Stop 0xc000021a

Source
Cause
The STOP 0xC000021A error occurs when either Winlogon.exe or Csrss.exe fails. When the Windows NT kernel detects that either of these processes has stopped, it stops the system and raises the STOP 0xC000021A error. This error may have several causes. Among them are the following:

• Mismatched system files have been installed.
• A Service Pack installation has failed.
• A backup program that is used to restore a hard disk did not correctly restore files that may have been in use.
• An incompatible third-party program has been installed. 

Solution
To troubleshoot this problem, you must determine which of these processes failed and why.
To determine which process failed, register Dr. Watson as the default system debugger (if it is not already the default debugger). Dr. Watson for Windows NT logs diagnostic information about process failures to a log file (Drwtsn32.log). Also, you can configure this program to produce memory dump files of failed processes that you can analyze in a debugger to determine why a process fails.
To set up Dr. Watson to trap user-mode program errors, follow these steps:

1. At a command prompt, type
   System Root\System32\Drwtsn32.exe -Iand then press ENTER.
   This command configures Dr. Watson as the default system debugger.
2. At a command prompt, type System Root\System32\Drwtsn32.exe, and then select the following options:
   Append to existing log file
   Create crash dump
   Visual Notification
3. After the computer restarts from the STOP 0xC000021A error, run Dr. Watson (Drwtsn32.exe).
4. View the Dr. Watson log to determine what user mode process may be causing the problem.
5. If the Dr. Watson log does not contain sufficient information to determine the cause of the problem, analyze the User.dmp file to determine the cause of the STOP 0xC000021A error.
   If Dr. Watson did not create a User.dmp file for either Winlogon.exe or Csrss.exe, you may have to use a different tool to generate a memory dump file of the process that fails. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
   241215  How to use the Userdump.exe tool to create a dump file
   Note Follow the instructions in the Knowledge Base article to troubleshoot a process that shuts down with an exception. While you follow these instructions, monitor the following processes to troubleshoot the STOP 0xC000021A error:
   • Winlogon.exe
   • Csrss.exe
   Note Most STOP 0xC000021A errors occur because Winlogon.exe fails. This typically occurs because of a faulty third-party Graphical Identification and Authentication (GINA) DLL. The GINA is a replaceable DLL component that Winlogon.exe loads. The GINA implements the authentication policy of the interactive logon model. The GINA performs all identification and authentication user interactions.

It is very common for certain types of remote control software to replace the default Windows GINA DLL (Msgina.dll). Therefore, a good first step is to examine the system to see if it has a third-party GINA DLL. To do this, locate the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value = GinaDLL REG_SZ

• If the Gina DLL value is present and if it is anything other than Msgina.dll, it probably means that a third-party product has changed this value.
• If this value is not present, the system uses Msgina.dll as the default GINA DLL.

If this error first occurred after the installation of a new or updated device driver, system service, or third-party program, the new software should be removed or disabled. Contact the manufacturer of the software to see if an update is available. For more information about hardware and software vendor contact information, visit the following Microsoft Web site: -

  http://support.microsoft.com/gp/vendors  

Last known good configuration
If the previous steps in this article do not resolve the problem, start the computer by using the last known good configuration. To start the computer by using the last known good configuration, follow these steps:Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Click Start, and then click Shut Down.
2. Click Restart, and then click OK.
3. Press F8 at the indicated time:
   • For an x86-based computer: When a screen of text appears and then disappears , press F8. (The screen of text may include a memory test, lines about the BIOS, and other lines.) There may also be a prompt that tells you when to press F8.
   • For an Itanium architecture-based computer: After you make your selection from the boot menu, press F8. There may be a prompt that tells you when to press F8.
4. Use the arrow keys to select Last Known Good Configuration, and then press ENTER.
   
   NUM LOCK must be off before the arrow keys on the numeric keypad will function.
5. Use the arrow keys to highlight an operating system, and then press ENTER.

NotesChoosing the Last Known Good Configuration startup option provides a way to recover from problems such as a newly added driver that may be incorrect for your hardware. However, it does not solve problems that are caused by corrupted or missing drivers or files.

• When you choose the Last Known Good Configuration option, only the information in registry key HKLM\System\CurrentControlSet is restored. Any changes you have made in other registry keys remain.

In-place upgrade
If the previous steps in this article do not resolve the problem, perform an in-place upgrade. For more information about how to do this,, click the following article numbers to view the articles in the Microsoft Knowledge Base:

292175  How to perform an in-place upgrade of Windows 2000

315341  How to perform an in-place upgrade (reinstallation) of Windows XP

816579  How to perform an in-place upgrade of Windows Server 2003

Remove incompatible software by using the Recovery Console
If the previous steps in this article do not resolve the problem, remove incompatible software by using the Recovery Console. Complete steps that describe how to do this are beyond the scope of this article. However, you may be able to use the following articles as guidelines for performing this procedure.

