Hulp op afstand

Knowledge base

What does stop code 0xC000021A mean?

0xC000021A (STATUS_SYSTEM_PROCESS_TERMINATED) means Windows cannot continue because a critical process or user-mode subsystem has terminated. Microsoft names Winlogon and CSRSS among the relevant processes.

The code does not identify the file, driver or update that caused the failure. Do not immediately replace winlogon.exe or blindly remove the latest update.

Lees in het Nederlands →

Common symptoms

  • Windows begins loading, then crashes;
  • the PC restarts automatically;
  • Automatic Repair keeps returning;
  • Safe Mode fails in the same way;
  • the problem began after a Windows update, driver or security change;
  • there may be no useful crash dump, the diagnostic file saved after a crash, because the failure occurs early.

Photograph the full stop code and record what happened immediately before the first crash.

1. Check storage, data and BitLocker

Confirm that the SSD appears consistently in UEFI, the computer’s settings before Windows starts, and can be read normally.

If the drive reports errors or disappears, create a disk image or safe file copy first. Do not perform intensive Windows repair on a drive that may be failing.

BitLocker encrypts the Windows volume. From a recovery command prompt, check its status:

manage-bde -status

The Windows volume must be unlocked before you inspect logs, packages and system files offline.

2. Try the built-in recovery routes

Open Windows Recovery Environment (WinRE), the recovery options available when Windows cannot start. Try:

  • Startup Repair;
  • removing the latest quality update if the failure began directly after an update;
  • System Restore if a suitable restore point exists;
  • Safe Mode.

If Safe Mode works, back up data and investigate recent drivers, software and security products.

If Safe Mode crashes with the same code, continue with Windows components, early drivers, updates, storage and other hardware.

3. Identify the offline Windows volume

The checks below run from a recovery command prompt against the installed copy of Windows while it is not running. This is what “offline” means here. Drive letters can differ from those used in normal Windows.

diskpart
list volume
exit
dir C:\Windows
dir D:\Windows
dir E:\Windows

Use D: in the examples below only after confirming that Windows, Program Files and Users are present there.

4. Check updates and Windows components

DISM examines the installed Windows image, including update packages and the component store used for repairs. These commands show the Windows edition, list packages and scan the store for damage:

dism /Image:D:\ /Get-CurrentEdition
dism /Image:D:\ /Get-Packages /Format:Table
dism /Image:D:\ /Cleanup-Image /ScanHealth

Keep:

  • D:\Windows\Logs\CBS\CBS.log;
  • D:\Windows\Logs\DISM\dism.log;
  • relevant Windows Update and servicing logs.

After a failed update, these can show whether a package completed or remains pending.

5. Check Windows components and protected files

DISM checks the component store; SFC checks protected system files against it. Follow the full procedure for repair sources and interpreting results:

Repair Windows offline with DISM and SFC →

A targeted check of winlogon.exe can be useful when that file is part of the diagnosis:

sfc /verifyfile=D:\Windows\System32\winlogon.exe /offbootdir=D:\ /offwindir=D:\Windows

Do not use loose copies of winlogon.exe or other system files from download sites.

6. Test a suspected driver one at a time

Storage, authentication and security drivers can load early during startup.

If logs or recent changes point to one driver:

  • record the original configuration;
  • make a recovery copy where possible;
  • test one driver or service at a time;
  • record whether the stop code, failure point or Safe Mode behaviour changes.

7. Check the Windows update state

If the update completed and the failure began afterwards, start with the supported uninstall route:

Remove a Windows update through WinRE or Windows PE →

If logs and package state show an update that did not finish, and rollback does not restore a working previous state, check the offline package-install route:

Install a Windows update offline with DISM →

8. Decide whether boot configuration needs attention

Windows Boot Manager starts the Windows loading process; BCD holds its boot configuration. If Boot Manager works and 0xC000021A appears later while Windows is loading, do not start by rebuilding BCD.

Use BCDBoot when Windows Boot Manager is missing, boot configuration is demonstrably wrong or updated boot files need to be copied after offline servicing.

Repair EFI and BCD with BCDBoot →

Real-world example: KB5120998

On 3 September 2026, we investigated one Windows 11 PC with recurring 0xC000021A.

Memory tests found no errors, although that cannot rule out every hardware fault. The SSD remained visible and Windows components could be repaired, but the crash continued. Rollback did not help either.

Local package state and logs showed that preview update KB5120998 had not completed. Applying the exact official cumulative package, verified by size and hash, offline was the decisive change. The Windows image then reported build 10.0.26200.9278. After one transitional boot with 0xC0000001, Windows reached sign-in and the PC ran stably afterward. Files, applications and configuration were retained.

This does not show that KB5120998 generally causes 0xC000021A. It was one machine-specific update installation.

Read the anonymised case →

Stop if

  • the SSD is unreliable;
  • the Windows volume or BitLocker state is uncertain;
  • package state and previous changes cannot be reconstructed;
  • you would have to change several possible causes at once;
  • a matching official repair source or update cannot be identified exactly.

Need help? Contact Forcys →