Server Unexpectedly rebooted BugCheck Code: 0xc000021a

Vikrant 21 Reputation points
2022-03-27T19:34:02.75+00:00

Hello,

Need your assistance to resolve the server unexpected restart issue with BugCheck: 0xc000021a.

Please check below-mentioned memory dump details:

Debugging Details:

Page 1828de not present in the dump file. Type ".hh dbgerr004" for details

ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_PARAMETER1: ffffc001c8a52190

EXCEPTION_PARAMETER2: 0000000000000000

EXCEPTION_PARAMETER3: 0000000000000000

EXCEPTION_PARAMETER4: 0

ADDITIONAL_DEBUG_TEXT: Windows must now restart because the DCOM Server Process Launcher service terminated unexpectedly

BUGCHECK_STR: 0xc000021a_DCOM_Terminated

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: services.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80011994895 to fffff8001175d3c0

STACK_TEXT:
ffffd00162ea66b8 fffff80011994895 : 000000000000004c 00000000c000021a ffffd001634bc3f8 ffffe001f8722710 : nt!KeBugCheckEx
ffffd00162ea66c0 fffff8001198c194 : 0000000000000000 ffffd00162ea67d9 0000000000000000 0000000000000002 : nt!PopGracefulShutdown+0x2c9
ffffd00162ea6700 fffff8001176d2e3 : ffffe001f85a5040 fffff80011744f00 00000000c0000004 fffff800116a5000 : nt! ?? ::OKHAJAOM::string'+0x1d64 ffffd00162ea6840 fffff800117613a0 : fffff80011b90091 0000000000000001 ffffd00162ea6a58 00000000c0000004 : nt!KiSystemServiceCopyEnd+0x13 ffffd00162ea69d8 fffff80011b90091 : 0000000000000001 ffffd00162ea6a58 00000000c0000004 ffffd00163c42180 : nt!KiServiceLinkage ffffd00162ea69e0 fffff80011ad66af : 0000000000000000 0000000000000000 ffffd00163c42180 ffffe001f85a5180 : nt! ?? ::NNGAKEGL::string'+0x608e1
ffffd00162ea6aa0 fffff800116d72da : fffff800116d7220 0000000000000000 0000000000000002 0000000000000000 : nt!PopPolicyWorkerAction+0x63
ffffd00162ea6b10 fffff800116770ff : fffff80000000002 ffffe001f85a5040 fffff800118c8140 fffff800118c1d20 : nt!PopPolicyWorkerThread+0xba
ffffd00162ea6b50 fffff800116ef73a : 0000000000000000 ffffd00160566180 0000000000000080 ffffe001f3ba18c0 : nt!ExpWorkerThread+0x69f
ffffd00162ea6c00 fffff80011764e66 : ffffd00160566180 ffffe001f85a5040 ffffd00160576580 0000000000000000 : nt!PspSystemThreadStartup+0x18a
ffffd00162ea6c60 0000000000000000 : ffffd00162ea7000 ffffd00162ea1000 0000000000000000 0000000000000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::OKHAJAOM::string'+1d64 fffff8001198c194 cc int 3

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt! ?? ::OKHAJAOM::`string'+1d64

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 62156609

IMAGE_VERSION: 6.3.9600.20302

BUCKET_ID_FUNC_OFFSET: 1d64

FAILURE_BUCKET_ID: 0xc000021a_DCOM_Terminated_nt!??::OKHAJAOM::string

BUCKET_ID: 0xc000021a_DCOM_Terminated_nt!??::OKHAJAOM::string

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc000021a_dcom_terminated_nt!??::okhajaom::string

FAILURE_ID_HASH: {9ba00585-f32d-a134-4c58-327c0d8bed3f}

Followup: MachineOwner


9: kd> db ffffc001c8a52190
ffffc001c8a52190 57 69 6e 64 6f 77 73 20-6d 75 73 74 20 6e 6f 77 Windows must now ffffc001c8a521a0 20 72 65 73 74 61 72 74-20 62 65 63 61 75 73 65 restart because
ffffc001c8a521b0 20 74 68 65 20 44 43 4f-4d 20 53 65 72 76 65 72 the DCOM Server ffffc001c8a521c0 20 50 72 6f 63 65 73 73-20 4c 61 75 6e 63 68 65 Process Launche
ffffc001c8a521d0 72 20 73 65 72 76 69 63-65 20 74 65 72 6d 69 6e r service termin ffffc001c8a521e0 61 74 65 64 20 75 6e 65-78 70 65 63 74 65 64 6c ated unexpectedl
ffffc001c8a521f0 79 00 00 00 00 00 00 00-12 00 00 00 00 00 00 00 y............... ffffc001c8a52200 08 01 0b 00 41 6c 53 65-5c fe e3 54 b6 0b 69 b3 ....AlSe..T..i.

9: kd> da ffffc001c8a52190
ffffc001c8a52190 "Windows must now restart because" ffffc001c8a521b0 " the DCOM Server Process Launche"
ffffc001c8a521d0 "r service terminated unexpectedl" ffffc001c8a521f0 "y"

Windows for business | Windows Server | User experience | Other
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Docs 15,761 Reputation points
    2022-03-27T20:18:57.19+00:00

    Please run the DM log collector and post a share link into this thread using one drive, drop box, or google drive.

    If the server is able to run the V2 log collector it will collect more useful files for troubleshooting.

    https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

    https://www.elevenforum.com/t/bsod-posting-instructions.103/

    Indicate if any of these occurred recently:

    a) files restored from a backup image
    b) installation or reinstallation of software
    c) updated driver(s)

    Open administrative command prompt and type or copy and paste:

    sfc /scannow
    dism /online /cleanup-image /restorehealth
    chkdsk /scan

    Post images or share links of the commands with results into this thread.

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is:

    Propose as answer = answered the question

    On the left side of each post there is /\ with a number: click = a helpful post
    .
    .
    .
    .
    .


  2. Docs 15,761 Reputation points
    2022-03-28T01:29:30.67+00:00

    Bugcheck 21A is typically caused by the user.

    Backup images, installing software, drivers, etc.

    It is likely a one time event.

    If there are new BSOD then run one of the log collectors and post a share link into this thread for troubleshooting.

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is:

    Propose as answer = answered the question

    On the left side of each post there is /\ with a number: click = a helpful post
    .
    .
    .
    .
    .

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.