Windows Blue Screen, Unexpected Restart, or Mac Kernel Panic
Symptoms
Use this guide when Windows shows a blue or black stop screen, displays a stop code, restarts without warning, or says it recovered from an unexpected shutdown. On a Mac, use it when the computer restarts and reports that it restarted because of a problem. A single crash may be temporary, but repeated crashes can indicate a software, accessory, storage, memory, power, or hardware problem.
Urgent safety check
Stop using the computer if a crash happens with smoke, sparks, a burning or chemical smell, liquid exposure, battery swelling, unusual clicking or grinding, or heat that makes the device painful to touch. Shut it down normally if possible, unplug it only if safe, and contact support or site safety staff. Also stop if every restart immediately crashes again, because repeated forced restarts can risk open work and make diagnosis harder.
Safe checks
Capture the message safely. Write down or photograph the Windows stop code and any "What failed" name, or the Mac restart message. Include the time. Make sure the photo does not show confidential work, usernames, QR-linked private information, or other sensitive content.
Allow one normal restart. If the computer restarts and becomes stable, sign in normally and save current work to an approved location. Do not deliberately trigger the crash again. If it is caught in a restart loop, stop and contact support.
Disconnect optional external hardware. Shut down normally, then remove docks, USB accessories, external drives, adapters, and secondary displays. Keep approved power and essential input only. Restart once and note whether the problem returns. Do not remove internal components.
Check the pattern. Note whether the crash occurs during startup, wake from sleep, a video call, one application, charging, or connection to a particular accessory. Record any recent approved software, driver, peripheral, or hardware change. Timing and repetition are more useful than guessing the cause.
Use official updates only when the computer is stable. Check Windows Update or macOS Software Update and your organization's approved software portal. Keep the device connected to approved power. If it crashes during updating or cannot remain stable, stop and escalate rather than repeatedly retrying.
Check built-in history without changing settings. On Windows, Settings may show update history, and Reliability Monitor may show the time and name of a failure. On a Mac, note the "restarted because of a problem" alert and any app named near the event. Do not copy or upload full memory dumps or diagnostic archives unless support provides an approved secure channel, because they may contain sensitive information.
Back up active work through approved methods. If the computer is stable long enough, confirm that essential work is saved to your normal approved location. Do not begin a large migration or use a personal drive during an unstable period.
What not to do
Do not open the computer, reseat memory, change firmware settings, edit the registry, run destructive disk or repair commands, use unapproved driver or cleaning tools, disable endpoint protection, or erase or reinstall the operating system. Do not repeatedly force power off, search random stop-code download sites, or post crash dumps publicly. Never send passwords, MFA codes, recovery keys, customer data, or confidential files.
When to escalate
Escalate immediately for any physical safety sign, a restart loop, a crash during every startup, or suspected security activity. Contact support after any repeated crash, even if the computer recovers. Also escalate when the same stop code returns, the issue follows a specific approved accessory, data is missing, or a business-critical task cannot be completed. Leave the computer powered off if support advises or if continued use causes more crashes.
What to include in the ticket
Include the make, model, asset tag, Windows or macOS version if known, exact stop code or restart wording, date and time of each event, frequency, what the computer was doing, connected accessories, and recent approved changes. List the safe checks completed and whether the crash returned with accessories disconnected. Share a sanitized photo if useful. Do not attach memory dumps, diagnostic archives, credentials, recovery keys, customer data, or confidential documents unless support provides a specifically approved secure process.