Share via

Bug Check 0xC000021A: WINLOGON_FATAL_ERROR in Windows Server 2019

pregs22 41 Reputation points
2022-04-01T02:10:41.023+00:00

Good morning, my WS 2019 physical server is a Hyper-V Cluster node, has presented a memory dump but the DUMP is not found in the location.

In logs I see the following BugCheck:

The computer has rebooted from a bugcheck. The bugcheck was: 0xc000021a (0xffffe38ec05baa30, 0xffffffffc0000006, 0x00007ffc6c8ea252, 0x0000009a8c39dc00. A dump was saved in: C:\Windows\Minidump\032422-17015-01.dmp. Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0

I don't see errors related to WinLogon,

the Microsoft link, I can't find a possible specific cause. ( https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xc000021a--winlogin-fatal-error )

Recently I have not installed any application, but 6 days ago I applied the Updates for the month of March-2022.

It is possible to determine something.

I appreciate your opinions and help.

Windows Server 2019
Windows Server 2019
A Microsoft server operating system that supports enterprise-level management updated to data storage.
3,744 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,049 questions
Hyper-V
Hyper-V
A Windows technology providing a hypervisor-based virtualization solution enabling customers to consolidate workloads onto a single server.
2,706 questions
Windows Server Clustering
Windows Server Clustering
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Clustering: The grouping of multiple servers in a way that allows them to appear to be a single unit to client computers on a network. Clustering is a means of increasing network capacity, providing live backup in case one of the servers fails, and improving data security.
995 questions
Accepted answer
  1. Docs 15,516 Reputation points
    2022-04-02T19:39:16.177+00:00

    It wasn't able to be opened.

    If there is another crash then see if you can open Msinfo32 for a while to see if it opens completely.
    Then run V2.
    The log collector has a timer for V2 so that it completes relatively quickly and sometimes msinfo32 is beyond the time allotment.

4 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Docs 15,516 Reputation points
    2022-04-01T06:44:29.71+00:00

    Run the DM log collector and post a share link into this thread using one drive, drop box, or google drive.

    If the server is able to run the V2 log collector it will collect more useful log files for troubleshooting.

    https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

    https://www.elevenforum.com/t/bsod-posting-instructions.103/

    .
    .
    .
    .
    .

    Please remember to vote and to mark the replies as answers if they help.

    On the bottom of each post there is:

    Propose as answer = answered the question

    On the left side of each post there is /\ with a number: click = a helpful post
    .
    .
    .
    .
    .

  2. Limitless Technology 39,611 Reputation points
    2022-04-01T10:53:35.387+00:00

    Hi @pregs22

    This error is usually related to a failure to ensure security on the environment, normally related to some 3rd Party driver set, including virtualization, storage or networking drivers. The main recommendation would be to disable the Driver Signed Enforcement using:

    bcdedit.exe /set nointegritychecks

    Reference: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set#verification-settings

    Hope this helps with your query,

    --
    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments
  3. pregs22 41 Reputation points
    2022-04-01T23:38:01.15+00:00
    0 comments
  4. Docs 15,516 Reputation points
    2022-04-02T01:29:50.417+00:00

    Msinfo32 was missing/corrupt in the collected logs.

    Please search for Msinfo32 > save as NFO (not text) > post a share link into this thread

    There were no dump files collected for debugging.

    This bugcheck is typically related to user causes.

    A cause and effect for this bugcheck was not identified in the collected logs.

    For new BSOD post V2 results into the newest post.

    Event[15739]:
    Log Name: Application
    Source: Windows Error Reporting
    Date: 2022-04-01T18:00:46.082
    Event ID: 1001
    Task: N/A
    Level: Information
    Opcode: Info
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: CXV-SH-MSALUD20.smpdc.gblx
    Description:
    Fault bucket , type 0
    Event Name: BlueScreen
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: c000021a
    P2: ffffe38ec05baa30
    P3: ffffffffc0000006
    P4: 7ffc6c8ea252
    P5: 9a8c39dc00
    P6: 10_0_17763
    P7: 0_0
    P8: 272_3
    P9:
    P10:

