Storm season is back, bringing with it the potential for significant weather events. If you have clients in areas prone to infrastructure disruption, visit the Disaster Recovery Resources guide for preparedness information. Datto recommends performing proactive disaster recovery testing to mitigate potential downtime. See our articles about the importance of disaster recovery testing and Preparing For A Cloud Virtualization Test: Policies, Procedures, And Partner Responsibilities to learn more. For live updates, follow @datto on Twitter.

Backup Verification: Troubleshooting STOP Code c000021a {Fatal System Error}

Follow

Error

STOP: c000021a {Fatal System Error}

The Verification of a KnownDLL failed. system process terminated unexpectedly wit h a status of 0xc000012f (0x00641a10 0x00000000). The system has been shut down.

Cause

The STOP: c000021a (Fatal System Error) error occurs when the Windows NT kernel detects that either Winlogon.exe or Csrss.exe processes has failed. When this happens, the Windows NT kernel stops the system and generates the stop error message.

Although there can be many causes of this problem, some of the most common causes are

    • You have mismatched system files installed on the system.
    • A Service Pack installation failed to complete.
    • You recently restored a few files on the hard disk, but the process failed to correctly restore the files that where in use during the restoration.
    • You have an incompatible third-party software on your computer.
    • Missing or corrupt system files.

Solution

Section 1: Attempt differential merge:

  1. Force a differential merge of the agent. https://kb.datto.com/hc/en-us/articles/200554185-Differential-Merge
  2. When completed, force a screenshot test of the newly created backup. https://kb.datto.com/hc/en-us/articles/205924920
  3. If the issue persists, follow the next section.

Section 2: Diagnose and repair Winlogon.exe and/or CSRSS.exe.

To resolve this issue, you first need to find out which of the two processes (Winlogon.exe or Csrss.exe) failed and the reason behind their failure.

To find out this information, you need to register Dr. Watson as the default debugger program-ideally, it should already be the default debugger for your system.

The Dr. Watson debugger program logs all information related to failed processes to the Drwtsn32.log file. In addition to this, the debugger program can be configured to create memory dump files related to the failed processes. You can refer these dump files to analyze the reason behind a process failure.

Perform the following steps to configure Dr. Watson as the default debugger program to record user-mode program errors:

    1. Open Start menu, select Run, type Drwtsn32.exe -I and then press Enter. This command sets Dr. Watson as the default debugger.
    2. Next, run the Drwtsn32.exe command.
    3. In the Dr. Watson for Windows dialog box, select the following check boxes:
    • Append to Existing Log File
    • Visual Notification
    • Create Crash Dump File
    1. Now, when your computer restarts after the STOP 0xC000021A error is generated, run the Dr. Watson command.
    2. Here, view the paths to the Dr. Watson and User.dmp logs.
    3. Open Windows Explorer, navigate to the log files and then open them.
    4. Here, check the cause behind the STOP 0xC000021A error.

Most of the time, this error occurs due to the failure of the Winlogon.exe process. This usually happens if a faulty third-party Graphical Identification and Authentication (GINA) DLL exists on your system.

GINA is a replaceable DLL component that is used to perform the following tasks:

    • Implement the authentication policy of the interactive logon model.
    • Perform user interactions, such as authentication and identification.

At times, a remote control software may replace the default GINA DLL file, msgina.dll, on your computer and you may face the stop error. This is the reason why it is a good idea to first check if you have a third-party msgina.dll on your computer. To do this, run the regedit command to open the Registry Editor tool. Here, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Here, check if the value GinaDLL REG_SZ is on the right pane. If the value is there and its value is different from msgina.dll then it means that a third-party software has changed this value. In case this value is not there, it implies that that your system uses msgina.dll as the default DLL file for GINA.

If this error follows a new driver, service or third-party software installation, you must try to uninstall this new software to repair the error. To do this, you may use a good third-party program uninstaller tool, such as Perfect Uninstaller to ensure complete removal. You may also try to install an update for the software, if it is available.

You may also try to boot the system with Last known good configuration information to see if the error goes. If nothing works, you may have to perform and in-place upgrade of your operating system to resolve the error.

Additional Recommendations

Driver Update: Many errors are related to driver problems such as obsolete, outdated or incompatible drivers. A driver update tool is recommended to scan your system for corrupted and outdated drivers and to ensure that all your drivers stay up-to-date.

Section 3: Repair Filesystem

  1. If the above solution did not resolve the issue, perform the following:
  2. On the protected system, have the partner run: 'chkdsk /r <driveLetter>' and complete the disk check.
  3. Once the check is complete, have the partner run 'sfc /scannow'.
  4. When that has completed, force a differential merge of the agent. https://kb.datto.com/hc/en-us/articles/200554185-Differential-Merge
  5. When completed, force a screenshot test of the newly created backup. https://kb.datto.com/hc/en-us/articles/205924920
  6. If the issue persists, destroy the live dataset of the agent and force a new full backup: https://kb.datto.com/hc/en-us/articles/205311910-Configure-Destroy-Live-Dataset  https://kb.datto.com/hc/en-us/articles/213841643-Manual-backup
  7. When completed, force a screenshot test of the newly created backup. https://kb.datto.com/hc/en-us/articles/205924920

 

If you have tried all the steps above and are still having issues, please gather the Agent Diagnostic Logs as appropriate, and attach to the ticket.


Was this article helpful?

0 out of 0 found this helpful

You must sign in before voting on this article.

Want to talk about it? Head on over to our Community Forum!

  • Avatar
    Jeremy Galindo

    Please describe the issue in detail:


    I feel the partner could benefit from having this article being public. Just needs the removal at the bottom for "Request Level 2 Escalation". They can perform all of the steps within the article without issue.