question

ErnestJankovski-7178 avatar image
0 Votes"
ErnestJankovski-7178 asked ElevenYu-MSFT answered

Windows 10 crash with csrss.exe

Could this be a bug in windows 10?

I have not seen any hardware or driver problem from the following minidump analysis.

link to dump files : https://1drv.ms/u/s!ApvTS2DUZhP_ayJo8NjrnRu1x-A?e=nERCq7



Path validation summary
Response Time (ms) Location
Deferred .sympath cache

Deferred srv*https://msdl.microsoft.com/download/symbols

Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Minidump\CHR011\072421-8671-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


Path validation summary
Response Time (ms) Location
Deferred .sympath cache

Deferred srv*https://msdl.microsoft.com/download/symbols
Symbol search path is: .sympath cache*;srv*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 10 Kernel Version 18362 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff804`20200000 PsLoadedModuleList = 0xfffff804`20645f30
Debug session time: Sat Jul 24 12:04:56.113 2021 (UTC + 3:00)
System Uptime: 0 days 4:04:25.106
Loading Kernel Symbols
...............................................................
................................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
........
For analysis of this file, run !analyze -v
9: kd> !analyze -v



  •                      Bugcheck Analysis                                    *
    



WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffff8c895a58a030, String that identifies the problem.
Arg2: ffffffffc0000006, Error Code.
Arg3: 00007ffd4f84865e
Arg4: 0000008be0ebe140

Debugging Details:



ETW minidump data unavailable

KEY_VALUES_STRING: 1

 Key  : Analysis.CPU.Sec
 Value: 3

 Key  : Analysis.DebugAnalysisProvider.CPP
 Value: Create: 8007007e on LTVIL-JF06NX2

 Key  : Analysis.DebugData
 Value: CreateObject

 Key  : Analysis.DebugModel
 Value: CreateObject

 Key  : Analysis.Elapsed.Sec
 Value: 30

 Key  : Analysis.Memory.CommitPeak.Mb
 Value: 80

 Key  : Analysis.System
 Value: CreateObject


ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x

EXCEPTION_CODE_STR: c000021a

EXCEPTION_PARAMETER1: ffff8c895a58a030

EXCEPTION_PARAMETER2: ffffffffc0000006

EXCEPTION_PARAMETER3: 00007ffd4f84865e

EXCEPTION_PARAMETER4: 8be0ebe140

BUGCHECK_CODE: c000021a

BUGCHECK_P1: ffff8c895a58a030

BUGCHECK_P2: ffffffffc0000006

BUGCHECK_P3: 7ffd4f84865e

BUGCHECK_P4: 8be0ebe140

PROCESS_NAME: csrss.exe

ADDITIONAL_DEBUG_TEXT: Windows SubSystem

IMAGE_NAME: ntkrnlmp.exe

MODULE_NAME: nt

CUSTOMER_CRASH_COUNT: 1

STACK_TEXT:
ffffc486`7c87f198 fffff804`20aa8da9 : 00000000`0000004c 00000000`c000021a ffffc486`7c87f2f8 ffffc888`e24ee390 : nt!KeBugCheckEx
ffffc486`7c87f1a0 fffff804`207aeea2 : ffffc888`dff593b0 ffffc888`e24ee390 ffffc888`e24ee300 00000000`00000100 : nt!PoShutdownBugCheck+0xf9
ffffc486`7c87f240 fffff804`203cd9e8 : 00000000`00000013 ffffc486`7c87f8c8 00000000`00000001 00000000`00000000 : nt!ExpSystemErrorHandler2+0x672
ffffc486`7c87f490 fffff804`20a012c7 : 00000000`c000021a 00000000`00000004 00000000`00000001 ffffc486`7c87f8c8 : nt!ExpSystemErrorHandler+0xd8
ffffc486`7c87f4d0 fffff804`2092d8b8 : 00000000`ffff8001 ffffc888`dda8d050 ffffc888`dda8d050 ffff8c89`443a9e00 : nt!ExpRaiseHardError+0xd3997
ffffc486`7c87f850 fffff804`203d5755 : 00000000`00000e28 ffffc888`d551e400 ffffc486`00000002 ffffc486`7c87f900 : nt!NtRaiseHardError+0x1b8
ffffc486`7c87f990 00007ffd`4f87fab4 : 00007ffd`4c6782e7 00000000`00000000 00000000`00000000 ffffffff`ee1e5d00 : nt!KiSystemServiceCopyEnd+0x25
0000008b`e0ebd8b8 00007ffd`4c6782e7 : 00000000`00000000 00000000`00000000 ffffffff`ee1e5d00 00000000`00000e28 : 0x00007ffd`4f87fab4
0000008b`e0ebd8c0 00000000`00000000 : 00000000`00000000 ffffffff`ee1e5d00 00000000`00000e28 00000000`00000006 : 0x00007ffd`4c6782e7


SYMBOL_NAME: nt!ExpSystemErrorHandler2+672

IMAGE_VERSION: 10.0.18362.1621

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 672

FAILURE_BUCKET_ID: 0xc000021a_c0000006_csrss.exe_Terminated_nt!ExpSystemErrorHandler2

OS_VERSION: 10.0.18362.1

BUILDLAB_STR: 19h1_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {07388538-a1cd-d180-f12c-f4c8013feb53}

Followup: MachineOwner


windows-10-network
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

ElevenYu-MSFT avatar image
0 Votes"
ElevenYu-MSFT answered

Hi,

Please kindly note that dump analysis is currently beyond our Q&A forum scope. If you would like to confirm if the issue is a bug or not. I'd like to suggest that you could contact Microsoft Customer Support and Services to raise a support ticket. Please note that the consulting fee would be refund if it is confirmed as a bug.

Global Customer Service phone numbers:
https://support.microsoft.com/en-us/help/13948/global-customer-service-phone-numbers

Also, I did some research in our case database and found a similar case as yours. The issue in that case is "csrs*s.exe will fail to start leading the OS to a bugcheck 0xEF*".
I am not sure if it is also your problem. But you can try the solution to see if it helps. Please proceed a backup before you make any change.

  1. Boot the machine in repair mode.

  2. Load the SYSTEM HIVE.
    117950-image.png
    118085-image.png
    117998-image.png
    118086-image.png

  3. Check which ControlSet is the current:
    118050-image.png

  4. Change the settings under the correspondent ControlSet, in this particular case as Select shows, 001.
    118087-image.png

To reflect the data value:

Command Line: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

  1. Unload the HIVE - This part is very important!!!!
    118111-image.png
    118074-image.png

  2. Close regedit, exit CMD. Restart the OS.

Appreciate your understanding. And welcome to post any other question or issue to our Q&A forum in future.

Thanks,


If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.



image.png (22.4 KiB)
image.png (32.0 KiB)
image.png (48.4 KiB)
image.png (20.3 KiB)
image.png (42.6 KiB)
image.png (62.3 KiB)
image.png (25.2 KiB)
image.png (25.2 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.