    Attached files:
    \?\C:\Windows\Minidump\032422-17015-01.dmp
    \?\C:\Windows\TEMP\WER-18562-0.sysdata.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F25.tmp.WERInternalMetadata.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F45.tmp.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F54.tmp.csv
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F64.tmp.txt

    These files may be available here:
    \?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c000021a_57593511e6f6d11056303174bb3785733c5e020_00000000_cab_06b86f92

    Analysis symbol:
    Rechecking for solution: 0
    Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0
    Report Status: 100
    Hashed bucket:
    Cab Guid: 0

    Event[15688]:
    Log Name: Application
    Source: Windows Error Reporting
    Date: 2022-04-01T17:30:01.010
    Event ID: 1001
    Task: N/A
    Level: Information
    Opcode: Info
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: CXV-SH-MSALUD20.smpdc.gblx
    Description:
    Fault bucket , type 0
    Event Name: BlueScreen
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: c000021a
    P2: ffffe38ec05baa30
    P3: ffffffffc0000006
    P4: 7ffc6c8ea252
    P5: 9a8c39dc00
    P6: 10_0_17763
    P7: 0_0
    P8: 272_3
    P9:
    P10:

    Attached files:
    \?\C:\Windows\Minidump\032422-17015-01.dmp
    \?\C:\Windows\TEMP\WER-18562-0.sysdata.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F25.tmp.WERInternalMetadata.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F45.tmp.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F54.tmp.csv
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F64.tmp.txt

    These files may be available here:
    \?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c000021a_57593511e6f6d11056303174bb3785733c5e020_00000000_cab_06b86f92

    Analysis symbol:
    Rechecking for solution: 0
    Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0
    Report Status: 100
    Hashed bucket:
    Cab Guid: 0

    Event[20713]:
    Log Name: System
    Source: Microsoft-Windows-WER-SystemErrorReporting
    Date: 2022-03-24T21:16:42.280
    Event ID: 1001
    Task: N/A
    Level: Error
    Opcode: N/A
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: CXV-SH-MSALUD20.smpdc.gblx
    Description:
    The computer has rebooted from a bugcheck. The bugcheck was: 0xc000021a (0xffffe38ec05baa30, 0xffffffffc0000006, 0x00007ffc6c8ea252, 0x0000009a8c39dc00). A dump was saved in: C:\Windows\Minidump\032422-17015-01.dmp. Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0.

    Event[24273]:
    Log Name: System
    Source: Disk
    Date: 2022-03-28T16:13:08.463
    Event ID: 11
    Task: N/A
    Level: Error
    Opcode: N/A
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: CXV-SH-MSALUD20.smpdc.gblx
    Description:
    The driver detected a controller error on \Device\Harddisk30\DR30.

    +++ WER9 +++:
    Fault bucket , type 0
    Event Name: Failover_clustering_resource_error
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: Virtual Machine Configuration
    P2: ONLINERESOURCE
    P3: 5018
    P4: -2147467259
    P5: 5225058576
    P6:
    P7:
    P8:
    P9:
    P10:

    Event[15782]:
    Log Name: Application
    Source: Windows Error Reporting
    Date: 2022-04-01T18:19:59.921
    Event ID: 1001
    Task: N/A
    Level: Information
    Opcode: Info
    Keyword: Classic
    User: N/A
    User Name: N/A
    Computer: CXV-SH-MSALUD20.smpdc.gblx
    Description:
    Fault bucket , type 0
    Event Name: Failover_clustering_resource_error
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: Virtual Machine Configuration
    P2: ONLINERESOURCE
    P3: 5018
    P4: 32
    P5: 5225058576
    P6:
    P7:
    P8:
    P9:
    P10:

    Attached files:
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_31.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_32.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_34.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_35.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_37.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_38.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_39.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_40.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_41.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_42.evtx
    \?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_43.evtx
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D1F.tmp.WERInternalMetadata.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D3F.tmp.xml
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D4E.tmp.csv
    \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D6E.tmp.txt

    These files may be available here:
    \?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_Virtual Machine _b4975a3a1827b285eaa02f3f8774a44a1793eae5_00000000_cab_c5328d7d

    Analysis symbol:
    Rechecking for solution: 0
    Report Id: 1e26bf68-ab4e-424d-ad98-fc2c8cf94483
    Report Status: 100
    Hashed bucket:
    Cab Guid: 0

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.