APPLIES TO

Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
Microsoft Windows Server 2003, Datacenter x64 Edition
Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
Microsoft Windows Server 2003, Enterprise x64 Edition
Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
Microsoft Windows Server 2003, Standard x64 Edition
Microsoft Windows Server 2003, Standard Edition (32-bit x86)
Microsoft Windows Server 2003, Web Edition x64 Edition
Microsoft Windows Server 2003, Web Edition (32-bit x86)

The third-party products that this blog discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
Third parties are responsible for testing their software together with Microsoft software.

Symptoms:

STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0xc0000080 (0x00000000 0x0000000)
The system has been shutdown.
Note:  The parameter values could be different.

Note:  This article only talks about winlogon.exe crashes of Stop C21A.  I will be writing one for CSRSS.exe in the near future.

You will not get a kernel only memory dump nor a complete memory dump.
Even if you go thru 972110 How to generate a kernel dump file or a complete memory dump file in Windows Server 2003
http://support.microsoft.com/?id=972110

Dr. Watson and or Windows Error Reporting (W.E.R.) will not catch a user mode dump.

Cause:
There are many different reasons but the top one is due to third-party GINA’s loading in Winlogon.exe

Resolution:

Troubleshooting:

Step 1)  Read thru:
156669 How to troubleshoot a "STOP 0xC000021A" error
http://support.microsoft.com/?id=156669

Step 2)  Check to see if there is a 3rd party GINA loading in the Winlogon process.

Click on Start, Run, Regedit.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

GinaDLL
Note:  By default, GinaDLL is not there.

Additionally, you could do a search for *gina*.dll
Start, Run, CMD.exe
C:
CD\
dir /s *gina*.dll
Note:  The default gina is msgina.dll

So what do you do if you find a 3rd party GINA?
Look for an update.

What are some of the common 3rd party GINA's?
Citrix
Novell

Step 3)  If you run a MPSReport

823393 Microsoft Product Support Reporting Tool - PFE edition (which I personally prefer)
http://download.microsoft.com/download/f/0/4/f047169c-6357-47f3-835c-2665d6426e66/mpsrpt_pfe.exe
or
Microsoft Product Support Reports
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0

From the MPSreports, open up Process.TXT and search for:
USERENV.DLL
and
Msgina.dll
and
winlogon.exe

For example:
Module[ 15] [C:\WINDOWS\SYSTEM32\USERENV.DLL]
  Company Name:      Microsoft Corporation
  File Description:  Userenv
  Product Version:   (5.2:3790.3959)
  File Version:      (5.2:3790.3959)
  File Size (bytes): 1071104
  File Date:         Mon Jan 28 03:36:14 2008
    Module TimeDateStamp = 0x45d6ccab - Sat Feb 17 03:36:43 2007
    Module Checksum      = 0x00113dc8
    Module SizeOfImage   = 0x0010a000
  Module Pointer to PDB = [userenv.pdb]
    Module PDB Guid = {42F10050-B855-4A1C-9F69-BC64B12D2412}
    Module PDB Age = 0x2

In the winlogon.exe process, look for any non-Microsoft DLL's loading and check to see if there are updates from the vendor.

Step 4)  Make sure that the following hotfix(es) are installed for your Operating System.

A. x64 Windows Server 2003 Service Pack 2:
---------------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
http://support.microsoft.com/?id=N/A

950928 Error message when you restart a computer that is running Windows Server 2003 or an x64-based version of Windows XP Professional: "Stop 0xC000021A"
http://support.microsoft.com/?id=950928
Update(s): Userenv.dll
The latest version is in 958246
http://support.microsoft.com/?id=958246

Optional:
Update(s): winlogon.exe
The latest version is in 971080
http://support.microsoft.com/?id=971080

B. x86 Windows Server 2003 Service Pack 2:
---------------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
http://support.microsoft.com/?id=N/A

Optional:
Update(s): Userenv.dll
The latest version is in 958246
http://support.microsoft.com/?id=958246

Optional:
Update(s): winlogon.exe
The latest version is in 971080
http://support.microsoft.com/?id=971080

C. x86 Windows Server 2003 Service Pack 1:
---------------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in "Service Pack 2" for Windows Server 2003

Optional:
Update(s): Userenv.dll
The latest version is in 958246
http://support.microsoft.com/?id=958246

Optional:
Update(s): winlogon.exe
The latest version is in "Service Pack 2" for Windows Server 2003

D. x86 Windows Server 2003 RTM:
----------------------------
Optional:
Update(s): Msgina.dll
The latest version is in "Service Pack 2" for Windows Server 2003

889088 Your computer does not start and you receive a "Stop 0xC000021a" error message in Windows Server 2003
http://support.microsoft.com/?id=889088
Update(s): Userenv.dll
The latest version is in 913463
http://support.microsoft.com/?id=913463

Optional:
Update(s): winlogon.exe
The latest version is in "Service Pack 2" for Windows Server 2003

E. x86 Windows XP Service Pack 3:
------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
http://support.microsoft.com/?id=N/A

Optional:
Update(s): Userenv.dll
The latest version is in N/A
http://support.microsoft.com/?id=N/A

Optional:
Update(s): winlogon.exe
The latest version is in N/A
http://support.microsoft.com/?id=N/A

F. x64 Windows XP Service Pack 2:
------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in N/A
http://support.microsoft.com/?id=N/A

950928 Error message when you restart a computer that is running Windows Server 2003 or an x64-based version of Windows XP Professional: "Stop 0xC000021A"
http://support.microsoft.com/?id=950928
Update(s): Userenv.dll
The latest version is in 953663
http://support.microsoft.com/?id=953663

Optional:
Update(s): winlogon.exe
The latest version is in N/A
http://support.microsoft.com/?id=N/A

G. x86 Windows XP Service Pack 2:
------------------------------
893376 Stack corruption occurs if you remove and insert a smart card during a user log on process in Windows XP Service Pack 1 or Windows XP Service Pack 2
http://support.microsoft.com/?id=893376
Update(s): Msgina.dll
The latest version is in 948277
http://support.microsoft.com/?id=948277

922410 Error message when you restart a computer that is running Windows XP Professional: "Stop 0xC000021A"
http://support.microsoft.com/?id=922410
Update(s): Userenv.dll
The latest version is in 930597
http://support.microsoft.com/?id=930597

Optional:
Update(s): winlogon.exe
The latest version is in 969557
http://support.microsoft.com/?id=969557

H. x64 Windows XP Service Pack 1:
------------------------------
Optional:
Update(s): Msgina.dll
The latest version is in "Service Pack 3" for Windows XP

Optional:
Update(s): Userenv.dll
The last version is in 953663
http://support.microsoft.com/?id=953663
The latest version is in "Service Pack 3" for Windows XP

Optional:
Update(s): winlogon.exe
The last version is in 842308
http://support.microsoft.com/?id=842308
The latest version is in "Service Pack 3" for Windows XP

I. x86 Windows XP RTM:
------------------------------
893376 Stack corruption occurs if you remove and insert a smart card during a user log on process in Windows XP Service Pack 1 or Windows XP Service Pack 2
http://support.microsoft.com/?id=893376
Update(s): Msgina.dll
The last version is in 905865
http://support.microsoft.com/?id=905865
The latest version is in "Service Pack 3" for Windows XP

Optional:
Update(s): Userenv.dll
The last version is in 903895
http://support.microsoft.com/?id=903895
The latest version is in "Service Pack 3" for Windows XP

Optional:
Update(s): winlogon.exe
The last version is in
http://support.microsoft.com/?id=912354
The latest version is in "Service Pack 3" for Windows XP

Step 5) 
A.  Disable WER
Click on Start, right click on My Computer, Properties, Advanced tab
Error Reporting, check the box for "Disable error reporting"
Leave the check box for "But notify me when critical errors occur".
Click on OK twice.
Note:  When you are done troubleshooting, re-enable it.

B.  Below are the steps to collect a memory dump before the process crashes again. Please let me know if you have any questions.

1. Download and install "Debugging Tools for Windows" to C:\DEBUGGERS folder by selecting "Custom" during the install, if not already installed. "Debugging Tools for Windows" is available from:

For 32 Bit systems: http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

For 64 Bit systems: http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx

By default it installs to "c:\Program Files\Debugging Tools for Windows"

2. Click Start, Run, CMD to open a command prompt then type the following:

CD\debuggers

CScript adplus.vbs -crash -p PID -o c:\adplus

Note:  Where PID is the number shown in Task Manager (TaskMgr.exe) "Processes" tab for winlogon.exe. It’s usually PID in the 300 range, for example: 306 or 308.

WARNING:  The winlogon.exe that we need to capture is for Session 0.  The other winlogon.exe's will not cause a Stop c21A.

Note:  Do not capture 1st chance exceptions, it could fill up your hard drive.

3. Close the popup Warning dialog indicating that the symbols are missing, if displayed.

Please do not close the minimized "\cdb.exe" window.

You can lock the system, but do not log off while ADPlus is monitoring the process. If you need to log off, we will need to use a different tool called userdump.exe. The userdump.exe download includes an extensive help file. Userdump.exe is available from http://www.microsoft.com/downloads and I will be happy to assist you with it if needed.

4. When the crash occurs, please zip the c:\adplus folder and send it to us for analysis.

Keyword: Bugcheck 0xc000021a , Bugcheck c000021a, Bugcheck c21a