question

Vikrant-6824 avatar image
0 Votes"
Vikrant-6824 asked Docs-4663 edited

Server Unexpectedly rebooted BugCheck Code: 0xc000021a

Hello,

Need your assistance to resolve the server unexpected restart issue with BugCheck: 0xc000021a.

Please check below-mentioned memory dump details:

Debugging Details:


Page 1828de not present in the dump file. Type ".hh dbgerr004" for details

ERROR_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {Fatal System Error} The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

EXCEPTION_PARAMETER1: ffffc001c8a52190

EXCEPTION_PARAMETER2: 0000000000000000

EXCEPTION_PARAMETER3: 0000000000000000

EXCEPTION_PARAMETER4: 0

ADDITIONAL_DEBUG_TEXT: Windows must now restart because the DCOM Server Process Launcher service terminated unexpectedly

BUGCHECK_STR: 0xc000021a_DCOM_Terminated

DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT

PROCESS_NAME: services.exe

CURRENT_IRQL: 0

ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre

LAST_CONTROL_TRANSFER: from fffff80011994895 to fffff8001175d3c0

STACK_TEXT:
ffffd001`62ea66b8 fffff800`11994895 : 00000000`0000004c 00000000`c000021a ffffd001`634bc3f8 ffffe001`f8722710 : nt!KeBugCheckEx
ffffd001`62ea66c0 fffff800`1198c194 : 00000000`00000000 ffffd001`62ea67d9 00000000`00000000 00000000`00000002 : nt!PopGracefulShutdown+0x2c9
ffffd001`62ea6700 fffff800`1176d2e3 : ffffe001`f85a5040 fffff800`11744f00 00000000`c0000004 fffff800`116a5000 : nt! ?? ::OKHAJAOM::`string'+0x1d64
ffffd001`62ea6840 fffff800`117613a0 : fffff800`11b90091 00000000`00000001 ffffd001`62ea6a58 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13
ffffd001`62ea69d8 fffff800`11b90091 : 00000000`00000001 ffffd001`62ea6a58 00000000`c0000004 ffffd001`63c42180 : nt!KiServiceLinkage
ffffd001`62ea69e0 fffff800`11ad66af : 00000000`00000000 00000000`00000000 ffffd001`63c42180 ffffe001`f85a5180 : nt! ?? ::NNGAKEGL::`string'+0x608e1
ffffd001`62ea6aa0 fffff800`116d72da : fffff800`116d7220 00000000`00000000 00000000`00000002 00000000`00000000 : nt!PopPolicyWorkerAction+0x63
ffffd001`62ea6b10 fffff800`116770ff : fffff800`00000002 ffffe001`f85a5040 fffff800`118c8140 fffff800`118c1d20 : nt!PopPolicyWorkerThread+0xba
ffffd001`62ea6b50 fffff800`116ef73a : 00000000`00000000 ffffd001`60566180 00000000`00000080 ffffe001`f3ba18c0 : nt!ExpWorkerThread+0x69f
ffffd001`62ea6c00 fffff800`11764e66 : ffffd001`60566180 ffffe001`f85a5040 ffffd001`60576580 00000000`00000000 : nt!PspSystemThreadStartup+0x18a
ffffd001`62ea6c60 00000000`00000000 : ffffd001`62ea7000 ffffd001`62ea1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb

FOLLOWUP_IP:
nt! ?? ::OKHAJAOM::`string'+1d64
fffff800`1198c194 cc int 3

SYMBOL_STACK_INDEX: 2

SYMBOL_NAME: nt! ?? ::OKHAJAOM::`string'+1d64

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 62156609

IMAGE_VERSION: 6.3.9600.20302

BUCKET_ID_FUNC_OFFSET: 1d64

FAILURE_BUCKET_ID: 0xc000021a_DCOM_Terminated_nt!??::OKHAJAOM::string

BUCKET_ID: 0xc000021a_DCOM_Terminated_nt!??::OKHAJAOM::string

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:0xc000021a_dcom_terminated_nt!??::okhajaom::string

FAILURE_ID_HASH: {9ba00585-f32d-a134-4c58-327c0d8bed3f}

Followup: MachineOwner



9: kd> db ffffc001c8a52190
ffffc001`c8a52190 57 69 6e 64 6f 77 73 20-6d 75 73 74 20 6e 6f 77 Windows must now
ffffc001`c8a521a0 20 72 65 73 74 61 72 74-20 62 65 63 61 75 73 65 restart because
ffffc001`c8a521b0 20 74 68 65 20 44 43 4f-4d 20 53 65 72 76 65 72 the DCOM Server
ffffc001`c8a521c0 20 50 72 6f 63 65 73 73-20 4c 61 75 6e 63 68 65 Process Launche
ffffc001`c8a521d0 72 20 73 65 72 76 69 63-65 20 74 65 72 6d 69 6e r service termin
ffffc001`c8a521e0 61 74 65 64 20 75 6e 65-78 70 65 63 74 65 64 6c ated unexpectedl
ffffc001`c8a521f0 79 00 00 00 00 00 00 00-12 00 00 00 00 00 00 00 y...............
ffffc001`c8a52200 08 01 0b 00 41 6c 53 65-5c fe e3 54 b6 0b 69 b3 ....AlSe..T..i.

9: kd> da ffffc001c8a52190
ffffc001`c8a52190 "Windows must now restart because"
ffffc001`c8a521b0 " the DCOM Server Process Launche"
ffffc001`c8a521d0 "r service terminated unexpectedl"
ffffc001`c8a521f0 "y"


windows-server-2012
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Docs-4663 avatar image
0 Votes"
Docs-4663 answered Vikrant-6824 commented

Please run the DM log collector and post a share link into this thread using one drive, drop box, or google drive.

If the server is able to run the V2 log collector it will collect more useful files for troubleshooting.

https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

https://www.elevenforum.com/t/bsod-posting-instructions.103/


Indicate if any of these occurred recently:

a) files restored from a backup image
b) installation or reinstallation of software
c) updated driver(s)


Open administrative command prompt and type or copy and paste:

sfc /scannow
dism /online /cleanup-image /restorehealth
chkdsk /scan


Post images or share links of the commands with results into this thread.


.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post there is /\ with a number: click = a helpful post
.
.
.
.
.

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

As a part of troubleshooting I have reconfigure the shadow copies backup settings on this server.
After that the server not getting unexpected restart.

The generated bugcheck is related with shadow copy settings or configurations?

0 Votes 0 ·
Docs-4663 avatar image
0 Votes"
Docs-4663 answered Docs-4663 edited

Bugcheck 21A is typically caused by the user.

Backup images, installing software, drivers, etc.

It is likely a one time event.

If there are new BSOD then run one of the log collectors and post a share link into this thread for troubleshooting.


.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post there is /\ with a number: click = a helpful post
.
.
.
.
.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.