DWM Crashed: How to Fix It

The DWM.exe process is an important Windows component responsible for drawing the desktop and managing the visual composition of windows. Microsoft describes Desktop Window Manager as the component that redirects window drawing to off-screen surfaces and presents the desktop image on the display. That is why a DWM crash can look dramatic: the desktop itself is part of the failing path.

What is DWM.exe?

DWM.exe, or Desktop Window Manager, is the Windows process behind desktop composition: transparency, window thumbnails, animations, scaling, high-resolution rendering, and the final image that appears on your monitor. It normally uses some GPU and memory, especially on high-resolution or multi-monitor systems.

A normal DWM.exe process should be stable, signed by Microsoft, and located in C:/Windows/System32. It should not be running from Downloads, AppData, Temp, a browser cache folder, or a random subfolder in your user profile. A crash does not automatically mean malware, but the file path and signature are easy checks to make before you spend hours troubleshooting drivers.

How to fix “Your session was logged off because DWM crashed”

Work through the steps in this order. The order matters: Event Viewer usually tells you whether you are chasing a graphics driver, a Windows file, a game overlay, or a suspicious executable. Randomly reinstalling tools first can hide the real clue.

1. Check Event Viewer first

Open Event Viewer and go to Windows Logs → Application. Look for errors at the minute the session was logged off. Helpful entries often include Faulting application name: dwm.exe, Application Error, Display driver stopped responding, or a faulting module that belongs to a GPU driver, game, overlay, screen recorder, or shell extension.

Write down three things: the faulting module name, the exception code, and whether the crash happens only during games/video calls or also on the desktop. If the faulting module is a display driver DLL, start with the driver steps below. If it is a game, mod, overlay, or recording component, disable that tool first.

2. Update or roll back the GPU driver

A DWM crash is often caused by the layer between Windows and the graphics card. If the problem started after a driver update, roll back to the previous stable version in Device Manager or install an older driver from the GPU or laptop vendor. If the driver is old, install the newest stable driver from NVIDIA, AMD, Intel, or your laptop manufacturer.

For laptops, prefer the OEM driver when the generic GPU package keeps crashing. Laptop vendors sometimes ship display, power, and hybrid-GPU changes that are not fully represented in a generic driver. Also check Settings → Windows Update → Advanced options → Optional updates, because Microsoft can offer driver updates there.

3. Install Windows updates and optional driver updates

Install available Windows updates, reboot, and test again. Windows display bugs are often fixed through cumulative updates, graphics driver updates, or optional hardware updates. If the issue began after a specific Windows update, do the opposite: note the update number and test whether uninstalling or rolling back that update stops the crash.

Older discussions around DWM crashes often mention KB5026446 because it was a Windows 11 22H2 preview update from May 2023. Do not chase that update blindly in 2026. Use it as a clue that Windows build and graphics driver combinations can matter; the practical fix is still to get the current stable Windows and GPU driver combination for your machine.

4. Disable overlays and tools that hook into graphics

Disable overlays temporarily: Discord overlay, Steam overlay, Xbox Game Bar, GeForce Experience overlay, AMD overlay, MSI Afterburner, RTSS, screen recorders, FPS counters, ReShade, ENB presets, capture tools, remote-control software, and RGB/system-monitoring utilities that draw on top of games. These tools are useful, but they sit close to the graphics pipeline.

If DWM crashes only when a specific game or app is open, launch that app with overlays off and no mods. A clean launch tells you whether Windows itself is unstable or whether the compositor is being pulled down by injected graphics hooks.

5. Test display settings: HDR, VRR, scaling, and monitors

DWM has to compose every visible window for your actual display setup. Test with the simplest setup possible: one monitor, standard refresh rate, HDR off, variable refresh rate off, no docking station, and no custom scaling. If the crash stops, re-enable one setting at a time.

Pay attention to mixed-refresh multi-monitor setups, USB-C docks, HDR monitors, G-Sync/FreeSync, custom color profiles, and very high scaling values. None of these settings is “bad” by itself, but they can expose a display driver bug that only appears under a specific combination.

6. Repair Windows files with DISM and SFC

If Event Viewer points to dwm.exe itself or the crash happens even with overlays disabled, repair Windows system files. Microsoft recommends running DISM before System File Checker because DISM repairs the component store that SFC uses as a source.

Open Command Prompt or Windows Terminal as administrator and run:

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

Restart after both commands complete. If SFC says it repaired files, test the machine before making more changes. If SFC cannot repair files, boot into Safe Mode and run the scan again.

7. Check games, mods, overclocking, and GPU load

If DWM crashes during gaming, the visible DWM error may be collateral damage from a GPU reset. Remove recent mods, ReShade/ENB presets, unstable overclocks, undervolts, aggressive fan curves, and experimental game launch options. Return GPU settings to stock temporarily.

Also check power and heat. Desktop GPUs need stable PCIe power connections, and a loose connector can cause black screens or resets under load. On laptops, test both plugged in and on battery, then switch the power mode to balanced or best performance and compare behavior.

