How to Troubleshoot a STOP 0xC000021A

ID: Q156669

The information in this article applies to:
  • Microsoft Windows NT Workstation versions 3.5, 3.51, 4.0
  • Microsoft Windows NT Server versions 3.5, 3.51, 4.0

SYMPTOMS

A Windows NT Server or a Windows NT Workstation may stop with the following message:

STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000034 (0x00000000 0x0000000)
The system has been shutdown.
NOTE: The parameters in parenthesis are specific to your system configuration and may differ each time.


CAUSE

The stop 0xC000021A is caused by a user-mode process that causes the Windows NT operating system operations to come to a halt. Windows NT interprets this STOP as a fatal error and the operating system will not continue. A memory dump from this type of STOP does not contain much useful information without the proper preparation.


RESOLUTION

The solution to the STOP 0xC000021A lies in troubleshooting this STOP from an application standpoint. Basic troubleshooting procedures apply. "Was new hardware installed?" "Was new software installed?" And so forth.

Any applications loaded in user-mode memory space can cause this STOP. This includes the native user-mode processes of Windows NT. Carefully review the loaded software on this system and try to determine if any one of them may be causing a problem. Follow these steps to help in isolating the cause of these types of errors.

First, set up Dr. Watson to trap any user-mode application that may be causing this problem. Dr. Watson for Windows NT is an application error debugger, which is a program that detects application errors, diagnoses the error, and logs the diagnostic information.

To properly set up Dr. Watson to trap user-mode problems, perform the following steps:

  1. Run <SystemRoot>\System32\Drwtsn32.exe-I. This will initialize the Dr. Watson program.


  2. Run <SystemRoot>\System32\Drwtsn32.exe and select dump symbol table and create crash dump.


  3. In Windows NT 3.51, copy the <CD-ROM>\Support\Debug\Symbols from the Windows NT Server CD-ROM to the %SystemRoot% of the failing system. To install symbols in Windows NT 4.0, use the Expndsym.cmd batch file.


  4. When a Dr. Watson log is generated, use the log to determine what user mode process may be causing a problem. The Dr. Watson help file can be used in assisting in decoding the log file. If the Dr. Watson log does not contain enough information to determine the cause of the problem, the User.dmp file can be analyzed to determine the cause of the application fault.


NOTE: If the Windows NT system fails running a third-party application, this problem should be directed to the third-party software vendor.

If a third-party software package was recently installed, and now the system fails on booting with a 0xC000021A, try using the Last Known Good option at start up. After Windows NT has started, remove the faulting application and contact the third-party software vendor.

Set the GlobalFlag to 60000 in the registry. To do this, please see the following Microsoft Knowledge Base article:
ARTICLE-ID: Q147314
TITLE : GlobalFlags for Windows NT 3.51
After setting this global flag, the systems memory dump will contain more information on the faulting user-mode application. Making any kernel mode memory dump more useful.

Additional query words: debugref 21A 0x21a

Keywords : kbnetwork NTSrvWkst
Version : winnt:3.5,3.51,4.0
Platform : winnt
Issue type : kbprb


Last Reviewed: October 30, 1999
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.