313670  How to replace a driver by using Recovery Console in Windows 2000

816104  How to replace a driver by using Recovery Console in Windows Server 2003

326215  How to use the Recovery Console on a Windows Server 2003-based computer that does not start

229716  Description of the Windows 2000 Recovery Console

307654  How to install and use the Recovery Console in Windows XP

307545  How to recover from a corrupted registry that prevents Windows XP from starting

216417  How to install the Windows Recovery Console 

============

To troubleshoot this problem, you must determine which of these processes failed and why.

To determine which process failed, register Dr. Watson as the default system debugger (if it is not already the default debugger). Dr. Watson for Windows NT logs diagnostic information about process failures to a log file (Drwtsn32.log). Also, you can configure this program to produce memory dump files of failed processes that you can analyze in a debugger to determine why a process fails.

To set up Dr. Watson to trap user-mode program errors, follow these steps:

1. At a command prompt, type System Root\System32\Drwtsn32.exe -I, and then press ENTER.
   
   This command configures Dr. Watson as the default system debugger.
2. At a command prompt, type System Root\System32\Drwtsn32.exe, and then select the following options:
   Append to existing log file
   Create crash dump
   Visual Notification
3. After the computer restarts from the STOP 0xC000021A error, run Dr. Watson (Drwtsn32.exe).
4. View the Dr. Watson log to determine what user mode process may be causing the problem.
5. If the Dr. Watson log does not contain sufficient information to determine the cause of the problem, analyze the User.dmp file to determine the cause of the STOP 0xC000021A error.
   
   If Dr. Watson did not create a User.dmp file for either Winlogon.exe or Csrss.exe, you may have to use a different tool to generate a memory dump file of the process that fails. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
   241215  How to use the Userdump.exe tool to create a dump file
   Note Follow the instructions in the Knowledge Base article to troubleshoot a process that shuts down with an exception. While you follow these instructions, monitor the following processes to troubleshoot the STOP 0xC000021A error:
   • Winlogon.exe
   • Csrss.exe
   Note Most STOP 0xC000021A errors occur because Winlogon.exe fails. This typically occurs because of a faulty third-party Graphical Identification and Authentication (GINA) DLL. The GINA is a replaceable DLL component that Winlogon.exe loads. The GINA implements the authentication policy of the interactive logon model. The GINA performs all identification and authentication user interactions.

It is very common for certain types of remote control software to replace the default Windows GINA DLL (Msgina.dll). Therefore, a good first step is to examine the system to see if it has a third-party GINA DLL. To do this, locate the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value = GinaDLL REG_SZ

• If the Gina DLL value is present and if it is anything other than Msgina.dll, it probably means that a third-party product has changed this value.
• If this value is not present, the system uses Msgina.dll as the default GINA DLL.

If this error first occurred after the installation of a new or updated device driver, system service, or third-party program, the new software should be removed or disabled. Contact the manufacturer of the software to see if an update is available. For more information about hardware and software vendor contact information, visit the following Microsoft Web site: -

  http://support.microsoft.com/gp/vendors  

Last known good configuration

If the previous steps in this article do not resolve the problem, start the computer by using the last known good configuration. To start the computer by using the last known good configuration, follow these steps:Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Click Start, and then click Shut Down.
2. Click Restart, and then click OK.
3. Press F8 at the indicated time:
   • For an x86-based computer: When a screen of text appears and then disappears , press F8. (The screen of text may include a memory test, lines about the BIOS, and other lines.) There may also be a prompt that tells you when to press F8.
   • For an Itanium architecture-based computer: After you make your selection from the boot menu, press F8. There may be a prompt that tells you when to press F8.
4. Use the arrow keys to select Last Known Good Configuration, and then press ENTER.
   
   NUM LOCK must be off before the arrow keys on the numeric keypad will function.
5. Use the arrow keys to highlight an operating system, and then press ENTER.

Notes

• Choosing the Last Known Good Configuration startup option provides a way to recover from problems such as a newly added driver that may be incorrect for your hardware. However, it does not solve problems that are caused by corrupted or missing drivers or files.
• When you choose the Last Known Good Configuration option, only the information in registry key HKLM\System\CurrentControlSet is restored. Any changes you have made in other registry keys remain.

In-place upgrade 

If the previous steps in this article do not resolve the problem, perform an in-place upgrade. For more information about how to do this,, click the following article numbers to view the articles in the Microsoft Knowledge Base:

292175  How to perform an in-place upgrade of Windows 2000

315341  How to perform an in-place upgrade (reinstallation) of Windows XP

816579  How to perform an in-place upgrade of Windows Server 2003

Remove incompatible software by using the Recovery Console  

If the previous steps in this article do not resolve the problem, remove incompatible software by using the Recovery Console. Complete steps that describe how to do this are beyond the scope of this article. However, you may be able to use the following articles as guidelines for performing this procedure.

