KB5034768 causes BSOD on Windows Server 2019 Standard

Question

I have an issue with KB5034768.

Error Code: 0xc000021a (BSOD)

Server: Hyper-V VM

OS: Windows Server 2019 Standard Version 1809 (OS Build 17763.5329)

Hard Disk: 1.5TB / 700GB Free

Memory: 64GB

Processor: 12-Virtual

Server Software: Microsoft SQL Server 2014 (64-bit)

Error Code: 0xc000021a

Description: During a Windows update process, our server encountered a Blue Screen of Death (BSOD) displaying the error code 0xc000021a immediately after rebooting. The server initiated a data collection process and then automatically restarted. This issue persisted through the second reboot, leading to the same error code, followed by another data collection and an automatic redirection to a troubleshooting panel on the third reboot. Unfortunately, all provided troubleshooting measures failed to resolve the issue. The only successful resolution was to restore the Virtual Machine (VM) from a backup. Prior to attempting the update again, we manually shut down SQL services, considering SQL as the sole non-OS application installed on this server. Despite this precaution, the update resulted in the same BSOD and error code, necessitating another restoration from backup. To circumvent this issue, we are now selectively applying Windows security updates via PowerShell, specifically excluding update KB5034768.

We manage several Server 2019 virtual machines (VMs) on the same Hyper-V host, all of which were created on the same day a few years back using the identical ISO file. Among these, only one VM is experiencing this issue, while the rest are fully updated. The sole distinction with the problematic VM is that it is running SQL.

Answer 1

By the way, in case this is helpful for anyone coming across this thread, in my case there was an error on the blue screen:

Stop code: DRIVER UNLOADED WITHOUT CANCELLING PENDING OPERATIONS

What failed: edrdrv.sys

After some investigation this was identified as part of the Xcitium (Comodo) EDR client. I was able to:

Boot the server 2019 system into safe mode.

Enable Windows Installer in safe mode by running these commands in an elevated command prompt (I really only needed the first):

 REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer” /VE /T REG\_SZ /F /D “Service”

 REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer” /VE /T REG\_SZ /F /D “Service”

Uninstall the Xcitium EDR client.

Reboot normally

Problem was solved for now - need to contact Xcitium for solution.

Answer 2

Hello,

Thank you for posting in Microsoft Community forum.

Based on the description, I understand your question is related to update caused BSOD.

The error code 0xc000021a indicates that there is a problem with the Windows operating system. As a workaround, you can uninstall KB5034768 for now from Settings/ Windows update.

Also, you can wait for Microsoft to release a fix for this issue. I recommend keeping an eye on the Microsoft Support website for any updates or patches related to this issue.

February 13, 2024—KB5034768 (OS Build 17763.5458) - Microsoft Support

Have a nice day. 

Best Regards,

Molly

Answer 3

Hi Molly,

Can you explain how to uninstall the update when the system won't boot?

Thanks,

Ralph

Answer 4

Hello,

Try below steps to uninstall update when no boot:

1. restart the computer, press and hold the F8 key as your computer restarts, The machine will show advanced boot options
2. Choose Repair your computer option then Troubleshooting the Command Prompt.
3. From command prompt, locate the Windows folder on one of the drives. You can select each disk and run dir command until you locate the Windows folder.
4. Run the following command to revert pending actions where D: in this command will be whatever drive your Windows folder is on. DISM /Image:D:\ /Cleanup-Image /RevertPendingActions

You can attempt to boot normally after this is completed. If you still cannot boot, we can go a step further and try to manually remove individual update packages. Run the following commands.

DISM /image:D:\ /Get-Packages

Locate the packages that were recently installed that could be causing the no boot issue. Then remove them with the following command. 

DISM /image:D:\ /Remove-Package /PackageName:PackageName

Replace "PackageName" with the name of the package in the list. Once package removed attempt to boot normal to see if the problem is resolved. You can repeat this to remove each recently installed package until you locate the one causing the no boot issue. 

Hope this answer helps！

Best regards,

Molly

Answer 5

Thank you for that information - it was helpful.