With the latest Windows 11 update, Microsoft is saying goodbye to the infamous “Blue Screen of Death” and has enabled the quick machine recovery feature by default for Home users.
“For nearly four decades, the blue screen shown during an unexpected restart has been a visual shorthand for something going wrong,” says Monika Sandhu, Senior Program Manager at Microsoft.
“The new UI is simpler, and more aligned with Windows 11’s design language. It removes the frowny face and QR code, and instead presents a short, readable message with the stop code [e.g., CRITICAL_PROCESS_DIED] and faulty driver information.”
The black ‘unexpected restart’ screen (Source: Microsoft)
The screen will also show a hex version of the stop code, so that IT pros can more easily search for the cause of the unexpected restart. As before, enterprises will be able to collect full kernel dumps (to support rich diagnostics) or can configure devices to create a small memory dump (with basic info for diagnostics).
And, Sandhu says, the whole process will be much quicker, as Microsoft has “significantly improved” the crash dump collection.
Quick machine recovery
If enabled, quick machine recovery – announced in 2024, rolled out to “Windows Insiders” earlier this year, and now included in Windows 11 version 24H2 – kicks into gear when the device repeatedly crashes / fails to boot.
The quick machine recovery process (Source: Microsoft)
If the “auto remediation” option is switched on, after showing the black “unexpected restart” screen, the system proceeds to boot the device into the Windows Recovery Environment (Windows RE), establishes a network connection, and scans Windows Update for remediation options.
“If no solution is found, the system retries the process based on the configured retry scanning intervals and time-outs. If a solution is found, the system downloads and applies it,” Microsoft explains.
After a remediation is applied, the device reboots either into Windows (if the remediation works as intended) or, if it doesn’t work, into Windows RE, and the remediation process is repeated.
Quick machine recovery is meant to allow Microsoft to deliver fixes quickly, make users’ and IT admins’ lives easier, and prevent widespread outages like the one that happened in July 2024 due to a faulty CrowdStrike update.
The feature is disabled by default for Windows 11 Pro, Education, and Enterprise edition devices, but IT admins can enable it and configure it via management tools (e.g., Intune), the RemoteRemediation configuration service provider, or via command line.
“Support for additional editions, including Windows Server, as well as expanded connectivity options for enterprise environments is coming soon. Future enhancements will also include advanced IT admin tools for remediation management, monitoring, additional policy and rollout controls,” Sandhu added.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
