Bug Check 0xC000021A: WINLOGON_FATAL_ERROR

The WINLOGON_FATAL_ERROR bug check has a value of 0xC000021A. This means that that the Winlogon process terminated unexpectedly.

This topic is for programmers. If you are a customer who has received a blue screen error code while using your computer, see Troubleshoot blue screen errors.

WINLOGON_FATAL_ERROR Parameters

A string that identifies the problem

Cause

This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system.

Mismatched system files can also cause this error. This mismatch can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use.

Resolution

Running the kernel debugger may not be useful in this situation because the actual error occurred in a user-mode process.

Resolving an error in a user-mode device driver, system service, or third-party application

Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications. If the error occurred after the installation of a new or updated device driver, system service, or third-party application, the new software should be removed or disabled to isolate the cause. Contact the manufacturer of the software about a possible update.

Resolving a mismatched system file problem

If you have recently restored your hard disk from a backup, check if there is an updated version of the backup/restore program available from the manufacturer.

Look at the most recently installed applications. To do this navigate to «Uninstall or change a program» in control panel and sort the installed applications by install date.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. For more information, see Open Event Viewer. Look for critical errors in the system log that occurred in the same time window as the blue screen.

Check the System Log in Event Viewer for additional error messages that might help pinpoint the device or driver that is causing the error. Look for critical errors in the system log that occurred in the same time window as the blue screen.

Remarks

Use the System File Checker tool to repair missing or corrupted system files. The System File Checker is a utility in Windows that allows users to scan for corruptions in Windows system files and restore corrupted files. Use the following command to run the System File Checker tool (SFC.exe).

Run a virus detection program. Viruses can infect all types of hard disks that are formatted for Windows, and the resulting disk corruption can generate system bug check codes. Make sure the virus detection program checks the Master Boot Record for infections.

Verify that the system has the latest updates installed. To detect which version is installed on your system, select Start, select Run, type winver, and then press ENTER. The About Windows dialog box displays the Windows version number (and the version number of the service pack, if one is installed).

Using Safe Mode

Consider using Safe Mode to isolate elements for troubleshooting and, if necessary, to use Windows. Using Safe Mode loads only the minimum required drivers and system services during the Windows startup.

To enter Safe Mode, use Update and Security in Settings. Select RecoveryВ > Advanced startup to boot to maintenance mode. At the resulting menu, choose TroubleshootВ > Advanced OptionsВ > Startup SettingsВ > Restart. After Windows restarts and displays the Startup Settings screen, select option 4, 5, or 6 to boot to Safe Mode.

Safe Mode may also be available by pressing a function key on boot, for example F8. Refer to information from the computer’s manufacturer for specific startup options.

Fix “The Windows Logon Process has Unexpectedly Terminated”

The Windows Logon process is a complicated system process that handles the Windows logon screen, user authentication, loading the user profile, locking the computer, and much more.

There are many errors assoicated with the Windows Logon process, but there are two that I have run into on many occasions.

The Windows logon process has unexpectedly terminated.

and

STOP: c000021a
The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000034.The system has been shutdown.

Depending on whether you are getting this error on Windows XP, Windows Server 2003, or Windows Server 2008, there are several ways to fix the problem. Basically, the Winlogon.exe or Csrss.exe processes have failed and therefore the system crashes.

In this post, I’ll try and walk you though several solutions that have worked in the past to solve this error.

Windows Server 2003/2008

If you’re getting this error on a server, the cause can probably be attributed to one of the following problems below. Scroll down if you are having the problem on Windows XP, Vista or 7.

• Lack of system resources (hard disk space, memory, CPU)
• Corrupted Windows registry
• Service that has failed to start

To check for lack of system resources, check the amount of free hard drive space on the partition where Windows is installed. You can also open the Task Manager and go to the Performance tab to make sure 100% of the CPU is not being used. In the Task Manager, you can also check the amount of available RAM.

If the Windows registry is corrupt, you may not even be able to log onto the computer. In that case, you will have to try and get in using Safe Mode or use the Recovery Console to run the Startup Repair utility, which I will explain below.

If a service failed to start and that’s what is causing the problem, you can click on Start, Control Panel, Administrative Tools, and then Event Viewer. Click on the System log and look for any white exclamation points in a red circle. These indicate that a service or driver failed.

Resources

To fix the first problem of lack of resources, you can either free up some hard drive space or disable some services that are taking up large amounts of memory or CPU power.

Registry

If your Windows Registry is corrupted, you will have to repair it using Startup Repair. You can do this by booting your computer from the CD/DVD and choosing the Repair Your Computer option.

Next, choose your operating system and click Next. A list of system recovery options will appear. Here you should choose Startup Repair.

Startup Repair will automatically find problems with your computer and try to repair it. Once it’s finished, restart your computer and see if your problem has gone away.

You can also repair a corrupt registry by using System Restore. Go to Start and type in systempropertiesprotection and press Enter. Click on the System Protection tab and click on System Restore.

Click on Choose a different restore point and click Next. Pick a restore point when your computer was working and click Next. After the registry is restored, restart your computer.

Services

Lastly, if a service has failed to start, you can manually try to start it by going to Start and typing in services.msc. In the Services dialog, find the service, right-click on it and choose Start.

Windows XP, Vista, 7

If you’re running any of these operating systems, you can try a couple of more things to try and fix the problem.

Last Known Good Configuration

Restart your computer and press F8 when it is booting up. This will get you the Advanced Boot Options.

This can help you recover from problems resulting from newly installed drivers that may not be compatible with your system.

Reinstall Windows

If that doesn’t work, then you may have to try reinstalling Windows. This is also called a repair install. It basically replaces all your system files, but keeps all your data and applications. You will have to reinstall all Windows updates after perform a repair.

You can read our previous post on how to perform a repair install (scroll to the bottom of the post).

GINA DLL

A lot of times the Winlogon.exe process fails due to a bad GINA DLL that has replaced the original Microsoft one. The GINA DLL file performs all authentication and identification tasks during the logon process.

You can check to see if the original file has been replaced by a third-party one by going to the following registry key:

If there is a key called Gina DLL and it’s value is not Msgina.dll, then the dll has been replaced with a third party program. If they key does not exist at all, then the system is using the default Msgina.dll file.

If there is a third-party file being used, you need to remove or disable the third party software. Usually, this is done by remote control software, so if you have any remote control programs installed, remove those.

Uninstall Windows Update

If you are getting this message right after installing the latest Windows updates, you can try to uninstall them using the recovery console.

Check out this forum post below for the steps to uninstall a particular update:

Hopefully one of these solutions will solve your problem! If not, post a comment here and I’ll try to help! Enjoy!

Founder of The Back Room Tech and managing editor. He began blogging in 2007 and quit his job in 2010 to blog full-time. He has over 15 years of industry experience in IT and holds several technical certifications. Read Aseem’s Full Bio

ошибка c000021a . windows logon process . 0xc0000006(0х00000000 0x00000000)

Win xp sp3. При включении копьютера выкидывает bsod с C000021a . windows logon process . 0xc0000006(0х00000000 0x00000000) вместо точек нечитаемые символы. Помогает рестарт.

Что можно сделать, как исправить?

Вспомните, какие были выполнены манипуляции до возникновения проблемы.

Проверьте в ветке реестра HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Имя Userinit должно содержать значение C:\WINDOWS\system32\userinit.exe,

Причины возникновения ошибки c000021a

Появляется при завершении Winlogon.exe и ли Csrss.exe . Windows не может работать без этих процессов. Также c000021a появляется при неудачном запуске smss.exe.

Подробнее об устранении этой ошибки можно узнать здесь .

Пошаговая инструкция

• Если в сообщении присутствует Windows Logon Process

1. Загружаемся с диска Windows PE или подключаем HDD к другому ПК

2. Стартуем regedit.exe

3. Щелкаем HKEY_LOCAL_MACHINE, выбираем Загрузить куст

4. На диске с нерабочей системой находим файл WINDOWS\system32\config\SOFTWARE .

5. Пишем имя раздела TEST

6. Находим раздел HKEY_LOCAL_MACHINE\TEST\Microsoft\Windows NT\Winlogon

7. Делаем параметр GinaDll равным msgina.dll. Если такого параметра нет, создавать его не надо .

8. Находим раздел HKEY_LOCAL_MACHINE\TEST\Microsoft\Windows NT\Winlogon\Notify

9. Смотрим, нет ли подозрительных Winlogon notification package .
Выгружаем куст
Перезагружаемся

• Если в сообщении присутствует Session manager initialization или запуска диспетчера сеанса

1. Загружаемся с диска Windows PE или подключаем HDD к другому ПК

2. Стартуем regedit.exe

3. Щелкаем HKEY_LOCAL_MACHINE, выбираем Загрузить куст

4. На диске с нерабочей системой находим файл WINDOWS\system32\config\SYSTEM .

5. Пишем имя раздела TEST

6. Находим раздел HKEY_LOCAL_MACHINE\TEST\nnnn\Control\Session Manager, где nnnn принимает значения CurrentControlSet, ControlSet001, ControlSet002 и т.д.

7. Делаем параметр BootExecute равным

После этой строки должен быть ENTER. Тип параметра REG_MULTI_SZ.

Удаляем параметр PendingFileRenameOperations.
Выгружаем куст
Перезагружаемся

Такую ошибку может вызывать:

— аппаратная неисправность — перегрев центрального процессора. При возникновении ошибки следует проверить температуру CPU и исправность системы его охлаждения.

— программа Vipnet, в таком случае необходимо удалить раздел реестра HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe

Так же, следует проверить наличие самого файла %WINDIR%\system32\winlogon.exe, его отсутствие вызывает эту же ошибку, плюс невозможность зайти в безопасном режиме.

— вирус Win32:Nebuler-X. Обнаружен и вылечен антивирусом Avast в c:\windows\system32\winkpb32.dll и winmxw32.dll.

— запуск MPC HomeCinema версии 1.5.0.2827 (x86) на ноутбуке Acer Aspire 5520G с ОС Windows XP SP2; деинсталляция этой и установка более старой версии 1.3.1249.0 (x86) решила проблему.

— драйвер CryptoPro, в этом случае загрузить WinPE и переименовать файл c:\windows\system32\drivers\cproctrl.sys , после чего Windows должна загрузиться нормально. В Windows нужно конвертировать файловую систему диска C: в NTFS выполнив в командной строке convert c: /fs:ntfs . Далее можно переименовать драйвер CryptoPro к исходному имиени.

— нехватка свободного места на системном разделе.

— некорректная работа планки памяти («битая память», несовместимость с другими планками)