PC Randomly crashes with c000021a code

Question

At work we have some PCs that run on Windows XP SP2 (They are segmented away from the internet) and they have been having some issues which strike me as strange, there is 6 PCs that went down, all within 10 mins of each other. All these PCs present the same issue which is the BSOD with error code c000021a. Now the first step we thought was a rollback, on 3 PCs this was accomplished, the other 3 for some reason had System restore and checkpoints disabled so no luck there for the other 3. Another strange issue is if we log in as Administrator some of them do not crash at all, while if we log in as the default user they can crash randomly, we have recreated this user and still the problem persists. On these PCs is a program called WinCC (For manufacturing) which we suspect maybe causing the crash, but one thing that counteracts this is we have seen safe mode crashes with same error also. I have googled the error code which seems to be a core windows file that has been damaged, but on these PCs we cannot even use recovery CD as the OS does not seem to detect them, this has also been done via sic /scannow which just presented the error "Please insert original XP SP2 disc and click retry" Which we have and still get the error.

We have also imaged one of the PCs (Known to be working) and installed it to a new HDD and a PC which is known for crashing (They are the exact same specs) and still we get the same error code even though the image is taken from a stable and working PC. We have also ran chkdsk /r /f /x for a full scan and while it said it repaired the filesystem it still continued to crash.

I just find this issue weird as all of them went down with the exact same error close to each other, but there has been no updates to the systems.

Suggestions?

Thanks

Answer 1

This error occurs when a user-mode subsystem, such as WinLogon or the Client Server Run-Time Subsystem (CSRSS), has been fatally compromised and system security can no longer be guaranteed. In Short: Someone/Something is killing your LSA. This is less likely to happen, if the executing user has the priviledge of doing so (eg. doing thins right).

What can cause this error?

• Mismatched system files (SFC /SCANNOW)
• Mismatched LSA (cloned machines without sysprep)
• Virii
• Copy protection software
• faulty drivers/services <-- this
• Malfunctioning USB-Sticks (especially with CD-Rom part)
• Specially crafted network packets when your system is not patched (aka BLASTER worm)

Because bug check 0xC000021A occurs in a user-mode process, the most common culprits are third-party applications/services. It's possible that a Windows-Update caused an incompatibility to one of your modules.

The only way (known to me) to get the exact Applicatin name, is a remote kernel debugger.

What will most likely not cause this error?

• Harddisk/Filesystem
• Hardware (just setup another different HW to test this)
• cpu/memory problems
• Windows user account

I hope that helps. If it was me to fix this, I would examine running services, check for copy protection, patch the machine and look for the latest WinCC updates.