Error 0x00000028 is the Windows stop code CORRUPT_ACCESS_TOKEN. It means the kernel detected a corrupted access token and halted the system to protect it. The code is uncommon and is not, by itself, a diagnosis of a particular failed part. A hardware device, a driver, or ordinary software can be responsible, so the reliable fix is to correlate the crash with recent changes and, if it repeats, inspect the crash dump rather than installing a generic “repair” utility.
Work through the reversible checks first: record the complete blue-screen information, remove recently added hardware, use Safe Mode if normal startup is unstable, and update or roll back the driver or software that matches the timeline. Repeated crashes should be investigated with WinDbg and !analyze -v; the named module in a dump is more useful than the hexadecimal code alone.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Microsoft Windows 11 (USB) | $124.97 | Buy on Amazon |
| 2 |
|
Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |... | $119.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What 0x00000028 means
Microsoft identifies bug check value 0x00000028 as CORRUPT_ACCESS_TOKEN. An access token is kernel-managed security information used to represent a process or thread’s permissions. When Windows detects that this information is corrupted, it stops with a blue screen instead of continuing with potentially unsafe state.
The stop code appears very infrequently. It is a symptom of a kernel stop, not a universal explanation such as “bad RAM” or “a virus.” Microsoft’s consumer guidance states that a hardware device, its driver, or software might have caused a blue-screen error. The code-specific Microsoft page is written mainly for debugging and points to the !analyze debugger extension; it does not provide a one-click consumer cure.
#1 Best Overall
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
The optional “What failed” line on the blue screen may identify a module. Treat that name as a lead, not automatic proof: a damaged memory state can make a normally innocent module appear in the report. Your objective is to find a repeatable cause while preserving files and keeping every change reversible until the evidence is clear.
Before changing anything
Capture the complete stop information
Use a phone photo if the screen disappears too quickly. Record:
- The exact stop code, including any text after
0x00000028. - The “What failed” module name, if Windows displays one.
- The date and time, whether the crash happened during startup, gaming, sleep/wake, or a particular application, and whether it repeats at the same action.
- Anything changed immediately beforehand: a Windows update, driver installation, new USB or PCIe device, security tool, utility, or application.
Do not delete minidumps or use a cleanup program before you have copied them. A dump can provide the only useful evidence after the blue screen.
Protect your data
If Windows still starts, copy important documents and game saves to another drive or cloud storage. If the machine is unstable, avoid lengthy repairs until essential files are backed up. A later reset or reinstall can preserve files in some modes, but it is not a substitute for a backup.
Choose the least risky recovery path
| Path | Can Windows start normally? | Reversibility | Evidence quality | Typical scope | Data risk |
|---|---|---|---|---|---|
| Remove recent hardware | Yes or intermittent | Very high; reconnect later | Good when the timing is clear | One device or its driver | Low |
| Safe Mode and rollback | No or repeated startup crash | High; uninstall or roll back | Good when a recent change is known | Driver, security tool, or utility | Low |
| Windows and manufacturer driver update | Usually yes | Moderate; create a restore point first | Moderate unless the update matches the timeline | Single component or system compatibility | Low |
| WinDbg dump analysis | Yes, or bootable enough to retrieve dumps | High; analysis changes nothing | Highest when a module and stack are consistent | Specific code path | Very low |
| Recovery USB or installation media | No | Depends on the repair chosen | Useful for offline startup and repair, not code-specific | Boot configuration or Windows installation | Low to high; back up first |
| Reset or clean reinstall | Not reliably | Low | Low for identifying the original cause | Whole Windows installation | High unless files and licenses are backed up |
Step 1: Undo a recently added device
Shut the PC down completely. Disconnect external hardware installed immediately before the first 0x00000028 crash: USB docks, storage, cameras, controllers, printers, adapters, and similar devices. If you added an internal component, power off, unplug the system, and remove or reseat it only if you are comfortable following the manufacturer’s service instructions. Leave the keyboard, mouse, display, and required boot drive connected.
Start Windows and use the computer under the same conditions that previously triggered the stop. If the crashes stop, reconnect one device at a time and test between changes. The device itself, its firmware, or its driver may be involved. If nothing changes, reconnect the hardware and continue; do not assume the device is defective solely because it was installed recently.
Step 2: Start Windows in Safe Mode
Safe Mode loads a limited set of drivers and services. It is useful when a normal startup crashes before you can remove a recent change.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- From Windows 11, open Settings > System > Recovery. Under Advanced startup, select Restart now. In Windows 10, use Settings > Update & Security > Recovery, then choose Restart now under Advanced startup.
- At the recovery menu, choose Troubleshoot > Advanced options > Startup Settings > Restart.
- After the restart, press 4 for Safe Mode or 5 for Safe Mode with Networking. Use networking only when you need an online driver or support page.
- In Safe Mode, open Device Manager and inspect hardware changed just before the crash. On the device’s Driver tab, use Roll Back Driver when the problem began after an update. If rollback is unavailable, uninstall the recently changed driver or associated utility, then restart normally.
- Remove a recently installed security product, overclocking tool, hardware monitor, or other low-level utility if the timeline points to it. Reinstall only a current version supplied by its vendor after stability returns.
If Safe Mode itself crashes, note whether the stop code and module are identical. A crash in this reduced environment makes a normal-startup application less likely and increases the value of dump and hardware testing.
Step 3: Update or roll back Windows and drivers deliberately
Use Windows Update
When the PC is stable enough to run normally, open Settings > Windows Update (or Settings > Update & Security > Windows Update on Windows 10), install pending updates, and restart. Do not install several unrelated driver packages at once if you are trying to identify a cause; change one variable, then test.
Use the manufacturer’s support channel
For a graphics card, chipset, storage controller, network adapter, audio device, or motherboard, obtain a driver that explicitly supports your Windows edition and hardware model from the PC or component manufacturer. Compare the installed and recommended versions. If the first 0x00000028 crash followed a driver update, rolling back is more informative than stacking another third-party driver utility on top of it.
Check the timeline
A driver update is not automatically the culprit. A crash that began weeks later, or that occurs only when a particular USB device is attached, points elsewhere. Keep a short change log with the date, version, and result of each update or rollback.
Recommended Free Tools
Step 4: Remove or repair software that runs at kernel level
Security products, disk filters, virtualization tools, anti-cheat components, backup agents, and hardware-monitoring utilities can install kernel drivers. If the blue screen began immediately after one was installed or updated, uninstall it from Settings > Apps > Installed apps (Windows 11) or Settings > Apps > Apps & features (Windows 10), then restart and test.
Do not remove your only security protection casually. If you temporarily uninstall a security product for diagnosis, keep Windows’ built-in protection enabled and reinstall a supported product after testing. A clean boot can further separate third-party services from Windows components: use msconfig, hide Microsoft services, disable the remaining non-Microsoft services, restart, and re-enable items in groups after the crash stops. Record each change so you can undo it.
Rank #2
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
Step 5: Check Windows system integrity after the reversible changes
Corrupted system files can complicate a driver or software failure. Open Terminal (Admin) or Command Prompt (Admin) and run:
sfc /scannowAllow the scan to finish and follow its result. If Windows reports corruption it could not repair, run:
DISM /Online /Cleanup-Image /RestoreHealthRestart and run sfc /scannow again. These checks repair Windows components where possible; they do not identify a faulty third-party driver and are not a guaranteed cure for 0x00000028.
Step 6: Collect and analyze a crash dump
Make sure Windows records a dump
- Press Windows key + R, enter
sysdm.cpl, and press Enter. - Open the Advanced tab, select Startup and Recovery > Settings, and look at Write debugging information. A small memory dump is normally stored in
%SystemRoot%Minidump; a kernel or complete dump may be written as%SystemRoot%MEMORY.DMP. - Ensure the system drive has enough free space and that Automatically restart is disabled if you need time to read the stop screen. Select OK and restart.
If the PC cannot stay on long enough to create a dump, use another computer to prepare Windows recovery or installation media. Such media is an offline startup and repair aid, not a 0x00000028-specific fix.
Open the dump in WinDbg
- Install and open WinDbg on a stable Windows installation, then choose File > Start debugging > Open dump file and select the newest file from
C:WindowsMinidumporC:WindowsMEMORY.DMP. - At the debugger command line, set Microsoft’s public symbol path with
.symfix, reload symbols with.reload, and run!analyze -v. - Record the bug-check arguments, the Probably caused by line, the failing module, and the stack. If a driver is named, inspect its details with
lmvm drivername, replacingdrivernamewith the module shown in the output. - Compare at least two dumps when available. A third-party
.sysmodule that appears consistently is stronger evidence than a single appearance. Inconsistent names, truncated stacks, or symbol errors mean the dump may be too damaged for a confident conclusion.
The Microsoft debugger guidance specifically identifies !analyze as useful for determining the root cause. Keep the original dump files when asking a hardware or software vendor for help; do not edit them or rely only on a screenshot of the summary.
Step 7: Act on what the dump identifies
A recurring third-party driver
Download a corrected version from the driver or software vendor, or remove the associated software if no compatible release exists. If the module belongs to a device you do not need, disconnect the device while testing. Do not delete a .sys file manually from C:WindowsSystem32drivers; use the vendor’s uninstaller or Device Manager so services and driver registrations are removed together.
Microsoft code with no consistent third-party module
Install all applicable Windows updates, undo any overclock or firmware change, and test with recently added hardware disconnected. If the crash continues, provide the dumps and system information to Microsoft support or the PC manufacturer rather than repeatedly reinstalling unrelated drivers.
Corruption that prevents useful analysis
Memory corruption can make the dump misleading. Run the built-in Windows Memory Diagnostic by pressing Windows key + R, entering mdsched.exe, and choosing the restart-and-check option. For a persistent or intermittent fault, the PC manufacturer may recommend a longer hardware diagnostic or testing each memory module and slot separately. Follow the manufacturer’s service guidance and back up data first.
No stable pattern
Microsoft’s published crash analysis gives a broad context, not a prediction for your machine: about 70% of analyzed crashes were attributed to third-party driver code, 10% to hardware issues, 5% to Microsoft code, and 15% were unknown because memory was too corrupted to analyze. Microsoft does not state a year for those figures on the cited page. Use them to prioritize evidence gathering, not to declare that your RAM or a particular driver is at fault.
Step 8: Use System Restore, uninstall an update, or reset only when justified
System Restore
If restore points are enabled and the first crash follows a driver or software change, open Control Panel > Recovery > Open System Restore and select a point dated before the change. Restore points do not replace personal files, but they can remove drivers and applications installed afterward. Confirm which programs will be affected before committing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Remove a recent Windows update
From Settings > Windows Update > Update history > Uninstall updates, remove only an update that matches the crash timeline and that Windows allows you to uninstall. Restart and test. Keep in mind that removing a security update can reduce protection, so install a corrected release when available.
Reset or reinstall Windows
A reset or clean installation is a last resort when Windows cannot be stabilized and dumps do not identify a repairable component. Back up files, export application data and game saves, record activation information, and obtain installation media first. A reinstall may remove the symptom while leaving an underlying hardware fault; if the same stop code returns on a clean system, stop reinstalling and have the hardware examined.
Quick Recap
If Windows will not boot normally
- Disconnect recently added external hardware and try one normal start.
- Enter Windows Recovery with repeated interrupted starts or a Windows installation/recovery USB, then choose Troubleshoot > Advanced options > Startup Settings for Safe Mode.
- Use Uninstall Updates, System Restore, or Command Prompt only after selecting the option that matches the last known change. These are recovery functions, not code-specific cures.
- If you can reach another computer, copy minidumps from the affected drive before a reset or reinstall. A vendor or support technician can often do more with the original dumps than with a description of the blue screen.
What not to do
- Do not assume the hexadecimal value proves that RAM, a graphics card, or Windows itself is defective.
- Do not buy a cleaner, driver updater, replacement memory, or storage device as a diagnosis. The appropriate repair depends on the dump, timeline, and hardware tests.
- Do not install several driver packages at once, because you will lose the ability to correlate the change with the crash.
- Do not delete dump files, disable all security software permanently, or edit driver files by hand.
- Do not treat a recovery USB as a guaranteed fix; it only supplies offline startup and repair options.
As an optional shortcut after the manual checks, Outbyte PC Repair can look for more than 100 common Windows issues where possible, including broken system elements and shared DLL files, while also offering settings tweaks, temporary and cache cleanup, privacy and vulnerability checks, a real-time boost, file shredder, and app-crash log. It runs on Windows 11, 10, 8, and 7; its category-based free trial lasts at least two days before a paid subscription, and it complements an antivirus rather than replacing one. Results vary, and no tool repairs every crash.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
