Usually when your system blue screens and you get a stop error, an event is written to your System log. This even is Event ID 1003 and has the event source System Error and it contains the error code and the four parameters from your start screen. It’s important to check for this event in Event Viewer if you have your system configured to automatically restart after a stop screen (this is the default) as you may never actually see the stop screen, but you’ll need the error code at the minimum in order to try and troubleshoot.
Just a warning though—not all stop screens write this event to the System log. Sometimes your system crashes in such a way that it simply can’t do this! If you think this is happening, configure your system *not* to automatically restart after a stop screen (unless it’s a mission critical server).
***
Mitch Tulloch is President of MTIT Enterprises, an IT content development company based in Winnipeg, Canada. Prior to starting his own company in 1998, Mitch worked as a Microsoft Certified Trainer (MCT) for Productivity Point International. Mitch is a widely recognized expert on Windows administration, networking and security and has written 14 books and over a hundred articles on various topics. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy Microsoft platforms, products and solutions. Mitch is also a professor at Jones International University (JIU) where he teaches graduate-level courses in Information Security Management (ISM) for their Masters of Business Administration (MBA) program. For more information see http://www.mtit.com.
