SBS BSOD c000021A

A

azler

Member
Joined
Sep 4, 2014
Posts
12
I have been directed to this forum from another in the hope for a resolution to my rather annoying issue.

My SBS 2008 server has failed and causing me a whole lot of pain in the process.
There was a fairly comprehensive backup plan in place, Acronis image (Daily), Windows image (Daily) and Bexec.
The last DA test we did worked fine and I was able to restore the acronis to a VM and boot.
Now we have actually had an error none of the backups work! All with the same error code on physical hardware and within a VM.
The error is:
FileDownloadHandler.ashx

Steps taken:
Restore to VM
Load SBS media to do system repair (System repair not present. Started CMd & startrep.exe) Could not resolve the issue.
Load SBS media to do system repair, sfc scan & chckdsk (some things it could not repair)
Made some reg tweaks so it didn't restart when it BSOD (Still cant get it to make a memory dump though.)

One restart the same error.
Tried all the F8 options, All with the same error. Even safe mode!
It will not output a boot log either to see which drivers it last loaded in the windows root.

This folder is empty:
C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\
& This one does not exsist:
C:\Windows\System32\
I copied these files from a PE environment to the C drive to at least try and get it to boot which made no difference so I reverted it back.

I have had to re-install the server from scratch to get it up and running but some settings I need fromthe VM which I didnt backup else where such as program configurations.

It is running as a Hyperv vm on a windows 8.1 laptop.
I have has other errors such as driver issues which I have managed to bypass and resolve, But I cant seem to make headway with this error or even understand what it is pointing to the problem being.

Hope someone can assist.
I can product / provide logs where needed.
Last driver I see loaded is ACPI.sys when booting into safe mode.

Rob
 
Could you follow these instructions?

https://www.sysnative.com/forums/bs...ctions-windows-8-1-8-7-and-windows-vista.html

0xc000021a is similar to the Windows 7 0xF4 in that a critical process has terminated for some reason, a Kernel dump file is the most use for these.

Go the Start
Right click My Computer
Select Properties
Click Advanced system settings
Click on the Advanced tab
Select Settings under Startup and Recovery
Then under Write debugging information select Kernel memory dump.

Once a dump is created go to:

Code: 
C:/Windows/memory.dmp

Copy the file to the desktop, zip it up and upload it to a file sharing site like Onedrive. After the upload is done post the download link in your next reply.
 
Thanks for the quick reply.
I am unable to boot to the OS at all and cant run most of the things from the instructions. Including the ones you posted.
Is there anyway to do those from a PE environment or on an off-line computer?
Is there a way to make the changes you suggested via the registry?

Rob
 
So even safe mode won't load properly?
I take it the computer you're running off works fine?
If it does then it sounds like serious OS corruption, if it won't boot into safe mode then there isn't much we can do.
 
That is correct.
The SBS server failed on a scheduled restart I am lead to believe (I was on holiday.) and when they restored it they were getting BSOD.
They decided to re-build to get the users connected again and connect the file shares etc.

I when I returned and managed get hold of the backup I wanted to boot from it to pull some of the software configuration that had been setup on it.

I restored the acronis image to a disk and converted that to a VHDX file then imported it into hyper-v running on my windows 8.1 laptop. (The laptop works fine.)

The VM will not boot at all even in safe mode I always get that error message.

I can produce a log for SFC scan if they would help? Can I point synative jcgriff2 towards an off-line image? / I can do that with Autoruns.

There must be something I can do / Run to resolve the OS corruption? Should startrep.exe not resolve that..

Rob
 
Without access to the machine itself in the VM we can't get the dump files.
Run SFC /scannow and post the results, I can't read the logs itself so I will have to PM someone to help you with that.
Is it the same 0xc000021a each time?
 
I can mount the VHDX to the computer and browse the files on the drive to retrieve dump files. The only issue is it does not seem to make any.
It is the same error message every time. The last driver to be loaded is ACPI.sys then it BSOD.

I am running SFC a few times to give some comparison logs.
Is there anything else I can run / upload to help?
 
