Knowledge base
What does stop code 0xC000021A mean?
0xC000021A (STATUS_SYSTEM_PROCESS_TERMINATED) means Windows cannot continue because a critical process or user-mode subsystem has terminated. Microsoft names Winlogon and CSRSS among the relevant processes.
The code does not identify the file, driver or update that caused the failure. Do not immediately replace winlogon.exe or blindly remove the latest update.
Common symptoms
- Windows passes the first bootloader stage and then crashes;
- the PC restarts automatically;
- Automatic Repair keeps returning;
- Safe Mode fails in the same way;
- the problem began after a Windows update, driver or security change;
- there may be no useful crash dump because the failure occurs early.
Photograph the full stop code and record what happened immediately before the first crash.
1. Check storage, data and BitLocker
Confirm that the SSD appears consistently in UEFI and can be read normally.
If the drive reports errors or disappears, create an image or safe data copy first. Do not perform intensive Windows repair on a drive that may be failing.
manage-bde -status
The Windows volume must be unlocked before you inspect logs, packages and system files offline.
2. Try the built-in recovery routes
From WinRE, try:
- Startup Repair;
- removing the latest quality update if the failure began directly after an update;
- System Restore if a suitable restore point exists;
- Safe Mode.
If Safe Mode works, back up data and investigate recent drivers, software and security products.
If Safe Mode crashes with the same code, continue with Windows components, early drivers, updates, storage and other hardware.
3. Identify the offline Windows volume
diskpart
list volume
exit
dir C:\Windows
dir D:\Windows
dir E:\Windows
Use D: in the examples below only after confirming that Windows, Program Files and Users are present there.
4. Read package state and component-store health
dism /Image:D:\ /Get-CurrentEdition
dism /Image:D:\ /Get-Packages /Format:Table
dism /Image:D:\ /Cleanup-Image /ScanHealth
Keep:
D:\Windows\Logs\CBS\CBS.log;D:\Windows\Logs\DISM\dism.log;- relevant Windows Update and servicing logs.
After a failed update, these can show whether a package completed or remains pending.
5. Check Windows components and protected files
Repair Windows offline with DISM and SFC →
A targeted check of winlogon.exe can be useful when that file is part of the diagnosis:
sfc /verifyfile=D:\Windows\System32\winlogon.exe /offbootdir=D:\ /offwindir=D:\Windows
Do not use loose copies of winlogon.exe or other system files from download sites.
6. Test early drivers reversibly
Storage, authentication and security drivers can load early during startup.
If logs or recent changes point to one driver:
- record the original configuration;
- make a recovery copy where possible;
- test one driver or service at a time;
- record whether the stop code, failure point or Safe Mode behaviour changes.
7. Check the Windows update state
If the update completed and the failure began afterwards, start with the supported uninstall route:
Remove a Windows update through WinRE or Windows PE →
If logs and package state show an update that did not finish, and rollback does not restore a working previous state, check the offline package-install route:
Install a Windows update offline with DISM →
8. EFI and BCD
If Windows Boot Manager works and 0xC000021A appears later while Windows is loading, do not start by rebuilding BCD.
Use BCDBoot when Windows Boot Manager is missing, boot configuration is demonstrably wrong or updated boot files need to be copied after offline servicing.
Repair EFI and BCD with BCDBoot →
Real-world example: KB5120998
On 3 September 2026, we investigated one Windows 11 PC with recurring 0xC000021A.
Memory tests found no fault, the SSD remained visible and Windows components could be repaired, but the crash continued. Rollback did not help either.
Local package state and logs showed that preview update KB5120998 had not completed. After the exact verified package was applied offline, the image reported build 26200.9278 and Windows finished the remaining configuration during subsequent boots.
This does not show that KB5120998 generally causes 0xC000021A. It was one machine-specific update installation.
Stop if
- the SSD is unreliable;
- the Windows volume or BitLocker state is uncertain;
- package state and previous changes cannot be reconstructed;
- you would have to change several possible causes at once;
- a matching official repair source or update cannot be identified exactly.
Need help? Contact Forcys →