Microsoft recommends the following steps to troubleshoot this error:
- Stop 0xC000021A messages occur in a user-mode process and the most common causes are third-party applications. If the error occurred after installing a new or updated device driver, system service, or third-party application, you need to remove, disable, or roll back the driver, or uninstall the new software. Contact the software manufacturer about a possible update.
- System file mismatch caused by partially restoring the system from backup media might cause this error (some backup programs do not restore files that they determine are in use). Always use backup software that is Windows XP Professional compatible.
- If SYSTEM account permissions were altered, follow the procedures below to regain access to the boot partition:
1. Perform a parallel Windows XP Professional installation onto a separate partition or drive. Do not use the original drive and folder names because the new Windows XP Professional installation overwrites previous settings. Complete the second installation.
2. In the Run dialog box, in the Open box, type: c:
3. Right-click the original Windows XP Professional system root folder, and then click Properties.
4. Click the Security tab, and then grant the local SECURITY account full control of the system root folder and its subfolders.
5. Restart the system, and then select the original Windows XP Professional installation from the startup menu.
Read the articles referenced by the links below for further information on this error.
This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Runtime Subsystem (CSRSS), has been fatally compromised and security can no longer be guaranteed. In response, the operating system switches to kernel mode. Microsoft Windows cannot run without WinLogon or CSRSS. Therefore, this is one of the few cases where the failure of a user-mode service can shut down the system. Mismatched system files can also cause this error. This can occur if you have restored your hard disk from a backup. Some backup programs might skip restoring system files that they determine are in use. Search Microsoft's site for 0xc000021a as there are a large number of Q article related to this stop code.
Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.
Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.