Recover from a 0xc000021a Winlogon or CSRSS fatal system-process failure

Windows stops during startup with 0xc000021a, meaning a critical user-mode system process terminated. The processes most strongly associated with this status are Windows Logon (winlogon.exe) and Client Server Runtime (csrss.exe). Common triggers include a failed update, mismatched system files, a recently installed driver or security product, or a damaged system state.

Search 0xc000021a together with the most recent update KB, named driver, named process, or dump module. The stop code proves that a critical process ended; it does not prove whether the cause was servicing, a driver, a third-party security component, storage, or corrupted Windows files.

Use this procedure when Windows 10 or Windows 11 displays 0xc000021a during startup and the installation and Windows volume are readable from recovery.

Do not use it for an ordinary Explorer-only black screen after sign-in, for CRITICAL_PROCESS_DIED (0xEF), or when the storage device is absent or unstable. These conditions require different decision paths.

The exact Windows build may remain unknown for System Restore, removal of the latest update through WinRE, and initial offline SFC. It becomes required if DISM needs a matching repair source or if a specific package must be removed manually.

Before you start:

Windows Recovery Environment or Windows 10/11 installation media
Command Prompt
Readable Windows volume
A restore point, update rollback option, or matching repair source for the applicable branch

Open Repair your computer > Troubleshoot > Advanced options. Begin with reversible graphical recovery options before editing the offline installation.

Do not delete winlogon.exe, csrss.exe, registry hives, or pending servicing files.
Do not replace system files from another computer.
Do not run /RevertPendingActions without evidence of a failed pending servicing operation.
Do not disable all services or boot-start drivers offline.
Do not rebuild BCD solely because 0xc000021a appears.
Do not use Reset this PC before preserving data, logs, and recovery options.

Stop when the volume is unstable, no reversible cause can be isolated, SFC requires unmatched source files, or the same failure occurs even from known-good recovery media.

Check the cause

Record the complete stop screen and whether the failure began immediately after:
- a quality update or feature upgrade;
- a driver installation or rollback;
- antivirus, endpoint-security, credential, or logon software installation;
- System Restore or image restoration;
- file replacement or disk errors.
Select Startup Settings > Restart > Safe Mode.
If Safe Mode starts, record recent update and driver history before changing anything. The working Safe Mode branch makes a third-party driver, filter, service, or startup component more likely.
If Safe Mode also fails with 0xc000021a, return to Advanced options > Command Prompt.

Detect the Windows volume:

diskpart
list volume
select volume <Windows-volume-number>
detail volume
assign letter=W
exit

Confirm the installation and critical process files:

dir W:\Windows\System32\winlogon.exe
dir W:\Windows\System32\csrss.exe
dir W:\Windows\System32\Config\SYSTEM

If the files or volume cannot be read reliably, stop and investigate storage before attempting system-file repair.
If the onset followed Windows servicing, list package states:
```
dism /image:W:\ /get-packages /format:table
```
Record any package shown as Install Pending, Uninstall Pending, or otherwise unresolved. Do not infer a pending update merely from the stop code.

Proceed in order and stop after the first branch that restores stable startup.

Branch A — Restore the pre-failure system state

From Advanced options, select System Restore.
Choose the affected Windows installation.
Select Show more restore points if available.
Select a restore point created before the update, driver, or security-software change.
Review the affected programs, complete the restore, and restart.
If Windows starts, record what the restore removed before reinstalling anything.

Branch B — Remove the latest Windows update

Return to Advanced options > Uninstall Updates.
If the failure began after a normal monthly update, choose Uninstall latest quality update.
If it began during a Windows version upgrade, choose Uninstall latest feature update when that option is available.
Complete the rollback and restart.
Do not manually remove a package by name unless the exact package and installed build have been verified.

Branch C — Remove a demonstrated third-party cause from Safe Mode

If Safe Mode works, open Settings > Apps > Installed apps and Device Manager.
Record the exact version of the software or driver installed immediately before the first crash.
Uninstall or roll back only the evidenced third-party security, credential, filter, or device component.
Restart normally.
If the system starts, do not reinstall the same version until compatibility with the Windows build is confirmed.

Branch D — Repair protected Windows files offline

From WinRE Command Prompt, run:

sfc /scannow /offbootdir=W:\ /offwindir=W:\Windows

Record the final SFC result.
If SFC reports successful repairs, restart and test.
If SFC cannot repair files, stop before using an arbitrary source. Use matching Windows installation media and the source-repair process in FIX-066.

Branch E — Revert demonstrably pending servicing actions

Use this branch only when the failure immediately followed servicing and DISM /Get-Packages showed unresolved pending actions.

Preserve the servicing logs:

md W:\BootRepairBackup
copy W:\Windows\Logs\CBS\CBS.log W:\BootRepairBackup\CBS-before-revert.log
copy W:\Windows\Logs\DISM\dism.log W:\BootRepairBackup\DISM-before-revert.log

Revert pending offline actions:

dism /image:W:\ /cleanup-image /revertpendingactions

Record the DISM result and restart.
After Windows starts, inspect Update History before another update attempt.

Check the result

Windows completes three normal starts without 0xc000021a.
Sign-in completes and Winlogon remains stable.
Update History or installed-app history records the reverted component.
sfc /scannow completes without unresolved integrity violations after Windows starts.
Event Viewer does not record another 0xc000021a bug check.
System Restore or update removal restores startup: The failure was tied to the reverted state, but the exact component may still require log review.
Safe Mode works and removing one recent third-party component fixes normal startup: Record its product, version, driver files, and replacement plan.
Offline SFC repairs files and Windows starts: System-file mismatch or corruption was involved.
Pending-action reversion works: Preserve the CBS and DISM logs; do not immediately repeat the failed update without checking its error.
0xc000021a persists after these branches: Dump analysis or a matching-source repair is required. Do not continue with unrelated bootrec commands.
The stop changes to 0xEF, 0x5A, or a named checksum failure: Follow the new, more specific condition.

To undo the change:

System Restore has its own undo option when Windows becomes accessible. An uninstalled update can be reoffered after the system is stable, but record the KB and cause first. Reinstall a removed third-party component only with a known-compatible version. Pending-action reversion has no simple one-command undo; retain the servicing logs and install the corrected update later through normal Windows Update.

Type	Searchable identifier	When it applies
Windows stop/status	`0xc000021a` — `STATUS_SYSTEM_PROCESS_TERMINATED`	Primary identifier. Windows terminated because a critical system process failed.
Screen text	`Your PC ran into a problem and needs to restart` with `0xc000021a`	Current Windows blue-screen presentation.
Legacy screen text	`{Fatal System Error}` with `Windows Logon Process` or `Client Server Runtime Process`	The screen or dump identifies Winlogon or CSRSS.
Event Viewer	`Event ID 1001` — `BugCheck`	Available after recovery or from offline event logs; confirms the bug-check value and dump path.
Event Viewer	`Kernel-Power Event ID 41`	Records an unclean restart after the crash. It does not identify the cause.
Secondary exception	`0xc0000005` — `STATUS_ACCESS_VIOLATION`	Use only when a dump or event records this as the terminating status for the critical process or a related module.
Secondary status	`0xc0000006` — `STATUS_IN_PAGE_ERROR`	Use only when the dump shows the critical process could not page required data from storage. This shifts attention toward the storage path.