8. Check the GPU power connections

On a desktop PC, shut down the machine, unplug it, and inspect the GPU power connectors. The connectors should be fully seated on both the power-supply side and the graphics-card side. Avoid running a high-power GPU through questionable adapters, splitters, or cables that are not meant for that card.

This step is worth doing when the crash happens during games, video rendering, or anything that makes the GPU draw more power. A DWM crash in that situation is often the last visible Windows symptom, not the root cause.

9. Test Safe Mode, clean boot, or a clean user profile

If the crash does not happen in Safe Mode, basic Windows drivers and default settings are likely stable. That points toward a startup app, shell extension, GPU utility, overlay, or profile-specific setting. Use a clean boot or a temporary local Windows account to narrow it down.

A clean user profile is especially useful when only one Windows account crashes. If the new profile is stable, review startup entries, browser extensions, shell customization tools, and recently installed desktop utilities in the original account.

DWM.exe high memory on Windows 11: what to check first

If you searched for Desktop Window Manager high memory, DWM.exe high GPU, or dwm.exe high memory Windows 11, start with the graphics stack rather than random cleanup tools. DWM keeps desktop surfaces in memory; usage can climb when a driver leaks memory, a game or overlay hooks into the compositor, HDR/VRR behaves badly, or a browser/video app keeps forcing composition work.

• If memory rises only while gaming or streaming: disable overlays first: Discord, Xbox Game Bar, GeForce/Adrenalin overlay, MSI Afterburner/RivaTuner, screen recorders, and third-party RGB or monitoring tools.
• If it starts after a driver or Windows update: install the latest GPU driver, or roll back to the last stable driver from Device Manager if the problem began immediately after an update.
• If DWM crashes and logs you out: check Event Viewer for dwm.exe, Display, nvlddmkm, amdkmdag, or igdkmdn64 around the exact crash time. That tells you whether Windows is failing in DWM itself or in the display driver below it.
• If the file path is not C:\Windows\System32\dwm.exe: treat it as a possible malware masquerade and scan before changing Windows settings.

Do not confuse this with Antimalware Service Executable. That is MsMpEng.exe, not dwm.exe. If Task Manager shows Defender using memory, use Defender scan-exclusion and scheduled-scan troubleshooting instead of DWM fixes.

DWM.exe high memory and GPU usage

High DWM.exe memory or GPU usage is related to the crash problem, but it is not always the same issue. DWM will naturally use more resources with many windows, 4K/5K displays, multiple monitors, video playback, animated wallpapers, transparency effects, screen recording, and hardware-accelerated browsers.

Treat it as a problem when the desktop becomes slow, fans stay loud at idle, memory usage keeps climbing, or the process does not calm down after closing graphics-heavy apps. The same fixes apply: update or roll back the display driver, reduce display complexity, disable overlays, close hardware-accelerated browser tabs, and reboot after Windows updates.

How to identify that DWM.exe is a virus

The legitimate DWM.exe file is in C:/Windows/System32/dwm.exe and is digitally signed by Microsoft. Malware can use the same file name to look harmless, but it cannot make a random file in AppData become the real Windows Desktop Window Manager.

1. Open Task Manager

Press Ctrl + Shift + Esc and look for Desktop Window Manager. In modern Windows, the legitimate process is part of the normal desktop session. High resource use alone is not proof of malware, so do not end or delete anything yet.

2. Open the location of the DWM.exe file

Right-click Desktop Window Manager and choose Open file location. The correct location is C:/Windows/System32. Then right-click the file, open Properties, and check the digital signature. It should be signed by Microsoft.

Be suspicious when you find a file named dwm.exe in AppData, Temp, Downloads, ProgramData, a browser cache folder, or a random folder with a fake system-looking name. Other warning signs include no Microsoft signature, double extensions, hidden attributes, strange startup entries, scheduled tasks, or network activity from the suspicious copy.

How to remove malicious DWM.exe with GridinSoft Anti-Malware

If the file path or signature is wrong, scan the system before deleting files manually. Malware that copies a Windows process name often creates scheduled tasks, startup entries, services, browser components, or secondary payloads. Removing only the visible file may leave the persistence mechanism behind.

You can also check a suspicious file with the GridinSoft Online Virus Scanner before running a full cleanup. For an infected system, a full local scan is safer because it can inspect startup points and related files.

Frequently asked questions

Related Windows performance guides

If this crash is part of a broader Windows slowdown, these guides cover nearby high CPU, memory, and shell process issues:

• Vmmem high memory and CPU usage
• SearchHost.exe high CPU, memory, or GPU usage
• Sihost.exe high CPU and malware check
• Computer keeps freezing: Windows fix checklist
• DISM Host Servicing Process high CPU
• TextInputHost.exe using GPU
• Usermode Font Driver Host high CPU and memory

Official references: Microsoft Desktop Window Manager overview, Microsoft DISM and System File Checker guidance, and Microsoft driver update guidance.