet access. Iastor is part of Intel’s Rapid Storage Technology (RST), often associated with drive arrays or high-end, high speed storage devices.
•  Overclock: indicates that failure is related to base, CPU or memory clock rate on a PC (usually appears only on deliberately overclocked systems). Usually best addressed by turning off CPU overclocking, or backing off from current timing levels.
• RAM: indicates that a memory fault may be the source of the error. Often requires replacing one or more memory modules to fix.
• USB: Could indicate a bad USB driver (which can pop up at the class, controller or device level) or a faulty or failing USB device. Easy to check by unplugging all USB devices except mouse and keyboard. Assuming those are working, plug in other USB devices one at a time until the error recurs.
• Not handled during install: Indicates a failure during OS install related to a corrupt or invalid driver that does not work with your PC.
• Loop: generally associated with graphics card drivers that won’t load, causing the OS to try and fail to load them repeatedly (in a loop, in the terms of the error text itself). Usually requires replacing the graphics card driver (or occasionally, the graphics card itself). 

Corrupt / Missing Device Drivers Can Cause KMODE EXCEPTION NOT HANDLED 

If drivers are missing, they will show up as Unknown Devices in Device Manager. Because Windows can’t find the drivers itself, you must dig into the Details tab for such devices. You can use the Hardware IDs information (see following screencap) to look up devices and find associated drivers. 

Normally, the information surrounding the BSOD will point you to specific devices or drivers. Your best bet is to make an image backup of your system (to which you can always revert if things get worse), and then to replace the existing driver with a known, good working copy of the same version, if a newer version is not available.

On the other hand, if a newer driver doesn’t help – as may be the case on older systems – you may need to install an older driver instead of a newer one. Websites such as Station Drivers maintain archives of drivers that go back 5 or more years. It’s an excellent source for newer drivers than you may find at the OEM site, but also for older drivers that the OEM no longer makes available. 

Network Driver Errors and Fixes for KMODE EXCEPTION NOT HANDLED 

If you get a text string that includes any of the following: netio.sys, ndis.sys, tcpip.sys, and so forth, all of these things point to issues with networking. NDIS is the basis for all network interface drivers, and netio refers to the ability to send and receive data over. TCP/IP is the primary networking protocol stack used to send and receive information across a network. 

For any and all of these issues, your best bet is to uninstall the current network interface drivers in Device Manager, and then to reboot your PC. During boot-up Windows should manage to find and install the latest (and working) network driver on your behalf. If that doesn’t work, you’ll have to turn to sites like the afore-linked Station Drivers to look for drivers that work on your particular PC. Warning: the older your PC, the more interesting and challenging this exercise can become. The short version of this particular fix is: Update network drivers! 

Antivirus Conflicts Can Cause KMODE EXCEPTION NOT HANDLED 

Some reports blame specific antivirus programs as culprits in causing BSODs labeled KMODE EXCEPTION NOT HANDLED. If the previous solutions provide no relief, you might try suspending or uninstalling your antivirus software – assuming it’s something other than Windows Defender – to see if that helps. 

If it does help, there’s no longer any reason to avoid Windows Defender as your go-to AV protection. It now rates as high as most third-party commercial packages at such rating sites as AV-Comparatives and Virus Bulletin. 

Still Having Problems? Try the Repair Maneuvers 

If none of the preceding suggestions help your situation (and they should  for 90-plus percent of readers) I recommend running the following commands at the command line: 

DISM /online /cleanup-image /restorehealth 
SFC /Scannow

If those don’t fix things, it’s time to run a repair install of Windows. If you still get no joy, your only remaining option is a clean install of Windows (10 or 11, whatever your version might be) with hopes that this will finally cure your ills. 

Ed Tittel is a long-time IT writer, researcher and consultant, and occasional contributor to Tom’s Hardware. A Windows Insider MVP since 2018, he likes to cover OS-related driver, troubleshooting, and security topics.