Hi Rander,
Before the update is installed, verify the system files and make sure to have recovery media and a .iso for verifying the system files.
Diagnostics Test
System File Check
Please try following:
- Open an admin command prompt
- Copy/paste "sfc/scannow" (without quotes) and press enter
- When it finished reboot your system
- Open again an admin command prompt
- Enter sfc/scannow again
If sfc/scannow does NOT say "Windows Resource Protection did not find any integrity violation" after the second SFC, please upload the cbs.log file located at {windows partition}\Windows\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.
After updating the crash will likely occur again, insert the recovery media and .iso (best is both in 1 device)
Boot to the command prompt in the advanced troubleshooting options and use DISM to restore the health
Code:
DISM /Online /Cleanup-Image /RestoreHealth
If there are problems with RestoreHealth, please follow step 6 or 7 (depending on the file you have from the download) from the tutorial DISM - Repair Windows 10 Image - Tutorial
When DISM is finished succesful, run SFC again, reboot to the recovery media again and run SFC again.
What is the result of the 2nd SFC scan from recovery media?
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck C000021A, {ffffc00136c666e0, ffffffffc0000428, ffffc00139911580, 0}
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Processing initial command '!analyze -v; !thread; !sysinfo machineid; !sysinfo cpuspeed; .bugcheck; .time;'
Probably caused by : ntkrnlmp.exe ( nt! ?? ::OKHAJAOM::`string'+7b1 )
Followup: MachineOwner
5: kd> da ffffc00139911580
ffffc001`39911580 "SHELL32.dll" // corrupted system file, verified below in the deeper analysis
Deeper analysis
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffffc00136c666e0, String that identifies the problem.
Arg2: ffffffffc0000428, Error Code.
Arg3: ffffc00139911580
Arg4: 0000000000000000
Debugging Details:
------------------
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
Page 1000 not present in the dump file. Type ".hh dbgerr004" for details
ERROR_CODE: (NTSTATUS) 0xc000021a - {Onherstelbare systeemfout} Het systeemproces %hs is onverwacht afgebroken met de status: 0x%08x (0x%08x 0x%08x). Het systeem is afgesloten.
EXCEPTION_CODE: (NTSTATUS) 0xc000021a - {Onherstelbare systeemfout} Het systeemproces %hs is onverwacht afgebroken met de status: 0x%08x (0x%08x 0x%08x). Het systeem is afgesloten.
EXCEPTION_PARAMETER1: ffffc00136c666e0
EXCEPTION_PARAMETER2: ffffffffc0000428
EXCEPTION_PARAMETER3: ffffc00139911580
EXCEPTION_PARAMETER4: 0
ADDITIONAL_DEBUG_TEXT: Verification of a KnownDLL failed.
BUGCHECK_STR: 0xc000021a_c0000428_SHELL32.dll_HASH_INVALID
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: smss.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff8027fdc1050 to fffff8027fb54770
STACK_TEXT:
ffffd001`65bea6c8 fffff802`7fdc1050 : 00000000`0000004c 00000000`c000021a ffffd001`61f663f8 ffffe000`0eb4cd10 : nt!KeBugCheckEx
ffffd001`65bea6d0 fffff802`7fdb9aa1 : ffffffff`80000714 00000000`00000002 ffffd001`65bea810 00000000`00000002 : nt!PopGracefulShutdown+0x250
ffffd001`65bea710 fffff802`7fb5efa3 : 00000000`00000004 00000000`00000004 00000000`c0000004 ffffd001`65bea900 : nt! ?? ::OKHAJAOM::`string'+0x7b1
ffffd001`65bea890 fffff802`7fb57660 : fffff802`7ffbb7d0 00000000`00000014 ffffd001`65beaa98 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13
ffffd001`65beaa28 fffff802`7ffbb7d0 : 00000000`00000014 ffffd001`65beaa98 00000000`c0000004 00000000`00000000 : nt!KiServiceLinkage
ffffd001`65beaa30 fffff802`7fefd137 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff802`7fda5340 : nt! ?? ::NNGAKEGL::`string'+0x52f80
ffffd001`65beaae0 fffff802`7fb00a56 : 00000000`00000001 fffff802`7fb009d4 00000000`00000002 fffff801`380c6320 : nt!PopPolicyWorkerAction+0x63
ffffd001`65beab50 fffff802`7fa7cb79 : ffffe000`0cba2340 fffff802`7fcecca0 fffff801`00000000 ffffe000`00170000 : nt!PopPolicyWorkerThread+0x82
ffffd001`65beab80 fffff802`7fa1b125 : 00000000`00000000 00000000`00000080 ffffe000`0c694700 ffffe000`0cba2340 : nt!ExpWorkerThread+0xe9
ffffd001`65beac10 fffff802`7fb59916 : ffffd001`60f88180 ffffe000`0cba2340 fffff802`7fa1b0e4 00000000`00000000 : nt!PspSystemThreadStartup+0x41
ffffd001`65beac60 00000000`00000000 : ffffd001`65beb000 ffffd001`65be5000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::OKHAJAOM::`string'+7b1
fffff802`7fdb9aa1 cc int 3
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt! ?? ::OKHAJAOM::`string'+7b1
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 568b1c58
BUCKET_ID_FUNC_OFFSET: 7b1
FAILURE_BUCKET_ID: 0xc000021a_c0000428_SHELL32.dll_HASH_INVALID_nt!_??_::OKHAJAOM::_string_
BUCKET_ID: 0xc000021a_c0000428_SHELL32.dll_HASH_INVALID_nt!_??_::OKHAJAOM::_string_
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc000021a_c0000428_shell32.dll_hash_invalid_nt!_??_::okhajaom::_string_
FAILURE_ID_HASH: {4bc49811-b103-1265-b610-97f56fcb1fd3}
Followup: MachineOwner