Troubleshooting Stop 0xc000021a Winlogon.exe
APPLIES TO
Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows Server 2003, Datacenter x64 Edition
Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
Microsoft Windows Server 2003, Enterprise x64 Edition
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
Microsoft Windows Server 2003, Standard x64 Edition
Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Microsoft Windows Server 2003, Web Edition x64 Edition
Microsoft Windows Server 2003, Web Edition (32-bit x86)
The third-party products that this blog discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
Third parties are responsible for testing their software together with Microsoft software.
Symptoms:
STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000080 (0x00000000 0x0000000)
The system has been shutdown.
Note: The parameter values could be different.
Note: This article only talks about winlogon.exe crashes of Stop C21A. I will be writing one for CSRSS.exe in the near future.
You will not get a kernel only memory dump nor a complete memory dump.
Even if you go thru 972110 How to generate a kernel dump file or a complete memory dump file in Windows Server 2003
https://support.microsoft.com/?id=972110
Dr. Watson and or Windows Error Reporting (W.E.R.) will not catch a user mode dump.
Cause:
There are many different reasons but the top one is due to third-party GINA’s loading in Winlogon.exe
Resolution:
Troubleshooting:
Step 1) Read thru:
156669 How to troubleshoot a "STOP 0xC000021A" error
https://support.microsoft.com/?id=156669
Step 2) Check to see if there is a 3rd party GINA loading in the Winlogon process.
Click on Start, Run, Regedit.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
GinaDLL
Note: By default, GinaDLL is not there.
Additionally, you could do a search for *gina*.dll
Start, Run, CMD.exe
C:
CD\
dir /s *gina*.dll
Note: The default gina is msgina.dll
So what do you do if you find a 3rd party GINA?
Look for an update.
What are some of the common 3rd party GINA's?
Citrix
Novell
Step 3) If you run a MPSReport
823393 Microsoft Product Support Reporting Tool - PFE edition (which I personally prefer)
https://download.microsoft.com/download/f/0/4/f047169c-6357-47f3-835c-2665d6426e66/mpsrpt_pfe.exe
or
Microsoft Product Support Reports
https://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0
From the MPSreports, open up Process.TXT and search for:
USERENV.DLL
and
Msgina.dll
and
winlogon.exe
For example:
Module[ 15] [C:\WINDOWS\SYSTEM32\USERENV.DLL]
Company Name: Microsoft Corporation
File Description: Userenv
Product Version: (5.2:3790.3959)
File Version: (5.2:3790.3959)
File Size (bytes): 1071104
File Date: Mon Jan 28 03:36:14 2008
Module TimeDateStamp = 0x45d6ccab - Sat Feb 17 03:36:43 2007
Module Checksum = 0x00113dc8
Module SizeOfImage = 0x0010a000
Module Pointer to PDB = [userenv.pdb]
Module PDB Guid = {42F10050-B855-4A1C-9F69-BC64B12D2412}
Module PDB Age = 0x2
In the winlogon.exe process, look for any non-Microsoft DLL's loading and check to see if there are updates from the vendor.
Step 4) Make sure that the following hotfix(es) are installed for your Operating System.
A. x64 Windows Server 2003 Service Pack 2:
---------------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
https://support.microsoft.com/?id=N/A950928 Error message when you restart a computer that is running Windows Server 2003 or an x64-based version of Windows XP Professional: "Stop 0xC000021A"
https://support.microsoft.com/?id=950928
Update(s): Userenv.dll
The latest version is in 958246
https://support.microsoft.com/?id=958246Optional:
Update(s): winlogon.exe
The latest version is in 971080
https://support.microsoft.com/?id=971080
B. x86 Windows Server 2003 Service Pack 2:
---------------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
https://support.microsoft.com/?id=N/AOptional:
Update(s): Userenv.dll
The latest version is in 958246
https://support.microsoft.com/?id=958246Optional:
Update(s): winlogon.exe
The latest version is in 971080
https://support.microsoft.com/?id=971080
C. x86 Windows Server 2003 Service Pack 1:
---------------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in "Service Pack 2" for Windows Server 2003Optional:
Update(s): Userenv.dll
The latest version is in 958246
https://support.microsoft.com/?id=958246Optional:
Update(s): winlogon.exe
The latest version is in "Service Pack 2" for Windows Server 2003
D. x86 Windows Server 2003 RTM:
----------------------------
Optional:
Update(s): Msgina.dll
The latest version is in "Service Pack 2" for Windows Server 2003889088 Your computer does not start and you receive a "Stop 0xC000021a" error message in Windows Server 2003
https://support.microsoft.com/?id=889088
Update(s): Userenv.dll
The latest version is in 913463
https://support.microsoft.com/?id=913463Optional:
Update(s): winlogon.exe
The latest version is in "Service Pack 2" for Windows Server 2003
