Windows · Windows Server  ·  critical  ·  Bugchecks & startup

0xC000021A — STATUS_SYSTEM_PROCESS_TERMINATED

A user-mode process that Windows cannot run without — winlogon or csrss — exited, so the kernel stops the machine deliberately.

What you see

Boot reaches the spinning dots and then bluescreens with 0xC000021A. Safe Mode usually fails the same way. Very common straight after a failed update or a badly-timed power loss.

What is actually wrong

A corrupt or mismatched system file, a third-party credential provider or security product hooking winlogon, or a half-applied update that left the servicing stack inconsistent.

Codes and articles

0xC000021AC000021ASTATUS_SYSTEM_PROCESS_TERMINATED0x0000004F

Fixes (3)

Clear the stuck pending update from WinRE
Windows Recovery Environment30 minutesmedium riskreversible

It started after an update. A half-applied transaction is the most common cause of this bugcheck.

  1. Boot to WinRE and open Troubleshoot → Advanced options → Command Prompt.

  2. Find the Windows volume — it is usually D: inside WinRE, not C:.

    Command Prompt
    diskpartlist volumeexit

  3. Look at what is pending.

    Command Prompt
    DISM /Image:D:\ /Get-Packages /Format:Table | findstr /i "Install Pending"

  4. Revert the pending actions.

    Command Prompt
    DISM /Image:D:\ /Cleanup-Image /RevertPendingActions

    This rolls the interrupted transaction back to the last consistent state, which is exactly what the machine failed to do on its own.

  5. Rename the pending operations file so the servicing stack does not retry the same thing on boot.

    Command Prompt
    ren D:\Windows\WinSxS\pending.xml pending.old

  6. Exit and restart. Expect the first boot to be slow.

Confirm it workedWindows reaches the sign-in screen. Check the servicing state once in.
PowerShell
DISM /Online /Cleanup-Image /ScanHealth
If you need to undo itRename pending.old back to pending.xml from WinRE if the revert made things worse.
Disable driver signature enforcement and remove the offending product
WinRE startup settings45 minutesmedium riskreversible

A security product or credential provider was installed recently.

  1. In WinRE choose Troubleshoot → Advanced options → Startup Settings → Restart, then press 7 for Disable driver signature enforcement.

    0xC000021A is frequently a third-party module that winlogon loads. This is often the only way to reach a desktop long enough to remove it.

  2. If that boots, uninstall the security product with the vendor's removal tool.

  3. If it does not, boot to WinRE Command Prompt and check for third-party credential providers.

    Command Prompt
    reg load HKLM\OFF D:\Windows\System32\config\SOFTWAREreg query "HKLM\OFF\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers"

  4. Note any GUID that is not a Microsoft one, then delete that key.

    Command Prompt
    reg delete "HKLM\OFF\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{GUID}" /freg unload HKLM\OFF

  5. Restart.

Confirm it workedWindows boots normally with signature enforcement back on.
If you need to undo itExport the Credential Providers key before deleting anything, and re-import it if the fix was wrong.
Repair the system files offline
Windows Recovery Environment45–60 minuteslow riskreversible

After a power loss, or when nothing else fits.

  1. From WinRE Command Prompt, identify the Windows volume as above.

  2. Check the disk first — a filesystem error will make the repair fail confusingly.

    Command Prompt
    chkdsk D: /f /r

  3. Run the offline system file check. Both paths are required and both are easy to get wrong.

    Command Prompt
    sfc /scannow /offbootdir=D:\ /offwindir=D:\Windows

    offbootdir is the drive holding the boot files, offwindir the one holding \Windows. On most machines in WinRE they are the same letter, but not always.

  4. Repair the component store from a mounted ISO of the same build if SFC reports it could not fix everything.

    Command Prompt
    DISM /Image:D:\ /Cleanup-Image /RestoreHealth /Source:WIM:E:\sources\install.wim:1 /LimitAccess

  5. Restart.

Confirm it workedWindows boots and a subsequent online sfc /scannow reports no violations.
If you need to undo itNone — these repair in place.

Related faults

STOP 0x0000007B — INACCESSIBLE_BOOT_DEVICEWindowsSTOP 0x0000009F — DRIVER_POWER_STATE_FAILUREWindowsSTOP 0x000000EF — CRITICAL_PROCESS_DIEDWindowsSTOP 0x00000139 — KERNEL_SECURITY_CHECK_FAILUREWindowsSTOP 0x0000001E — KMODE_EXCEPTION_NOT_HANDLEDWindowsSTOP 0x00000133 — DPC_WATCHDOG_VIOLATIONWindows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.