Error Message:



This Stop message occurs when a user-mode subsystem, such as Winlogon or the Client Server Runtime Subsystem (CSRSS), is seriously compromised and security can no longer be guaranteed. The operating system switches into kernel-mode and generates this error. Because Windows 2000 cannot run without Winlogon or CSRSS, this is one of the few situations where the failure of a user-mode service can shut down the system. Running the kernel debugger is not useful in this situation because the actual error occurred in a user-mode process. Because this Stop message occurs in a user-mode process, the most common culprits are third-party applications. Other common causes of this message are the installation of a new or updated device driver, or system service. Mismatched system files can also cause this error. Running a full system restore from tape might generate this error because some restore programs might skip restoring system files they determine are in use.

User Action:

If the error occurred after the installation of a new or updated device driver, system service or third-party application, remove or disable the new software. Contact the manufacturer of the software about a possible update. If the error occurs during system startup, restart your computer, and then press F8 at the character-mode menu that displays the operating system choices. At the resulting Windows 2000 Advanced Options menu, choose the Last Known Good Configuration option. This option is most effective when only one driver or service is added at a time. If this does not resolve the error, manually remove the offending software. If the system partition is formatted with FAT, use an MS-DOS startup disk to gain access to the computers hard disk. If the system partition is formatted with NTFS, you might be able to use Safe Mode to rename or delete the faulty software. If the faulty software is used as part of the system startup process in Safe Mode, start the computer using the Recovery Console in order to access the file. If a newly installed piece if hardware is suspected, remove it to see if this resolves the issue. Run the Emergency Recovery Disk (ERD) and allow the system to repair any errors that it detects. If running a full system restore from tape generated this error , check if an updated version of the Backup/Restore program is available from the manufacturer. For more troubleshooting information about this Stop message, refer to the Microsoft Knowledge Base at