AFAIK there isn't much else, is the bsod error code the same each time?
 
As I mentioned earlier the BSOD is not producing any dump files or at least I cant find them. Boot logging is also not making the file it should in the Windir.
Is there anyway I can enable these in the registry or will they be anywhere else other than C:\windows\mindump ?

The Sfc said it found violations and fixed them which it has been doing before. But it never did anything. This time it seems to have resolved them and when I scan it again it says no violations found now. So that log will be fairly useless. Still BSOD's though.

Just running a 'chkdsk /r /r /scan /perf' on it now to see if I have any luck with that this time.

If you can think of any tweaks I can make in the registry to produce any more clues?

I noticed the components part of the registry was mentioned in the SFC scan. What does that part contain? Any OS information or just hardware? Could I swap it out with a generic SBS2008 one? I installed as a separate VM?
 
You can change the dump file creation via registry.

In the registry editor (type regedit.exe in the start menu)
Navigate to:

Code: 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

Set the value to 2 for a Kernel dump file.
 
I set CrashDumpEnabled to 2 and it didnt produce a log to the minidump folder.
Tried boot logging again and it didnt product a ntbtlog.txt in the windir either.

Any other scans I can run on it to try and resolve the corruption?
 
2 sets it to a Kernel memory dump with is located in

Code: 
C:/Windows/MEMORY.dmp

It's a large file so it needs to be uploaded to a file sharing site like Onedrive, then you paste the download link.

If we can find the source of the problem we might be able to resolve it.
 
There is no such file in that location.
C:/Windows/MEMORY.dmp
I does not appear to be making any dump files just going straight to the BSOD without any indication is it saving the dump file which I would expect to see.
 
azler said:
I noticed the components part of the registry was mentioned in the SFC scan. What does that part contain? Any OS information or just hardware? Could I swap it out with a generic SBS2008 one? I installed as a separate VM?
Click to expand...
Do not do that!

Sorry for the perhaps harsh sounding message, but you must never replace the COMPONENTS hive with one from another machine, even if it is a very similar machine.

The COMPONENTS hive is a little known hive that deals with Windows Update related information. It doesn't do much, if anything, else. A corrupt COMPONENTS hive will not cause BSODs on a system, and will only cause Windows Update related failures. Because of the intricate nature of Windows Update and the fact every computer will have a different configuration of updates and settings on, replacing the hive with another one is a sure fire way to break things!

Zip up and send us the C:\Windows\Logs\CBS file if you wish me to take a look at it and see what the SFC scan did.

Stephen
 
Thanks for the reply.. I figured as much as am just desperate to try anything now.
I ran the sfc scan the other week and it did have some errors, I ran through several more times and it seemed to resolve them all so I dont think the CBS log will be much use any more.
The logs are here: Here
They are names in order they were run.

Is there anyway to get the startup repair option on the sbs media? Im a little confused why it is no there..

Rob
 
I did start rep by loading the media, CD recovery > startrep.exe
It could not resolve the issues and here is the additional info:
5q55XUMJa v8HmQwnkNPCYAAAAABJRU5ErkJggg==
A6EXcpNsPtjpAAAAAElFTkSuQmCC

Does it many any sense to anyone?!
Rob
 
Hello Rob,

Did you move the CBS log from OneDrive, I can not see it there. If it is there please check the permissions :).

The image that you tried to show in the previous post is not displaying, can you please attach it to the post?

Edit:: I can see the CBS logs (Must be the slow connection I have). Did you edit these logs at all? if you did can you please provide the original ones.
 
Do you now have the CBS logs?
I have not edited them. When you tun sfc /scannow on an off-line environment it does not push logs to the off-line OS folders. So I set it to push to my local C drive an they were the output.

1.PNG2.PNG

These are the screen dumps.

Rob
 
Does anyone have any updates on this? Im still no further along.
Does anyone know of any recovery software I can try which might give me more luck?

Rob
 

Has Sysnative Forums helped you? Please consider donating to help us support the site!

Back
Top