313670  How to replace a driver by using Recovery Console in Windows 2000

816104  How to replace a driver by using Recovery Console in Windows Server 2003

326215  How to use the Recovery Console on a Windows Server 2003-based computer that does not start

229716  Description of the Windows 2000 Recovery Console

307654  How to install and use the Recovery Console in Windows XP

307545  How to recover from a corrupted registry that prevents Windows XP from starting

216417  How to install the Windows Recovery Console

 =====================
How to Fix “STOP 0xC000021A” Error in Windows Server 2003

An error message while starting Windows Server 2003 system, halts the boot process and makes hard drive data inaccessible. A boot error message may appear owing to various reasons, the most common being system file corruption. Corruption of even a single system file (required at the time of boot process) halts the entire boot process. Just like other files, system files too are prone to corruption. And the cause of corruption can be virus attack, operating system damage, and human mistakes. To overcome system file corruption, a Windows user can format the system and restore data from an updated backup. However, in case no backup is available, a user needs to opt for a commercial partition recovery software.
For detailed explanation of the above problem, consider the below error message that appears when you try to boot your Windows Server 2003 machine:
“STOP: c000021a {Fatal System Error} The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000034 (0x00000000 0x0000000) The system has been shutdown.” (0x00000000 0x0000000) parameters are specific to system's configuration.
After the above error message pops up, the booting process stops, rendering to inaccessibility of the hard drive data.
Cause:
The above error message appears when the Windows NT kernel detects that Winlogon.exe and Csrss.exe processes have stopped. Winlogon.exe and Csrss.exe, are two very important system files that are required to boot system. This primarily occurs due to:
Installation of mismatched system files Failed installation of Service Pack Installation of incompatible third-party program Corruption of these two files
Resolution: To get past above boot error message and to access the data, you will need to:
1.Select 'Last Known Good Configuration' option to boot your system. 2.If the command does not work, then re-install Windows Server 2003 on your system.
Although re-installation allows you to overcome the above boot error message, it also deletes data from your hard drive. To recover data lost due to formatting, you need to use an effective third-party Partition Recovery application. Such Partition Recovery tools recover all formatted data from almost all kinds of formatted hard drives, including IDE, EIDE, etc.
===============
Quelle
Lösen des Problems

Die folgenden Empfehlungen gelten speziell für 0x21A-Stoppfehler.

• Da 0xC000021A-Stoppnachrichten in einem Benutzermodusprozess auftreten, liegt die Ursache dieses Fehlers meist in Anwendungen von Drittanbietern. Wenn der Fehler nach der Installation neuer oder aktualisierter Gerätetreiber, Systemdienste bzw. Anwendungen eines Drittanbieters auftritt, müssen Sie den Treiber entfernen, deaktivieren oder die Funktion zur Verwendung des installierten Treibers einsetzen oder die neue Software deinstallieren. Erkundigen Sie sich beim Softwarehersteller danach, ob ein Update erhältlich ist.
• Dieser Fehler kann durch Systemdateikonflikte hervorgerufen werden, wenn das System von Sicherungsmedien teilweise wiederhergestellt wird (als aktiv erkannte Dateien werden von einigen Sicherungsprogrammen nicht wiederhergestellt). Verwenden Sie stets Sicherungssoftware, die mit Windows XP Professional kompatibel ist.
• Wenn die Berechtigungen des Systemkontos geändert wurden, führen Sie die unten aufgelisteten Schritte aus, um wieder Zugriff auf die Startpartition zu erlangen:

1. Führen Sie in einer separaten Partition oder auf einem separaten Laufwerk eine parallele Installation von Windows XP Professional durch. Verwenden Sie nicht die ursprünglichen Laufwerk- und Ordnernamen, da die vorherigen Einstellungen von der neuen Windows XP Professional-Installation überschrieben werden. Schließen Sie die zweite Installation ab.
2. Geben Sie im Dialogfeld Ausführen im Feld Öffnen Folgendes ein: c:
3. Klicken Sie mit der rechten Maustaste auf den ursprünglichen %systemroot%-Ordner, und klicken Sie danach auf Eigenschaften.
4. Klicken Sie auf die Registerkarte Sicherheit, und erteilen Sie dem lokalen Konto SECURITY vollständige Zugriffsrechte für den %systemroot%-Ordner und dessen Unterordner.
5. Starten Sie das System neu, und wählen Sie im Startmenü die ursprüngliche Installation von Windows XP Professional aus.

Weitere Informationen zu 0xC000021A-Stoppnachrichten finden Sie auf der Seite für Webressourcen
(http ://www.microsoft.com/windows/reskits/webresources), wenn Sie auf den Hyperlink "Microsoft Knowledge Base" klicken. Verwenden Sie bei der Suche in der Knowledge Base die Schlüsselwörter winnt und 0xC000021A.