How to fix the WdFilter.sys blue screen (BSOD) on Windows

WdFilter.sys is the Microsoft Defender Antivirus mini-filter driver, the part of Defender that checks every file a program opens. When a blue screen names it, Defender was running at the moment of the crash, but the fault is often another driver beside it. Update Defender first, then look for a second antivirus, cloud drive or backup tool.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What WdFilter.sys is and why a blue screen names it

WdFilter.sys is a kernel driver of Microsoft Defender Antivirus, the antivirus built into Windows 11 and Windows 10. In the list of services it appears as Microsoft Defender Antivirus Mini-Filter Driver (older builds said Windows Defender), with the short name WdFilter. It sits between programs and the disk and lets Defender look at files and registry changes as they happen. That is how real-time protection works.

Because it runs in the kernel, an error inside it or in a driver it works with cannot be caught. Windows stops with a bug check, the screen Microsoft calls a stop code error, and writes What failed: WdFilter.sys under the code. The name says which driver was running, not always which driver was wrong.

Why WdFilter.sys crashes: the causes, most common first

Defender's driver is installed on hundreds of millions of PCs and updated every month, so a crash that only one PC sees usually has a local reason. Rank the causes like this and match each one to a fix.

Check what the crash dump really says

The stop screen shows only one name. The crash dump shows which other drivers were active, which is how you find the real partner in a clash.

1. Open File Explorer and go to C:\Windows\Minidump. Windows writes one small .dmp file per crash and names it by date.
2. Install Microsoft's debugger: open Terminal and run winget install Microsoft.WinDbg.
3. Start WinDbg as administrator and open the newest .dmp file.
4. Type !analyze -v and press Enter. Wait until the analysis ends.
5. Read IMAGE_NAME, MODULE_NAME and the STACK_TEXT lines. Note every driver name that is not from Microsoft.

Unable to load image WdFilter.sys

A debugger warning that it has no symbols for the file. It does not mean the file is missing on your PC.

Only WdFilter.sys and Windows files

Start with Fix 1 and Fix 3.

A third-party driver in the stack

That program is the first suspect. Go to Fix 2.

Is WdFilter.sys a virus, and can you turn it off

The genuine WdFilter.sys is a Microsoft file in C:\Windows\System32\drivers\wd, signed by Microsoft. Right-click it, select Properties and open Digital Signatures to check. A file with this name in another folder, or without a Microsoft signature, is worth a scan: How to scan for malware with Microsoft Defender

Turning the driver off is not a fix. Without it Defender cannot see files as they open, so the PC has no real-time protection. Tamper Protection also blocks most attempts to change it. You may pause real-time protection for one short test, and it turns itself back on: Turn off Microsoft Defender protection for a moment

How to fix the WdFilter.sys blue screen

Start with Fix 1 on every PC. Fix 2 is the answer when another security, sync or backup tool is installed. Fix 3 is for crashes that began right after a Defender update. Fix 4 gets a PC that does not start back to the desktop. Fixes 5 to 7 rule out hardware and Windows files.

Fix 1. Install the latest Defender platform and security intelligence updates

10 minutesNo riskEvery PC with this crash, and the only step needed after a single crash.

WdFilter.sys is replaced with each Defender platform update, which Microsoft ships monthly as KB4052623. Microsoft supports only the newest platform versions; anything older than the last two gets no fixes, so an outdated driver is the first thing to remove.

1. Press Win + I, open Windows Update (on Windows 10: Update & Security > Windows Update) and select Check for updates. Install everything offered, including Update for Microsoft Defender Antivirus antimalware platform (KB4052623) and Security Intelligence Update for Microsoft Defender Antivirus (KB2267602).
2. Open Windows Security, select Virus & threat protection, then Protection updates and Check for updates.
3. Still in Windows Security, open Settings > About and note the Antimalware Client Version (the platform version, starting with 4.18).
4. Restart the PC so the new WdFilter.sys loads.

If the updates fail in the app, force them from an elevated Command Prompt (Microsoft's own commands):

cd /d "%ProgramFiles%\Windows Defender"
MpCmdRun.exe -SignatureUpdate

Fix 2. Find and update or remove the program that filters files beside Defender

20 to 40 minutesLow riskA second antivirus, a cloud drive (Google Drive, OneDrive, Dropbox), a backup, VPN, encryption or data-loss tool is installed, or the dump names a third-party driver.

Every file request passes all filter drivers in turn, so a faulty one often crashes while WdFilter.sys holds the same request. In one Microsoft Q&A case the crash came while Task View loaded files from a Google Drive virtual disk, and the advice was to uninstall Google Drive and install its latest version.

1. Right-click Start and select Terminal (Admin) (on Windows 10: Windows PowerShell (Admin)).
2. List the file system filter drivers that are loaded now. WdFilter is Defender; every other name that is not a Microsoft driver belongs to a program you installed.

   fltmc filters

3. Search each unknown filter name online together with the word driver, or open the file's Properties > Details in C:\Windows\System32\drivers to see the company.
4. Update that program to its newest version from its maker's site. If you no longer need it, uninstall it: Uninstall a program or app in Windows
5. If you run a second antivirus, keep only one. Two real-time scanners filtering the same files is a known recipe for crashes.
6. Restart and use the PC as before: open, copy and sync the same files that were in use at the crash.

If fltmc shows nothing unusual, test with a clean boot, which starts Windows with Microsoft services only. If the crashes stop, turn the other services back on in groups until the culprit returns. Step by step: How to perform a clean boot in Windows

Fix 3. Roll back a Defender platform update that started the crashes

10 minutesLow riskThe blue screens began right after a Defender or Windows update, and Fix 1 and Fix 2 did not stop them.

Microsoft gives Defender its own rollback commands for exactly this case: if you run into problems after an update, you can go back to the previous platform or the version shipped with Windows. That swaps WdFilter.sys for the earlier copy.

1. Press Win, type cmd, right-click Command Prompt and select Run as administrator.
2. Go to Defender's program folder.

   cd /d "%ProgramFiles%\Windows Defender"

3. Roll the platform back to the previous version.

   MpCmdRun.exe -RevertPlatform

4. Restart the PC and use it as before.
5. If the crashes stop, check Windows Update again in a few weeks. A newer platform replaces the rolled-back one automatically.

Fix 4. Start in Safe Mode and check the Defender driver settings when Windows does not boot

20 minutesLow riskWindows crashes with WdFilter.sys before or right after the sign-in screen, every time.

Safe Mode starts Windows with a minimal set of drivers, so you can reach the desktop and run Fixes 1 to 3. A WdFilter service that was set to a non-default start by a tweak tool or a broken antivirus removal can also stop the boot.

After two failed starts in a row Windows opens the recovery screens. From there, start in Safe Mode with Networking so you can download updates. Step by step: Start Windows or a Mac in Safe Mode

1. In Safe Mode, run Fix 1 and Fix 2. Remove any second antivirus there if it will not uninstall in a normal start.
2. Open Command Prompt as administrator.
3. Check the WdFilter service. On a healthy PC START_TYPE reads 0 BOOT_START.

   sc.exe qc WdFilter

4. Only if it shows another start type, restore the default and restart.

   sc.exe config WdFilter start= boot

5. If Windows answers Access is denied, Tamper Protection is guarding the setting. Leave it as it is: it was not changed by hand.
6. If Safe Mode does not start either, use the recovery screens: Run Startup Repair or roll back with Undo recent changes with System Restore.

Fix 5. Rule out memory, overclocks and other drivers

60 minutes or moreLow riskThe stop codes change from crash to crash, other drivers are named too, or Fixes 1 to 3 did not help.

WdFilter.sys reads a great deal of memory because it inspects files as they open. Unstable RAM or a buggy storage or graphics driver often shows up first in such a busy driver, so the stop screen blames it.

1. Reset any CPU, GPU or memory overclock to default, and turn off the memory profile (XMP or EXPO) in the BIOS for the test.
2. Test the RAM with the tool built into Windows: How to test your RAM with Windows Memory Diagnostic
3. Update the storage, chipset and graphics drivers, or roll back one that arrived just before the crashes: Update, roll back or reinstall a driver
4. Install the newest BIOS from your PC or motherboard maker's support page, after reading its release notes.

Fix 6. Let Driver Verifier find the faulty driver

1 to 2 days of normal useRead the warningCrashes continue, hardware tests pass, and the dumps do not name a clear culprit. For experienced users.

Driver Verifier puts third-party drivers under strict checks so that a faulty one crashes at once and is named in the dump, instead of hiding behind WdFilter.sys.

1. Open Command Prompt as administrator, type verifier and press Enter.
2. Select Create standard settings and Next.
3. Select Select driver names from a list and Next.
4. Tick the drivers whose Provider is not Microsoft Corporation, then select Finish and restart.
5. Use the PC normally. When it crashes, read the newest dump as in the section on reading the crash dump. The driver named there is the culprit.
6. Turn Verifier off and restart, from a normal start or Safe Mode.

   verifier /reset

7. Update or uninstall the program that owns the named driver.

Fix 7. Repair Windows system files as a last check

20 minutesNo riskSFC has never run on this PC, or the dumps also name Windows files.

Defender's driver comes from its own updates, so this repair does not replace WdFilter.sys. It rules out damaged Windows components that the filter stack depends on, which is why it comes last.

DISM fetches clean copies of Windows components and SFC replaces damaged system files. Step by step with screenshots: Run DISM and SFC to repair Windows system files

In an elevated Command Prompt, one after the other:

DISM.exe /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Still crashing: what to collect and where to send it

A bug inside WdFilter.sys can only be fixed by Microsoft, and a clash with another program only by its maker. Give either of them what they need to reproduce the crash.

• The three newest .dmp files from C:\Windows\Minidump, zipped. Microsoft Q&A advisors also ask for the full C:\Windows\MEMORY.DMP when it exists.
• Your Windows edition and version from Settings > System > About.
• The Defender Antimalware Client Version from Windows Security > Settings > About.
• The output of fltmc filters from Fix 2.
• What you were doing at the crash: starting up, syncing, copying, gaming.

How to keep the WdFilter.sys blue screen from coming back

Windows 10 left support on 14 October 2025. A PC that can run Windows 11 gets the full stream of Windows fixes beside Defender's own updates.

Frequently asked questions

What is WdFilter.sys?

WdFilter.sys is the Microsoft Defender Antivirus Mini-Filter Driver, a kernel driver that comes with Windows 11 and Windows 10. It sits between programs and the disk and lets Defender inspect files and registry changes the moment they happen, which is what real-time protection means. Its service name is WdFilter, and the file lives in C:\Windows\System32\drivers\wd. Defender updates it through its monthly platform update. It is normal for it to be loaded all the time, and seeing it in Task Manager tools or boot logs is no reason for worry.

Is WdFilter.sys a virus?

No. The genuine file is a Microsoft driver signed by Microsoft, and it is part of the antivirus that protects your PC. To check your copy, right-click it in C:\Windows\System32\drivers\wd, select Properties and open Digital Signatures. A file with this name somewhere else, or one without a Microsoft signature, deserves a full scan with Microsoft Defender. Malware does sometimes borrow the names of system files, which is why the folder and the signature matter more than the name.

Why does the blue screen say WdFilter.sys failed?

The stop screen names the driver that was running when Windows stopped. WdFilter.sys handles a very large share of all file and registry activity, so it is often in the middle of the work when another driver, bad memory or an old Defender platform causes the error. That is why WdFilter.sys failed appears so often. The crash dump in C:\Windows\Minidump shows the other drivers involved; read it as described in this guide before you change anything.

How do I fix REGISTRY_FILTER_DRIVER_EXCEPTION with WdFilter.sys?

REGISTRY_FILTER_DRIVER_EXCEPTION (0x135) means a driver that watches registry changes hit an error it did not handle. WdFilter.sys watches the registry for Defender, and so do many third-party security, backup and system tools. Install the latest Defender updates first (Fix 1). Then run fltmc filters and remove or update any second antivirus or monitoring tool (Fix 2). If the code appeared right after a Defender update, roll the platform back with MpCmdRun.exe -RevertPlatform (Fix 3).

How do I fix SYSTEM_SERVICE_EXCEPTION caused by WdFilter.sys?

SYSTEM_SERVICE_EXCEPTION (0x3B) with WdFilter.sys is the most common form of this crash. Work through the fixes in order: update Defender, then look for a second filter driver such as a cloud drive, backup or antivirus program, then roll back a fresh Defender platform. If the stop code changes between crashes and other drivers are named too, test the memory and update storage and graphics drivers, because a busy driver like WdFilter.sys often hits faulty hardware first.

How do I disable WdFilter?

You should not, and on a normal PC you cannot do it cleanly. WdFilter is the part of Defender that sees files as they open; with it off the PC has no real-time protection. Tamper Protection blocks changes to it, which is why guides that edit its service often end in Access is denied. If you must test whether Defender is involved, pause real-time protection once in Windows Security and it turns itself back on. If you install another antivirus, Defender steps back on its own. People who search in Russian, "wdfilter как отключить" or "как отключить", ask the same thing: the answer is the same.

What does BOOTLOG_NOT_LOADED WdFilter.sys mean?

It is a line in the boot log, C:\Windows\ntbtlog.txt, which Windows writes only when boot logging is turned on. The log marks many drivers as BOOTLOG_NOT_LOADED on healthy PCs, for example drivers that load later in the start or are not needed in that mode. The line \SystemRoot\system32\drivers\wd\WdFilter.sys on its own is not an error and not a stop code. Only if Windows also fails to start or crashes with WdFilter.sys named is there something to fix, starting with Fix 4.

What is zdpfilter.sys? Is it the same as WdFilter.sys?

No. zdpfilter.sys is a different driver with a similar name, and this page is about Microsoft Defender's WdFilter.sys. We could not confirm which company makes zdpfilter.sys, so check it on your own PC: open C:\Windows\System32\drivers, right-click the file, select Properties and read the company on the Details tab and the signer on Digital Signatures. If it is a filter driver from a security or data protection product, the method in Fix 2 applies: update or remove that product if it clashes with Defender.

Can I download WdFilter.sys to replace a broken one?

No. Driver and DLL download sites offer files of unknown origin, and a wrong version of a kernel driver can stop Windows from starting. WdFilter.sys arrives with Microsoft Defender's platform update, KB4052623, through Windows Update or Windows Security. If you think the file is damaged, install the newest platform update (Fix 1), or reset Defender to the version shipped with Windows with MpCmdRun.exe -ResetPlatform and then update again.

Is a single WdFilter.sys blue screen dangerous?

Usually not. On Microsoft Q&A an independent advisor read one user's single WdFilter.sys minidump, found only generic errors, and judged that a background Windows update had most likely caused a one-time clash. Install the pending Defender and Windows updates, restart, and watch the PC for a week. If more crashes follow, especially with the same driver named, work through the fixes in this guide in order.