Fix 0x000000EF BSOD after KB5003214 PrintNightmare patch

Quick answer

Boot into Safe Mode, delete the registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors, then restart normally.

What's actually happening here

The KB5003214 update, released June 2021 to patch the PrintNightmare vulnerability (CVE-2021-34527), tightened restrictions on the Print Spooler service. On some systems, it conflicts with third-party printer drivers — specifically those using a custom print processor — causing the spooler to crash immediately on boot. Since Windows treats spoolsv.exe as a critical system process, its sudden death triggers bugcheck 0x000000EF (Critical Process Died). This isn't a random blue screen: the error code tells you exactly which process failed.

Fix steps

1. Boot into Safe Mode. Restart your PC and press F8 (or Shift + Restart from the login screen) before Windows loads. Choose Safe Mode with Networking. You'll need network access to reinstall drivers later.
2. Open Registry Editor. Press Win + R, type regedit, hit Enter. If UAC prompts, accept it.
3. Navigate to the print processor key. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors. Expand that key — you'll see subkeys for each installed print processor, like mXDW or winprint.
4. Identify the culprit. Look for a subkey not named winprint (the default Microsoft one). Third-party drivers from Brother, Canon, or HP often add their own. The problematic one is usually from an old or incompatible driver. Delete that entire subkey — right-click it and choose Delete.
5. Restart normally. Close Registry Editor, reboot without Safe Mode. Windows should boot cleanly now. The Print Spooler will fall back to the default processor.

Alternative fixes if that didn't work

If the registry fix doesn't stop the crash, the problem might be deeper. Try these:

• System Restore. Boot into Safe Mode and run rstrui.exe from the search bar. Roll back to a restore point created before KB5003214 installed. This is the nuclear option — it removes the update and all its changes.
• Uninstall KB5003214. In Safe Mode, go to Settings > Update & Security > View update history > Uninstall updates. Find KB5003214, click Uninstall. Reboot. You'll lose the PrintNightmare fix, so reinstall your printer driver from scratch afterward.
• Clean printer driver removal. If the registry key is gone but the spooler still crashes, a corrupt driver file remains. Download PrintBRM or use the built-in printmanagement.msc to remove all printers. Then manually delete leftover files in C:\Windows\System32\spool\drivers.

Prevention tip

To avoid this in the future, keep your printer manufacturer's driver up to date — install the latest version before installing Windows security patches. If you're an admin, you can also disable the Print Spooler service temporarily during updates: run net stop spooler in an elevated command prompt before applying patches, then restart it afterward. This prevents the update from touching active driver files.