[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question
[x]
Attachment Details

BSOD C000021a, Windows Logon Process system process terminated

Asked by Jonesey007 in Debugging Software for Development, Windows XP Operating System, Operating Systems Miscellaneous

Hi, im experiencing a very random bsod whilst the machine is shutting down. The description is as follows ..
***STOP: C000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status
of 0xC0000005 (0x00000000 0x00000000).
It is very random, once in 50 reboots maybe. I have been trying to troubleshoot it for the last couple of days but haven't got anywhere fast. We have modified GINAs and software that manages user profiles and login/logoff. Unfortunately its not the easiest thing to simply roll back to the previous version.
I need to be able to gather some proof about whats causing this bsod. Unfortunately no dumps or events are produced by this crash. The bsod seems to appear a split second before the machine powers down.
I've heard there is a checked version of Winlogon.exe which can dump loads of information into a logfile and log everything Winlogon does. Im sure if i can get hold of this it will help the troubleshooting but i tried calling Microsoft multiple times and cant seem to get it. I have some links that might help explain

http://blogs.msdn.com/ntdebugging/archive/2007/06/09/how-windows-shuts-down.aspx
This link is very useful and explains about Winlogon logging. It mentions
"Winlogon logging is obtained by applying the checked build of Winlogon and setting the following registry values ..."

On another forum someone called Alex stated
"This checked version of winlogon.exe is a hotfix and they will
send it to me.
They said, this checked version of winlogon.exe is not released in a free
download, you have to request it from microsoft."

Everytime i ring Microsoft they say i need to quote a KB number to request a hotfix. The KB number is 232575 but it has been removed from the system for some reason ??
The website below has a cached version of the KB article

http://www.netomatix.com/articles/KBArticle.aspx?a=232575

Please can someone advise me how to get this file or any other ideas that might help me.

Id be very grateful

Thanks
[+][-]10/22/09 06:37 AM, ID: 25633979Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10/22/09 06:38 AM, ID: 25633987Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10/22/09 06:47 AM, ID: 25634100Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091021-EE-VQP-81 - Hierarchy / EE_QW_3_20080625