Windows error 0xc000021a: a critical system process stopped

What 0xC000021A means

Microsoft states that error 0xC000021A means STATUS_SYSTEM_PROCESS_TERMINATED, and that it occurs when a critical process — such as Winlogon (winlogon.exe) or the Client Server Run-Time Subsystem (csrss.exe) — fails. After the kernel detects that either of those services has stopped, it returns the stop code.

Those two processes are not optional. Winlogon handles sign-in and the secure desktop; csrss handles the Win32 subsystem. Windows cannot continue with either of them dead, so it stops deliberately rather than running on in an undefined state. The blue screen is the system protecting itself, not the fault itself.

Microsoft lists four causes: mismatched system files were installed, a Service Pack or KB update installation failed, a backup program used to restore a hard disk did not correctly restore files that might have been in use, or an incompatible third-party program was installed. Every one of them is something that happened to the machine recently, which is why the first question is what changed.

Start with what changed

Because all four documented causes are recent events, the fastest route is usually memory rather than diagnostics. A driver installed yesterday, an antivirus or disk tool added last week, an update that reported a failure, a restore from backup — any of those fits, and reversing it is cheaper than any repair.

If the machine still reaches Safe Mode, that is where to do it. Microsoft's kernel-phase guidance is to try Safe Mode or Safe Mode with Networking and then use Event Viewer to identify the cause, reading the System and Application logs around the time the failures began. A machine that boots to Safe Mode has a software problem you can act on, which is much better news than one that does not.

Safe Mode also lets you do the removal itself: uninstall the recent program or roll back the recent driver, restart normally, and see whether the error is gone.

When it followed an update

A failed update is one of Microsoft's named causes, and there is a specific offline procedure for it. From a command prompt in the recovery environment, run DISM /image:C:\ /get-packages to see whether anything is left in a pending state, then uninstall a specific one with DISM /image:C:\ /remove-package /packagename: followed by the package name.

The broader version of the same fix is DISM /Image:C:\ /Cleanup-Image /RevertPendingActions, which undoes actions an interrupted update left half-applied. Microsoft's article also describes finding windows\winsxs\pending.xml and renaming it to pending.xml.old when the machine still will not start.

This is the case where patience pays off. An update that failed during installation frequently leaves exactly this signature, and reverting it puts the machine back rather than requiring anything to be rebuilt.

Repair tools, and the honest limit

If Safe Mode does not start either, boot from installation media for your version of Windows, choose Repair your computer, then Troubleshoot, then Startup Repair. It writes a log to %windir%\System32\LogFiles\Srt\Srttrail.txt describing what it found, which is worth reading if it reports that it could not fix the problem.

Where the stop error suggests system file corruption, Microsoft's offline system file check is SFC /Scannow /OffBootDir=C:\ /OffWinDir=C:\Windows, and where disk corruption is suspected, chkdsk /f /r. Both run from the recovery command prompt and both can take a long time.

It is worth being straight about the limit here. Microsoft's dedicated article for this code is written for Azure virtual machines, and its solutions are restoring the VM from backup or collecting a memory dump for a support ticket — neither of which translates to a laptop. On a physical PC, once the recent-change and update routes are exhausted, the remaining options are a system restore point, a repair install that keeps files and apps, or professional help. That is a shorter list than the internet suggests, and knowing it saves hours.

Sources and review notes

Checked on September 8, 2026. The meaning and the four causes come from Microsoft's article for this stop error, which is written for Azure VMs — its VM-specific solutions are noted rather than repeated. Repair steps come from Microsoft's Windows startup issues article. The framing of what to do first, and the closing assessment of what remains on a physical PC, are editorial. Glitchary is independent of Microsoft.

• Microsoft: Stop error 0xC000021A, status system process terminated
• Microsoft: Windows startup issues troubleshooting