Recover from a 0xc000021a Winlogon or CSRSS fatal system-process failure

Windows stops during startup with 0xc000021a, meaning a critical user-mode system process terminated. The processes most strongly associated with this status are Windows Logon (winlogon.exe) and Client Server Runtime (csrss.exe). Common triggers include a failed update, mismatched system files, a recently installed driver or security product, or a damaged system state.

Searchable Windows error codes and exact messages

Search 0xc000021a together with the most recent update KB, named driver, named process, or dump module. The stop code proves that a critical process ended; it does not prove whether the cause was servicing, a driver, a third-party security component, storage, or corrupted Windows files.

Use this procedure when Windows 10 or Windows 11 displays 0xc000021a during startup and the installation and Windows volume are readable from recovery.

Do not use it for an ordinary Explorer-only black screen after sign-in, for CRITICAL_PROCESS_DIED (0xEF), or when the storage device is absent or unstable. These conditions require different decision paths.

The exact Windows build may remain unknown for System Restore, removal of the latest update through WinRE, and initial offline SFC. It becomes required if DISM needs a matching repair source or if a specific package must be removed manually.

• Windows Recovery Environment or Windows 10/11 installation media
• Command Prompt
• Readable Windows volume
• A restore point, update rollback option, or matching repair source for the applicable branch

Open Repair your computer > Troubleshoot > Advanced options. Begin with reversible graphical recovery options before editing the offline installation.

1. Record the complete stop screen and whether the failure began immediately after:

   • a quality update or feature upgrade;
   • a driver installation or rollback;
   • antivirus, endpoint-security, credential, or logon software installation;
   • System Restore or image restoration;
   • file replacement or disk errors.

2. Select Startup Settings > Restart > Safe Mode.

3. If Safe Mode starts, record recent update and driver history before changing anything. The working Safe Mode branch makes a third-party driver, filter, service, or startup component more likely.

4. If Safe Mode also fails with 0xc000021a, return to Advanced options > Command Prompt.

5. Detect the Windows volume:

   diskpart
   list volume
   select volume <Windows-volume-number>
   detail volume
   assign letter=W
   exit
   

6. Confirm the installation and critical process files:

   dir W:\Windows\System32\winlogon.exe
   dir W:\Windows\System32\csrss.exe
   dir W:\Windows\System32\Config\SYSTEM
   

7. If the files or volume cannot be read reliably, stop and investigate storage before attempting system-file repair.

8. If the onset followed Windows servicing, list package states:

   dism /image:W:\ /get-packages /format:table
   

9. Record any package shown as Install Pending, Uninstall Pending, or otherwise unresolved. Do not infer a pending update merely from the stop code.

Proceed in order and stop after the first branch that restores stable startup.

Branch A — Restore the pre-failure system state

1. From Advanced options, select System Restore.
2. Choose the affected Windows installation.
3. Select Show more restore points if available.
4. Select a restore point created before the update, driver, or security-software change.
5. Review the affected programs, complete the restore, and restart.
6. If Windows starts, record what the restore removed before reinstalling anything.

Branch B — Remove the latest Windows update

1. Return to Advanced options > Uninstall Updates.
2. If the failure began after a normal monthly update, choose Uninstall latest quality update.
3. If it began during a Windows version upgrade, choose Uninstall latest feature update when that option is available.
4. Complete the rollback and restart.
5. Do not manually remove a package by name unless the exact package and installed build have been verified.

Branch C — Remove a demonstrated third-party cause from Safe Mode

1. If Safe Mode works, open Settings > Apps > Installed apps and Device Manager.
2. Record the exact version of the software or driver installed immediately before the first crash.
3. Uninstall or roll back only the evidenced third-party security, credential, filter, or device component.
4. Restart normally.
5. If the system starts, do not reinstall the same version until compatibility with the Windows build is confirmed.

Branch D — Repair protected Windows files offline

1. From WinRE Command Prompt, run:

   sfc /scannow /offbootdir=W:\ /offwindir=W:\Windows
   

2. Record the final SFC result.

3. If SFC reports successful repairs, restart and test.

4. If SFC cannot repair files, stop before using an arbitrary source. Use matching Windows installation media and the source-repair process in FIX-018.

Branch E — Revert demonstrably pending servicing actions

Use this branch only when the failure immediately followed servicing and DISM /Get-Packages showed unresolved pending actions.

1. Preserve the servicing logs:

   md W:\BootRepairBackup
   copy W:\Windows\Logs\CBS\CBS.log W:\BootRepairBackup\CBS-before-revert.log
   copy W:\Windows\Logs\DISM\dism.log W:\BootRepairBackup\DISM-before-revert.log
   

2. Revert pending offline actions:

   dism /image:W:\ /cleanup-image /revertpendingactions
   

3. Record the DISM result and restart.

4. After Windows starts, inspect Update History before another update attempt.

• System Restore or update removal restores startup: The failure was tied to the reverted state, but the exact component may still require log review.
• Safe Mode works and removing one recent third-party component fixes normal startup: Record its product, version, driver files, and replacement plan.
• Offline SFC repairs files and Windows starts: System-file mismatch or corruption was involved.
• Pending-action reversion works: Preserve the CBS and DISM logs; do not immediately repeat the failed update without checking its error.
• 0xc000021a persists after these branches: Dump analysis or a matching-source repair is required. Do not continue with unrelated bootrec commands.
• The stop changes to 0xEF, 0x5A, or a named checksum failure: Follow the new, more specific condition.

• Do not delete winlogon.exe, csrss.exe, registry hives, or pending servicing files.
• Do not replace system files from another computer.
• Do not run /RevertPendingActions without evidence of a failed pending servicing operation.
• Do not disable all services or boot-start drivers offline.
• Do not rebuild BCD solely because 0xc000021a appears.
• Do not use Reset this PC before preserving data, logs, and recovery options.

System Restore has its own undo option when Windows becomes accessible. An uninstalled update can be reoffered after the system is stable, but record the KB and cause first. Reinstall a removed third-party component only with a known-compatible version. Pending-action reversion has no simple one-command undo; retain the servicing logs and install the corrected update later through normal Windows Update.

• Windows completes three normal starts without 0xc000021a.
• Sign-in completes and Winlogon remains stable.
• Update History or installed-app history records the reverted component.
• sfc /scannow completes without unresolved integrity violations after Windows starts.
• Event Viewer does not record another 0xc000021a bug check.

Confidence is approximately 85% when the failure immediately follows a known update, driver, or system-state change and reversing that change restores startup. Confidence is lower when only the stop code is known. Stop when the volume is unstable, no reversible cause can be isolated, SFC requires unmatched source files, or the same failure occurs even from known-good recovery media.