E. x86 Windows XP Service Pack 3:
------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
https://support.microsoft.com/?id=N/AOptional:
Update(s): Userenv.dll
The latest version is in N/A
https://support.microsoft.com/?id=N/AOptional:
Update(s): winlogon.exe
The latest version is in N/A
https://support.microsoft.com/?id=N/A
F. x64 Windows XP Service Pack 2:
------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
https://support.microsoft.com/?id=N/A950928 Error message when you restart a computer that is running Windows Server 2003 or an x64-based version of Windows XP Professional: "Stop 0xC000021A"
https://support.microsoft.com/?id=950928
Update(s): Userenv.dll
The latest version is in 953663
https://support.microsoft.com/?id=953663Optional:
Update(s): winlogon.exe
The latest version is in N/A
https://support.microsoft.com/?id=N/A
G. x86 Windows XP Service Pack 2:
------------------------------
893376 Stack corruption occurs if you remove and insert a smart card during a user log on process in Windows XP Service Pack 1 or Windows XP Service Pack 2
https://support.microsoft.com/?id=893376
Update(s): Msgina.dll
The latest version is in 948277
https://support.microsoft.com/?id=948277922410 Error message when you restart a computer that is running Windows XP Professional: "Stop 0xC000021A"
https://support.microsoft.com/?id=922410
Update(s): Userenv.dll
The latest version is in 930597
https://support.microsoft.com/?id=930597Optional:
Update(s): winlogon.exe
The latest version is in 969557
https://support.microsoft.com/?id=969557
H. x64 Windows XP Service Pack 1:
------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in "Service Pack 3" for Windows XPOptional:
Update(s): Userenv.dll
The last version is in 953663
https://support.microsoft.com/?id=953663
The latest version is in "Service Pack 3" for Windows XPOptional:
Update(s): winlogon.exe
The last version is in 842308
https://support.microsoft.com/?id=842308
The latest version is in "Service Pack 3" for Windows XP
I. x86 Windows XP RTM:
------------------------------
893376 Stack corruption occurs if you remove and insert a smart card during a user log on process in Windows XP Service Pack 1 or Windows XP Service Pack 2
https://support.microsoft.com/?id=893376
Update(s): Msgina.dll
The last version is in 905865
https://support.microsoft.com/?id=905865
The latest version is in "Service Pack 3" for Windows XPOptional:
Update(s): Userenv.dll
The last version is in 903895
https://support.microsoft.com/?id=903895
The latest version is in "Service Pack 3" for Windows XPOptional:
Update(s): winlogon.exe
The last version is in
https://support.microsoft.com/?id=912354
The latest version is in "Service Pack 3" for Windows XP
Step 5)
A. Disable WER
Click on Start, right click on My Computer, Properties, Advanced tab
Error Reporting, check the box for "Disable error reporting"
Leave the check box for "But notify me when critical errors occur".
Click on OK twice.
Note: When you are done troubleshooting, re-enable it.
B. Below are the steps to collect a memory dump before the process crashes again. Please let me know if you have any questions.
1. Download and install "Debugging Tools for Windows" to C:\DEBUGGERS folder by selecting "Custom" during the install, if not already installed. "Debugging Tools for Windows" is available from:
For 32 Bit systems: https://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
For 64 Bit systems: https://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx
By default it installs to "c:\Program Files\Debugging Tools for Windows"
2. Click Start, Run, CMD to open a command prompt then type the following:
CD\debuggers
CScript adplus.vbs -crash -p PID -o c:\adplus
Note: Where PID is the number shown in Task Manager (TaskMgr.exe) "Processes" tab for winlogon.exe. It’s usually PID in the 300 range, for example: 306 or 308.
WARNING: The winlogon.exe that we need to capture is for Session 0. The other winlogon.exe's will not cause a Stop c21A.
Note: Do not capture 1st chance exceptions, it could fill up your hard drive.
3. Close the popup Warning dialog indicating that the symbols are missing, if displayed.
Please do not close the minimized "\cdb.exe" window.
You can lock the system, but do not log off while ADPlus is monitoring the process. If you need to log off, we will need to use a different tool called userdump.exe. The userdump.exe download includes an extensive help file. Userdump.exe is available from https://www.microsoft.com/downloads and I will be happy to assist you with it if needed.
4. When the crash occurs, please zip the c:\adplus folder and send it to us for analysis.
Keyword: Bugcheck 0xc000021a , Bugcheck c000021a, Bugcheck c21a
Comments
Anonymous
January 07, 2010
It's cool post. Sometimes I receive critsit case like this. Isn't it related to gina issue if the problem is the same when safe mode?Anonymous
February 14, 2010
The comment has been removed