Fix Stop 0xC000021A: Winlogon Process Crash on Boot

Winlogon crashes during login or shutdown, often after a Windows Update or driver install. The real fix is restoring critical system files or repairing the Registry hive.

You're logging in or shutting down, and bam—your screen goes blue with "Stop: c000021a {Fatal System Error}". The error message says something about Winlogon not starting or stopping unexpectedly. I've seen this most often after a Windows Update that got interrupted (think power loss during Patch Tuesday) or after installing a graphics driver that didn't play nice with the logon screen. It can also happen if a user profile's Registry hive (NTUSER.DAT) got corrupted.

What Actually Causes This

Winlogon is the process that handles interactive logons—typing your password, loading your desktop, keeping the session alive. The 0xC000021A error means Winlogon either crashed and the system couldn't recover, or an essential subsystem (like CSRSS) that Winlogon depends on failed. In my years on the help desk, 9 times out of 10 it's a corrupted system file in the winlogon.exe directory, a broken Registry key under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, or a bad user profile.

Skip the panic. You don't need to reinstall Windows yet.

Fix It in These Steps

1. Boot into Safe Mode or Recovery Environment

Force restart your PC three times during boot—when you see the spinning dots, hold the power button. The third time, Windows will boot into Automatic Repair. From there: Troubleshoot → Advanced options → Startup Settings → Restart. Then press 4 or F4 for Safe Mode.

If Safe Mode also crashes (it sometimes does with this error), use the same route but choose "Command Prompt" from Advanced options instead.

2. Restore the Winlogon Registry Key (Most Common Fix)

Open Registry Editor (regedit) in Safe Mode or from the Recovery Command Prompt (type regedit and press Enter). Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Look for a value named Shell. It should be explorer.exe. If it's missing or points to something else (like a virus), right-click in the right pane → New → String Value → name it Shell → set data to explorer.exe.

Also check Userinit—it should be C:\Windows\system32\userinit.exe, (with the comma).

Close Registry Editor and restart normally.

3. Run System File Checker (SFC) and DISM

In Safe Mode Command Prompt (run as Administrator), run these commands in order:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

SFC will fix corrupt system files, and DISM repairs the component store those files come from. This catches corrupted winlogon.exe or its dependencies. Let both finish—SFC can take 15 minutes, DISM up to 30 on slower machines.

4. Restore a Bad User Profile (If the Error Happens Only for One User)

If the error appears when a specific user tries to log in, their profile's NTUSER.DAT is likely toast. Boot into Safe Mode as Administrator (the built-in admin account, not yours).

Rename the bad profile folder: Go to C:\Users, find your username folder, right-click → Rename → add .old at the end.

Now open Registry Editor, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Each key under here has a ProfileImagePath value. Find the one pointing to your old user folder (the .old one). Delete that entire key (right-click → Delete).

Restart and log in again—Windows will create a fresh profile. You can copy your old documents from the .old folder manually (just not app settings).

5. Last Resort: System Restore from Recovery

If none of that worked, boot to the Recovery Environment (same three-power-button trick). Go to Troubleshoot → Advanced options → System Restore. Pick a restore point from before the error started—preferably a few days before the first crash.

This rolls back system files and Registry hives without touching your personal files. I've had this save a client's machine when a bad Windows Update nuked their Winlogon registry.

If It Still Fails

Try a clean boot to rule out third-party services (msconfig → Services → hide all Microsoft services → disable all). If that works, enable services one by one to find the culprit.

Still no luck? You're looking at a repair install using the Windows Media Creation Tool—it reinstalls Windows while keeping your apps and files. Boot from a USB, choose "Upgrade" instead of "Custom install". That fixed a particularly stubborn 0xC000021A on a Dell Precision T3600 that had a corrupted CSRSS.SYS.

If you're already at the point of data loss, pull the drive, back up what matters from another PC, then do a clean install. But try the steps above first—they'll work for most people.