This Solution is intended
for advanced computer users. If you are not comfortable with advanced
troubleshooting, you might want to ask someone for help or contact
Technical Support.
When you use a server or a workstation that
is running one of the operating systems that is listed in the
"Applies to" section, you may receive the following error message:
STOP: c000021a {Fatal System Error}
The Windows
Logon Process system process terminated unexpectedly with a status
of 0xc0000034 (0x00000000 0x0000000)
The system has been
shutdown.
Note The parameters in parentheses
are specific to your computer configuration and may be different for
each occurrence.
Back to the top
CAUSE
The STOP 0xC000021A error occurs when
either Winlogon.exe or Csrss.exe fails. Wh...
loadTOCNode(1, 'cause');
The STOP 0xC000021A error occurs when either Winlogon.exe
or Csrss.exe fails. When the Windows NT kernel detects that either
of these processes has stopped, it stops the system and raises the
STOP 0xC000021A error. This error may have several causes. Among
them are the following:
- Mismatched system files have been
installed.
- A Service Pack installation has failed.
- A
backup program that is used to restore a hard disk did not correctly
restore files that may have been in use.
- An incompatible
third-party program has been installed.
RESOLUTION
To troubleshoot this problem, you must
determine which of these processes faile...
loadTOCNode(1, 'resolution');
To troubleshoot this problem, you must determine which of
these processes failed and why.
To determine which process
failed, register Dr. Watson as the default system debugger (if it is
not already the default debugger). Dr. Watson for Windows NT logs
diagnostic information about process failures to a log file
(Drwtsn32.log). Also, you can configure this program to produce
memory dump files of failed processes that you can analyze in a
debugger to determine why a process fails.
To set up Dr. Watson
to trap user-mode program errors, follow these steps:
- At
a command prompt, type System Root\System32\Drwtsn32.exe
-I, and then press ENTER.
This command configures
Dr. Watson as the default system debugger.
- At a command
prompt, type System Root\System32\Drwtsn32.exe,
and then select the following options:
Append to existing log file
Create crash dump
Visual
Notification
- After the computer restarts
from the STOP 0xC000021A error, run Dr. Watson (Drwtsn32.exe).
- View
the Dr. Watson log to determine what user mode process may be
causing the problem.
- If the Dr. Watson log does not contain
sufficient information to determine the cause of the problem,
analyze the User.dmp file to determine the cause of the STOP
0xC000021A error.
If Dr. Watson did not create a User.dmp
file for either Winlogon.exe or Csrss.exe, you may have to use a
different tool to generate a memory dump file of the process that
fails. For more information, click the following article number to view
the article in the Microsoft Knowledge Base:
241215
(http://support.microsoft.com/kb/241215/
)
How to use the Userdump.exe tool to create a dump file
Note Follow the instructions in the Knowledge Base
article to troubleshoot a process that shuts down with an exception.
While you follow these instructions, monitor the following
processes to troubleshoot the STOP 0xC000021A error:
Note
Most STOP 0xC000021A errors occur because Winlogon.exe fails. This
typically occurs because of a faulty third-party Graphical
Identification and Authentication (GINA) DLL. The GINA is a
replaceable DLL component that Winlogon.exe loads. The GINA
implements the authentication policy of the interactive logon model.
The GINA performs all identification and authentication user
interactions.
It is very common for certain types of remote
control software to replace the default Windows GINA DLL
(Msgina.dll). Therefore, a good first step is to examine the system
to see if it has a third-party GINA DLL. To do this, locate the
following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value = GinaDLL REG_SZ
- If the Gina DLL value is
present and if it is anything other than Msgina.dll, it probably
means that a third-party product has changed this value.
- If
this value is not present, the system uses Msgina.dll as the default
GINA DLL.
If this error first occurred after the installation
of a new or updated device driver, system service, or third-party
program, the new software should be removed or disabled. Contact the
manufacturer of the software to see if an update is available.
For more information about hardware and software vendor contact
information, visit the following Microsoft Web site:
-
http://support.microsoft.com/gp/vendors
(http://support.microsoft.com/gp/vendors)
Last known good configuration
loadTOCNode(3, 'resolution');
If the previous steps in this article do not resolve
the problem, start the computer by using the last known good
configuration. To start the computer by using the last known good
configuration, follow these steps:
Note Because there are
several versions of Microsoft Windows, the following steps may be
different on your computer. If they are, see your product
documentation to complete these steps.
- Click Start, and then click Shut
Down.
- Click Restart,
and then click OK.
- Press
F8 at the indicated time:
- For an x86-based computer: When a
screen of text appears and then disappears , press F8. (The
screen of text may include a memory test, lines about the BIOS, and
other lines.) There may also be a prompt that tells you when to
press F8.
- For an Itanium architecture-based computer: After
you make your selection from the boot menu, press F8. There may be a
prompt that tells you when to press F8.
- Use the
arrow keys to select Last Known Good
Configuration, and then press ENTER.
NUM LOCK must be
off before the arrow keys on the numeric keypad will function.
- Use
the arrow keys to highlight an operating system, and then press
ENTER.
Notes
- Choosing
the Last Known Good Configuration startup option provides a way to
recover from problems such as a newly added driver that may be
incorrect for your hardware. However, it does not solve problems that
are caused by corrupted or missing drivers or files.
- When
you choose the Last Known Good Configuration option, only the
information in registry key HKLM\System\CurrentControlSet is restored.
Any changes you have made in other registry keys remain.
×