BSOD 0xC000021A (WINLOGON_FATAL_ERROR): causes and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Winlogon or CSRSS terminated fatally and Windows could not continue.

Could be also:
Constant	Type	OS
STATUS_SYSTEM_PROCESS_TERMINATED	NTSTATUS	Windows

Previous	Next
HARDWARE_PROFILE_UNKNOWN_STRING	MANUALLY_INITIATED_CRASH1

WINLOGON_FATAL_ERROR

Winlogon fatal error for WINLOGON_FATAL_ERROR

WINLOGON_FATAL_ERROR is bug check code 0xC000021A. Microsoft documents this as one of the few cases where a user-mode subsystem failure can shut down Windows, because Winlogon and CSRSS are required for the operating system to run securely.

How to read it in a dump

The real failure is often in user mode, so a kernel debugger alone may not identify the initiating application or service.
Mismatched or restored system files, third-party services, credential components, or subsystem compromise can be involved.
The dump and event logs should identify whether Winlogon, CSRSS, or a dependent component terminated first.

What to check

Check recent service, driver, security, credential-provider, and system-file changes.
Collect user-mode dumps or event logs for Winlogon/CSRSS-related failures when available.
Verify system file consistency and restore provenance before reinstalling or replacing random binaries.

References

Dump evidence

Preserve the complete dump, the four bug-check parameters, the exact Windows build, loaded-module list, and the event timeline immediately before the stop. AllStat summarizes the condition as “This means that that the Winlogon process terminated unexpectedly.”; that sentence identifies the failure class, while the parameters and stack determine which object, driver, processor, or subsystem instance was involved.

Analysis order

Run WinDbg !analyze -v, then inspect the documented meaning of each parameter instead of relying only on the probably-caused-by line.
find the earliest abnormal event: driver update, firmware change, device reset, storage error, verifier report, resource exhaustion, or application hang connected with winlogon / fatal.
keep third-party filter, security, storage, graphics, and virtualization drivers in the module inventory; removing evidence before dump analysis can obscure the responsible path.

Do not repeatedly reboot a machine affected by this result before collecting the dump and event logs. Recovery actions should follow the component identified by the stack and parameters, not merely the symbolic stop-code name.

Looking for a different code? Search another status or error code.