A single, self-contained PowerShell toolkit that finds out why a Windows machine is throwing Blue Screens and walks you through fixing it: bugcheck decoding, crash-dump analysis, system and storage repair, memory and driver diagnostics, Driver Verifier control, and a polished HTML health report.
Version 1.1.0 · MIT License · PowerShell 5.1+ · Windows 10 / 11
When Windows crashes with a stop error, the cause is hidden across several
places: the event log, minidump files, driver timestamps, SMART data and the
component store. BlueShield gathers all of it in one pass, translates the cryptic
0x000000XX stop code into plain causes and fixes, and offers safe, built-in
remediation. It uses only the diagnostic and repair utilities already shipped
with Windows (sfc, DISM, chkdsk, mdsched, verifier, Get-WinEvent, the optional
Microsoft debugger). No third-party binaries are bundled.
| Area | What it does |
|---|---|
| System snapshot | OS build, architecture, firmware/BIOS, CPU, RAM, uptime |
| BSOD history | Parses BugCheck (1001) events; correlates Kernel-Power 41 and EventLog 6008 |
| Bugcheck decoding | Built-in database of 57 common stop codes with causes and fixes |
| Dump discovery | Enumerates C:\Windows\Minidump and MEMORY.DMP with sizes and dates |
| Header read | Extracts the bugcheck directly from kernel dump headers without a debugger |
| Deep dump analysis | Drives WinDbg / kd.exe to run !analyze -v and parses the result |
| System integrity | sfc /scannow and DISM /RestoreHealth (and Check/Scan health) |
| Storage health | SMART reliability counters, online chkdsk /scan, scheduled chkdsk /f /r |
| Memory | Launches Windows Memory Diagnostic and reads previous results |
| Driver health | Problem devices, drivers changed in the last 30 days, third-party inventory |
| Driver Verifier | Query, enable on a list, enable on all, or reset (with recovery guidance) |
| Guided repairs | Disable Fast Startup, reset Windows Update, reset power plan, clear temp |
| Security posture | Secure Boot, Microsoft Defender and BitLocker status at a glance |
| Driver risk scoring | Flags unsigned, very old, or known-vulnerable (BYOVD) drivers present on the host |
| Reporting | Self-contained styled HTML report, plus JSON and CSV export |
| Configuration | Tunable via data/BlueShield.config.json |
| Logging | PowerShell transcript plus a structured JSON-lines log |
- Windows 10 or Windows 11 (also works on Windows Server 2016+).
- Windows PowerShell 5.1 (preinstalled) or PowerShell 7+.
- Administrator rights (the script self-elevates with a UAC prompt).
- Optional for deep dump analysis: the Windows debugger (
kd.exe/ WinDbg). Install withwinget install --id Microsoft.WinDbg -e, or add only "Debugging Tools for Windows" from the Windows SDK. BlueShield detects it automatically; without it you still get header-level bugcheck decoding.
- Download and extract the BlueShield archive to any folder, for example
C:\Tools\BlueShield. - Keep the folder structure intact (the launcher loads the
modulesanddatafolders relative to itself).
That is all. Nothing is installed into the system.
Double-click Run-BlueShield.bat. It bypasses the execution policy for that
single run and the script then requests Administrator rights via UAC.
# Interactive menu (recommended)
powershell -NoProfile -ExecutionPolicy Bypass -File .\BlueShield.ps1
# Fast read-only scan, no prompts
powershell -NoProfile -ExecutionPolicy Bypass -File .\BlueShield.ps1 -Mode Quick
# Full read-only diagnostic + open an HTML report
powershell -NoProfile -ExecutionPolicy Bypass -File .\BlueShield.ps1 -Mode Full
# Full diagnostic, export HTML + JSON + CSV to a chosen path
powershell -NoProfile -ExecutionPolicy Bypass -File .\BlueShield.ps1 -Mode Full -OutputFormat AllThe
-ExecutionPolicy Bypassswitch applies only to that single invocation and does not change your machine's policy.
1. Quick scan snapshot + BSOD history + dumps
2. Full diagnostic everything + HTML report
3. Analyze crash dumps WinDbg !analyze -v
4. BSOD history & decode event log
5. Storage & disk health SMART / chkdsk
6. Memory diagnostic schedule mdsched
7. Driver health & recent changes
8. Driver Verifier advanced
9. Guided repairs SFC / DISM / chkdsk / fixes
10. Generate HTML report
11. Look up a bugcheck code
12. Security posture & risky drivers
13. Export full report (HTML / JSON / CSV)
0. Exit
- Run option 1 (Quick scan) to see the machine state and the most recent stop code, already decoded into likely causes.
- Run option 3 (Analyze crash dumps) to let
!analyze -vname the faulting module (for examplenvlddmkm.sysfor an NVIDIA GPU driver). - Act on the named driver: update it, roll it back, or clean-install it.
- Run option 9 (Guided repairs): start with
DISM /RestoreHealththensfc /scannow; disable Fast Startup if you seeDRIVER_POWER_STATE_FAILURE. - If the culprit is still unclear, use option 8 (Driver Verifier) to force the bad driver to reveal itself (read the safety note below first).
- Test hardware with option 5 (storage/SMART) and option 6 (memory) when the
stop code points at RAM or disk (for example
MEMORY_MANAGEMENT,WHEA_UNCORRECTABLE_ERROR,NTFS_FILE_SYSTEM). - Generate an HTML report (option 2 or 10) to keep a record or share it.
Driver Verifier deliberately stresses drivers so the faulty one crashes with a
clear DRIVER_VERIFIER_DETECTED_VIOLATION (0xC4) that names the bad .sys.
This is powerful but can prevent Windows from booting while it is active.
Before enabling it, make sure you can reach Safe Mode. If the machine will not boot after enabling Verifier:
- Interrupt boot twice to enter the Recovery Environment, or boot from installation media and choose Repair.
- Open Safe Mode or Command Prompt.
- Run
verifier /resetand reboot.
BlueShield always offers verifier /reset (menu 8, option 4) and prints this
recovery path whenever you enable verification.
| Item | Location |
|---|---|
| HTML reports | Desktop\BlueShield-Reports\BlueShield_Report_<timestamp>.html |
| Session logs | C:\ProgramData\BlueShield\logs\BlueShield_<timestamp>.log |
| Dump analysis logs | %TEMP%\bs_analyze_<dump>_<time>.log |
BlueShield never deletes dumps, drivers or user data. The only destructive action is the optional "Clear temporary files" repair, which removes the contents of the user and Windows temp folders.
BlueShield/
BlueShield.ps1 Main interactive launcher
Run-BlueShield.bat Double-click launcher (bypass + self-elevate)
modules/
BlueShield.Common.psm1/.psd1 Privilege, UI, logging, config, HTML helpers
BlueShield.Diagnostics.psm1/.psd1 Snapshot, history, dumps, drivers, storage, security
BlueShield.DumpAnalysis.psm1/.psd1 WinDbg/kd discovery and !analyze -v parsing
BlueShield.Remediation.psm1/.psd1 SFC, DISM, chkdsk, mdsched, verifier, fixes
BlueShield.Reporting.psm1/.psd1 HTML report + JSON/CSV export
data/
BugCheckCodes.json Stop-code reference database (57 entries)
BlueShield.config.json Default configuration
tests/
BlueShield.Tests.ps1 Pester test suite
.github/workflows/ci.yml PSScriptAnalyzer + Pester CI
assets/
logo.jpg Project logo
README.md CHANGELOG.md ROADMAP.md
CONTRIBUTING.md SECURITY.md LICENSE .gitignore
| Stop code | Name | First things to check |
|---|---|---|
0x0000000A |
IRQL_NOT_LESS_OR_EQUAL | Recent driver, RAM |
0x0000003B |
SYSTEM_SERVICE_EXCEPTION | GPU driver, system files |
0x00000050 |
PAGE_FAULT_IN_NONPAGED_AREA | RAM, driver |
0x0000007E |
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED | Named .sys, GPU driver |
0x000000D1 |
DRIVER_IRQL_NOT_LESS_OR_EQUAL | Network/GPU/storage driver |
0x00000124 |
WHEA_UNCORRECTABLE_ERROR | CPU/PSU, overclock, temps |
0x00000133 |
DPC_WATCHDOG_VIOLATION | SSD firmware, AHCI driver |
0x000000EF |
CRITICAL_PROCESS_DIED | System files, disk, malware |
The full set of 57 codes lives in data/BugCheckCodes.json and is easy to
extend; add an entry and BlueShield picks it up immediately.
- "running scripts is disabled on this system" — use
Run-BlueShield.bat, or add-ExecutionPolicy Bypassas shown above. - A UAC prompt appears — expected; diagnostics need Administrator rights.
- Dump analysis says the debugger was not found — install WinDbg
(
winget install --id Microsoft.WinDbg -e); header-level decoding still works. - No BSOD history shown — that usually means there have been no recent crashes, which is good.
Released under the MIT License. See LICENSE.
This software is provided for diagnosing and repairing systems you own or are authorized to administer. It reads diagnostic data and invokes built-in Windows maintenance tools; review findings before making hardware changes.