Log Dejargonizer

Windows System Log · Event 10110

Event 10110: A user-mode driver crashed and took your device with it

Some drivers run outside the kernel so a fault cannot bring down Windows. When one of those crashes, the process hosting it is killed and the devices it was serving stop working until it restarts. Event Viewer marks this Critical, which overstates it — usually a webcam or a printer blinked.

Also written as Event ID 10110DriverFrameworks-UserMode 1011010111 user mode driver crash

What it means for you

On a personal computer

A driver for one of your devices crashed. Windows deliberately runs some drivers in a way that stops them crashing the whole PC, so this is the safety net doing its job. If a device stopped working, unplugging and replugging it usually brings it back; if nothing seems wrong, the device recovered on its own.

For an analyst

UMDF hosts drivers in WUDFHost.exe, so one fault kills every driver sharing that host instance. Printers, scanners, fingerprint readers, biometric devices and many USB peripherals are the usual occupants. Pair 10110 with 10111 — 10111 records the host being terminated where 10110 records the problem — and match the timestamps against sleep and resume transitions, which is where most repeat offenders cluster.

The fields that decide it

Everything else in the log line is context.

Device or driver named
Which user-mode driver failed. Often given as a hardware ID rather than a friendly name, so expect to look it up in Device Manager by matching the ID.
Hosting process
WUDFHost.exe, the process that ran the driver. Because several drivers share a host, the device that stopped working may not be the one that faulted.
Whether 10111 accompanies it
10111 records the host process being terminated. The pair together mean the host actually died rather than merely reporting a problem.
Relationship to sleep and resume
Not a field, but the strongest pattern. Faults concentrated at wake-from-sleep are almost always a power management bug in the driver rather than failing hardware.

Common questions

Is Event 10110 as serious as 'Critical' suggests?

Rarely. User-mode drivers are deliberately isolated so that a fault kills only the host process, not Windows. The Critical label describes a driver crashing, not the machine being at risk. On a machine where everything still works, a single 10110 needs no action; it is worth investigating when a device stops working or the event repeats daily.

Which device caused Event 10110?

The event usually gives a hardware ID rather than a name. Copy it into Device Manager's search, or match it against the Details tab of each device, to identify the hardware. Bear in mind that several user-mode drivers share one host process, so the device that visibly stopped working is not necessarily the one that crashed.

Event 10110 happens every time my PC wakes from sleep. Why?

That pattern points at the driver's power management rather than the device. Resuming from sleep requires the driver to restore state, and a bug there faults the host. Updating the driver is the fix when one exists; otherwise, disabling 'Allow the computer to turn off this device to save power' for that device in Device Manager avoids the code path entirely.

What is the difference between Event 10110 and 10111?

10110 reports that a problem occurred with one or more user-mode drivers. 10111 reports that the host process was terminated as a result. They are two halves of one incident and usually appear together; seeing 10110 without 10111 means the framework noticed a problem without having to kill the host.

Read next

Mentioned by

Vendor documentation

Last reviewed 6 September 2026