Windows Stop error - 0xC000021A Status System Process Terminated
Applies to: ✔️ Windows VMs
This article provides steps to resolve issues in which the operating system (OS) encounters Stop error code 0xC000021A. This error prevents an Azure virtual machine (VM) from restarting.
Symptoms
When you use Boot diagnostics to view a screenshot of the VM, the screenshot displays the following message that states that the OS encountered an error during restart:
Your PC ran into a problem and needs to restart. We're just collecting some error info, and then you can restart. (##% complete) If you'd like to know more, you can search online later for this error: 0xC000021a.
Cause
Error 0xC000021A means STATUS_SYSTEM_PROCESS_TERMINATED.
This error occurs when a critical process, such as Winlogon (winlogon.exe) or the Client Server Run-Time Subsystem (csrss.exe), fails. After the kernel detects that either of those services stopped, it returns the STOP 0xC000021A error code. This error might have several causes, including:
- Mismatched system files were installed.
- A Service Pack or KB update installation failed.
- A backup program that's used to restore a hard disk didn't correctly restore files that might have been in use.
- An incompatible third-party program was installed.
Solution 1: Restore the VM from a backup
If you have a recent backup of the VM, you can try to restore the VM from the backup to fix the restart problem.
Solution 2: Collect the memory dump file
If restoring the backup doesn't solve the problem, collect a memory dump file so that the crash can be analyzed. To collect the dump file, see the following sections.
Part 1: Attach the OS disk to a recovery VM
Take a snapshot of the OS disk of the affected VM to create a backup. For more information, see Create a snapshot of a virtual hard disk.
Use remote desktop protocol (RDP) to connect remotely to the recovery VM.
If the OS disk of the affected VM is encrypted, turn off encryption before you go to the next step. For more information, see Decrypt the encrypted OS disk.
Part 2: Locate the dump file and submit a support ticket
On the recovery VM, go to the Windows folder on the attached OS disk. For example, if the drive letter that's assigned to the attached OS disk is F, go to F:\Windows.
Locate the Memory.dmp file, and then submit a support ticket and attach the dump file.
Note
If you're having trouble locating the Memory.dmp file, you can try to use non-maskable interrupt (NMI) calls in the serial console instead. You can use this guidance to generate a crash dump file by using NMI calls.
Next steps
- For more troubleshooting information, see troubleshooting common boot errors or how to troubleshoot a Windows VM by attaching the OS disk to a recovery VM. You should also familiarize yourself with how to use boot diagnostics to troubleshoot a virtual machine.
- For more information about how to use Resource Manager, see Azure Resource Manager overview.
- If you can't connect to your VM, see Troubleshoot Remote Desktop Protocol (RDP) connections to an Azure VM.
Contact us for help
If you have questions or need help, create a support request, or ask Azure community support. You can also submit product feedback to Azure feedback community.