SIRIS, ALTO, and NAS: Backup Verification: Troubleshooting STOP Code c000021a {Fatal System Error}



Screenshot verification of a protected system fails with the error message, "STOP: c000021a {Fatal System Error} The Verification of a KnownDLL failed. system process terminated unexpectedly with a status of 0xc000012f (0x00641a10 0x00000000). The system has been shut down."


  • Datto SIRIS
  • Datto ALTO


The STOP: c000021a (Fatal System Error) error occurs when the Windows NT kernel detects that either the Winlogon.exe or Csrss.exe processes have failed. When this failure happens, the Windows NT kernel stops the system and generates the stop error message.

Although there can be many causes of this problem, some of the most common causes are:

    • You have mismatched system files installed on the system.
    • A Service Pack installation failed to complete.
    • You recently restored a few files on the hard disk, but the process failed to correctly restore the files that were in use during the restoration.
    • You have an incompatible third-party software on your computer.
    • Missing or corrupt system files.


Section 1: Attempt differential merge:

  1. Force a differential merge of the agent.
  2. When completed, force a screenshot test of the newly created backup.
  3. If the issue persists, follow the next section.

Section 2: Diagnose and repair Winlogon.exe and/or CSRSS.exe.

To resolve this issue, you first need to find out which of the two processes (Winlogon.exe or Csrss.exe) failed and the reason behind their failure.

To find out this information, you need to register Dr. Watson as the default debugger program-ideally, it should already be the default debugger for your system.

The Dr. Watson debugger program logs all information related to failed processes to the Drwtsn32.log file. In addition to this, the debugger program can be configured to create memory dump files related to the failed processes. You can refer these dump files to analyze the reason behind a process failure.

Perform the following steps to configure Dr. Watson as the default debugger program to record user-mode program errors:

    1. Open Start menu, select Run, type Drwtsn32.exe -I and then press Enter. This command sets Dr. Watson as the default debugger.
    2. Next, run the Drwtsn32.exe command.
    3. In the Dr. Watson for Windows dialog box, select the following check boxes:
    • Append to Existing Log File
    • Visual Notification
    • Create Crash Dump File
    1. Now, when your computer restarts after the STOP 0xC000021A error is generated, run the Dr. Watson command.
    2. Here, view the paths to the Dr. Watson and User.dmp logs.
    3. Open Windows Explorer, navigate to the log files and then open them.
    4. Here, check the cause behind the STOP 0xC000021A error.

Most of the time, this error occurs due to the failure of the Winlogon.exe process. This usually happens if a faulty third-party Graphical Identification and Authentication (GINA) DLL exists on your system.

GINA is a replaceable DLL component that is used to perform the following tasks:

    • Implement the authentication policy of the interactive logon model.
    • Perform user interactions, such as authentication and identification.

At times, a remote control software may replace the default GINA DLL file, msgina.dll, on your computer and you may face the stop error. This is the reason why it is a good idea to first check if you have a third-party msgina.dll on your computer. To do this, run the regedit command to open the Registry Editor tool. Here, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Here, check if the value GinaDLL REG_SZ is on the right pane. If the value is there and its value is different from msgina.dll then it means that third-party software has changed this value. In case this value is not there, it implies that your system uses msgina.dll as the default DLL file for GINA.

If this error follows a new driver, service or third-party software installation, you must try to uninstall this new software to repair the error. To do this, you may use a good third-party program uninstaller tool, such as Perfect Uninstaller to ensure complete removal. You may also try to install an update for the software if it is available.

You may also try to boot the system with Last known good configuration information to see if the error goes. If nothing works, you may have to perform an in-place upgrade of your operating system to resolve the error.

Additional Recommendations

Driver Update: Many errors are related to driver problems such as obsolete, outdated or incompatible drivers. A driver update tool is recommended to scan your system for corrupted and outdated drivers and to ensure that all your drivers stay up-to-date.

Section 3: Repair Filesystem

  1. If the above solution did not resolve the issue, perform the following:
  2. On the protected system, run: 'chkdsk /r <driveLetter>' and complete the disk check.
  3. Once the check is complete, run 'sfc /scannow'.
  4. When that has completed, force a differential merge of the agent.
  5. When completed, force a screenshot test of the newly created backup.
  6. If the issue persists, destroy the live dataset of the agent and force a new full backup.
  7. When completed, force a screenshot test of the newly created backup.

Was this article helpful?

0 out of 0 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage