Has anyone else seen Windows 11 machines crash with a Win32k.sys stop code, usually showing subtype 0x1A_1015_nt!MiUnloadSystemImage, and then fail to boot afterward? We have had roughly six systems affected for one client, two for another, and several in our own environment. Recovery attempts have generally been unsuccessful, so we have had to reset the machines. The systems are different makes and models and do not share one obvious recent update; for example, one received updates on August 5 but did not crash until August 12. We are also running ThreatLocker, so I am wondering whether this could be a known compatibility issue or whether others are seeing a broader increase in these failures.
3 Answers
A damaged or incompatible memory-management component could be contributing. As a troubleshooting step, you could temporarily disable the page file on a test machine and see whether it becomes stable, but I would treat that as a diagnostic experiment rather than a confirmed fix. Also check dump files and memory diagnostics before resetting more systems.
This has reportedly been a known issue since at least April, and ThreatLocker may be involved. It would be worth checking its release notes, event logs, and support advisories before assuming the systems are infected or suffering from a hardware problem.
The stop code alone does not prove malware. A security product, driver, or kernel-level filter can trigger failures around memory image unloading, so focus first on recent ThreatLocker policy or agent changes and collect crash dumps from an affected machine if possible.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures