Bug Check 0xC000021A: WINLOGON_FATAL_ERROR in Windows Server 2019

Question

question

CESARRAMIROBELTRN-3112 asked Apr 1, '22 CESARRAMIROBELTRN-3112 commented Apr 5, '22

Bug Check 0xC000021A: WINLOGON_FATAL_ERROR in Windows Server 2019

Good morning, my WS 2019 physical server is a Hyper-V Cluster node, has presented a memory dump but the DUMP is not found in the location.

In logs I see the following BugCheck:

The computer has rebooted from a bugcheck. The bugcheck was: 0xc000021a (0xffffe38ec05baa30, 0xffffffffc0000006, 0x00007ffc6c8ea252, 0x0000009a8c39dc00. A dump was saved in: C:\Windows\Minidump\032422-17015-01.dmp. Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0

I don't see errors related to WinLogon,

the Microsoft link, I can't find a possible specific cause. ( https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xc000021a--winlogin-fatal-error )

Recently I have not installed any application, but 6 days ago I applied the Updates for the month of March-2022.

It is possible to determine something.

I appreciate your opinions and help.

windows-server windows-server-2019 windows-server-hyper-v windows-server-clustering

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-04-02T19:39:16.177Z

Docs-4663 answered Apr 2, '22 CESARRAMIROBELTRN-3112 commented Apr 5, '22

It wasn't able to be opened.

If there is another crash then see if you can open Msinfo32 for a while to see if it opens completely.
Then run V2.
The log collector has a timer for V2 so that it completes relatively quickly and sometimes msinfo32 is beyond the time allotment.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CESARRAMIROBELTRN-3112 · Apr 05 at 01:46 PM

Checking the Hardware, from the iLO. Storage driver alarms are seen, I suppose that was the problem, for which the Firmware update is performed.
Thanks

0 ·

Answer 2 · 2022-04-01T06:44:29.71Z

Docs-4663 answered Apr 1, '22 CESARRAMIROBELTRN-3112 commented Apr 1, '22

Run the DM log collector and post a share link into this thread using one drive, drop box, or google drive.

If the server is able to run the V2 log collector it will collect more useful log files for troubleshooting.

https://www.tenforums.com/bsod-crashes-debugging/2198-bsod-posting-instructions.html

https://www.elevenforum.com/t/bsod-posting-instructions.103/

.
.
.
.
.

Please remember to vote and to mark the replies as answers if they help.

On the bottom of each post there is:

Propose as answer = answered the question

On the left side of each post there is /\ with a number: click = a helpful post
.
.
.
.
.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CESARRAMIROBELTRN-3112 · Apr 01 at 11:39 PM

Good evening, Thank you, I have already attached the Link V2 log collector

https://mystg1.blob.core.windows.net/containe-azure/(2022-04-01_18-19-23).zip

Thank you

0 ·

Answer 3 · 2022-04-01T10:53:35.387Z

LimitlessTechnology-2700 answered Apr 1, '22

Hi @CESARRAMIROBELTRN-3112

This error is usually related to a failure to ensure security on the environment, normally related to some 3rd Party driver set, including virtualization, storage or networking drivers. The main recommendation would be to disable the Driver Signed Enforcement using:

bcdedit.exe /set nointegritychecks

Reference: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set#verification-settings

Hope this helps with your query,

--If the reply is helpful, please Upvote and Accept as answer--

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 4 · 2022-04-01T23:38:01.15Z

CESARRAMIROBELTRN-3112 answered Apr 1, '22

Link V2 log collector

https://mystg1.blob.core.windows.net/containe-azure/(2022-04-01_18-19-23).zip

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 5 · 2022-04-02T01:29:50.417Z

Docs-4663 answered Apr 2, '22 CESARRAMIROBELTRN-3112 commented Apr 2, '22

Msinfo32 was missing/corrupt in the collected logs.

Please search for Msinfo32 > save as NFO (not text) > post a share link into this thread

There were no dump files collected for debugging.

This bugcheck is typically related to user causes.

A cause and effect for this bugcheck was not identified in the collected logs.

For new BSOD post V2 results into the newest post.

Event[15739]:
Log Name: Application
Source: Windows Error Reporting
Date: 2022-04-01T18:00:46.082
Event ID: 1001
Task: N/A
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: CXV-SH-MSALUD20.smpdc.gblx
Description:
Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: c000021a
P2: ffffe38ec05baa30
P3: ffffffffc0000006
P4: 7ffc6c8ea252
P5: 9a8c39dc00
P6: 10_0_17763
P7: 0_0
P8: 272_3
P9:
P10:

Attached files:
\\?\C:\Windows\Minidump\032422-17015-01.dmp
\\?\C:\Windows\TEMP\WER-18562-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F25.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F45.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F54.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F64.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c000021a_57593511e6f6d11056303174bb3785733c5e020_00000000_cab_06b86f92

Analysis symbol:
Rechecking for solution: 0
Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0
Report Status: 100
Hashed bucket:
Cab Guid: 0

Event[15688]:
Log Name: Application
Source: Windows Error Reporting
Date: 2022-04-01T17:30:01.010
Event ID: 1001
Task: N/A
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: CXV-SH-MSALUD20.smpdc.gblx
Description:
Fault bucket , type 0
Event Name: BlueScreen
Response: Not available
Cab Id: 0

Problem signature:
P1: c000021a
P2: ffffe38ec05baa30
P3: ffffffffc0000006
P4: 7ffc6c8ea252
P5: 9a8c39dc00
P6: 10_0_17763
P7: 0_0
P8: 272_3
P9:
P10:

Attached files:
\\?\C:\Windows\Minidump\032422-17015-01.dmp
\\?\C:\Windows\TEMP\WER-18562-0.sysdata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F25.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F45.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F54.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F64.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Kernel_c000021a_57593511e6f6d11056303174bb3785733c5e020_00000000_cab_06b86f92

Analysis symbol:
Rechecking for solution: 0
Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0
Report Status: 100
Hashed bucket:
Cab Guid: 0

Event[20713]:
Log Name: System
Source: Microsoft-Windows-WER-SystemErrorReporting
Date: 2022-03-24T21:16:42.280
Event ID: 1001
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: CXV-SH-MSALUD20.smpdc.gblx
Description:
The computer has rebooted from a bugcheck. The bugcheck was: 0xc000021a (0xffffe38ec05baa30, 0xffffffffc0000006, 0x00007ffc6c8ea252, 0x0000009a8c39dc00). A dump was saved in: C:\Windows\Minidump\032422-17015-01.dmp. Report Id: 2e327f5f-3528-43dc-87cd-bca7b0ebeeb0.

Event[24273]:
Log Name: System
Source: Disk
Date: 2022-03-28T16:13:08.463
Event ID: 11
Task: N/A
Level: Error
Opcode: N/A
Keyword: Classic
User: N/A
User Name: N/A
Computer: CXV-SH-MSALUD20.smpdc.gblx
Description:
The driver detected a controller error on \Device\Harddisk30\DR30.

+++ WER9 +++:
Fault bucket , type 0
Event Name: Failover_clustering_resource_error
Response: Not available
Cab Id: 0

Problem signature:
P1: Virtual Machine Configuration
P2: ONLINERESOURCE
P3: 5018
P4: -2147467259
P5: 5225058576
P6:
P7:
P8:
P9:
P10:

Event[15782]:
Log Name: Application
Source: Windows Error Reporting
Date: 2022-04-01T18:19:59.921
Event ID: 1001
Task: N/A
Level: Information
Opcode: Info
Keyword: Classic
User: N/A
User Name: N/A
Computer: CXV-SH-MSALUD20.smpdc.gblx
Description:
Fault bucket , type 0
Event Name: Failover_clustering_resource_error
Response: Not available
Cab Id: 0

Problem signature:
P1: Virtual Machine Configuration
P2: ONLINERESOURCE
P3: 5018
P4: 32
P5: 5225058576
P6:
P7:
P8:
P9:
P10:

Attached files:
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_31.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_32.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_34.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_35.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_37.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_38.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_39.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_40.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_41.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_42.evtx
\\?\C:\Windows\Cluster\Reports\CLUSWER_RHS_ERROR_75929938-972f-4c89-8eba-b1906ac3bf47_43.evtx
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D1F.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D3F.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D4E.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER8D6E.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_Virtual Machine _b4975a3a1827b285eaa02f3f8774a44a1793eae5_00000000_cab_c5328d7d

Analysis symbol:
Rechecking for solution: 0
Report Id: 1e26bf68-ab4e-424d-ad98-fc2c8cf94483
Report Status: 100
Hashed bucket:
Cab Guid: 0

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CESARRAMIROBELTRN-3112 · Apr 02 at 04:44 PM

hello, thanks for your help, I just collected again and uploaded the msinfo32

https://mystg1.blob.core.windows.net/containe-azure/msinfo32.zip

0 ·

question