Microsoft is investigating a known issue leading to Blue Screen of Death (BSOD) crashes with 0xc000021a errors after installing the Windows 10 KB5021233 cumulative update released during this month's Patch Tuesday.
The company warned over the weekend that "after installing KB5021233, some Windows devices might start up to an error (0xc000021a) with a blue screen."
This comes after a stream of users reports on Redmond's own community website [1, 2, 3] and Reddit [1, 2, 3], some of them reporting that the update reverted automatically or that they've been able to fix the issue after a system restore.
The known issue is likely caused by a mismatch between the file versions of hidparse.sys in system32 and system32/drivers in the Windows folder, "which might cause signature validation to fail when cleanup occurs."
The list of affected platforms includes only client Windows 10 versions, from Windows 10 20H2 to the latest release, Windows 10 22H2.
Redmond added that it's already working on a fix to address this newly acknowledged issue but hasn't yet shared when it will be available.
Workaround for affected Windows 10 systems
However, the company did share a temporary solution to workaround the blue screen issue and revive the affected systems to start as expected.
This requires users to copy the hidparse.sys file from the system32\drivers folder into system32 via the Windows Recovery Environment (WinRE) so that the signature validation no longer fails during cleanup.
To mitigate this issue on impacted devices, you need to go through the following steps:
- You will need to enter Windows Recovery Environment. If your device has not automatically started up into WinRE, please see Entry points into WinRE.
- Select the Troubleshoot button.
- Select the "Start recovery, troubleshooting, and diagnostic tools" button.
- Select the "Advanced Options" button.
- Select the "Command Prompt" button and wait for your device to restart, if needed.
- Your device should restart to a Command Prompt window. You might need to sign into your device with your password before getting to the Command Prompt window.
- Run the following command (Important: If Windows is not installed to C:\windows you will need to modify the command to your environment): xcopy C:\windows\system32\drivers\hidparse.sys C:\windows\system32\hidparse.sys
- Once the previous command completes, type: exit
- Select the "Continue" button.
- Windows should now start up as expected.
"It is not recommended to follow any other workaround than those recommended above. We do not recommend deleting the hidparse.sys from your Windows\System32 folder," Microsoft added.
Redmond is also investigating a known issue linked to this month's Windows Server Patch Tuesday updates that triggers errors when creating new virtual machines on some Hyper-V hosts.
Comments
rayg75 - 1 year ago
I think you have a typo on step number 7. I know most of the readers here will know the correct thing to type, but someone that found this on a search might not.
serghei - 1 year ago
Thanks, fixed!
JCAdmin - 1 year ago
Hi - if you mean the double backslash - that is from Microsoft's own article on their message centre.
"xcopy C:\windows\system32\drivers\hidparse.sys C:\windows\\system32\hidparse.sys"
The quality of patches is terrible. With issues like this and breaking Kerberos on servers people are just going to stop patching. Microsoft has to do better than this.
Sabredude - 1 year ago
So im a bit of a novice here. Do i type this command in seperate lines? Type it exactly as you have it in your post? I tried this last night and it didnt work but i think its because i may not be typing it right in the command window.
INTREPID-FL - 1 year ago
"So im a bit of a novice here. Do i type this command in seperate lines? Type it exactly as you have it in your post? I tried this last night and it didnt work but i think its because i may not be typing it right in the command window."
STOP. You do not have to do this unless your computer is in an unbootable state with constant blue screens. If you can't boot, then you type the command in ONE line (without the quotes). In addition, the command by Microsoft had a typo - a double \\ by mistake. The correct command is (as posted by Bleeping Computer):
xcopy C:\windows\system32\drivers\hidparse.sys C:\windows\system32\hidparse.sys
Sabredude - 1 year ago
Well, it becomes unbootable after i update this bad patch. Ive been using a restore point to have the computer back. As it looks so far, ill have this happen every 7 days until a fix is out. So if i update this bad patch now, then i can use this fix, right?
0s1r1s - 1 year ago
Hopefully now you have rolled it back you can go into the Windows Update area and Pause for 7 days or maybe 14 to be absolutely safe. Hopefully Microsuck have sorted it out by then. Has anyone lodged a class action against them yet? As always, I'm sure it will be coming.
INTREPID-FL - 1 year ago
This won't be fixed until the second Tuesday in January 2023 at the earliest. Pause updates for the maximum allowed (35 days).
Sabredude - 1 year ago
This fix didnt work for me. Im pretty sure i typed it all correctly, it copied, and went right back to blue screen. Ive made a custom restore point so whenever the comp shuts down for any reason, i can get it back up. What a pain in the ass...ty Microsoft.
Ill just try to hold her together until a fix is implemented.
rabidR04CH - 1 year ago
I guess I should feel blessed that the update refuses to install on my old MSI GT72.
0s1r1s - 1 year ago
That's lucky. I have a customer with this update still trying to install. I haven't managed to get my hands on it yet but resetting the Windows Update cache, Downloads Cache and the app itself had no effect. I'll have to try this fix but it won't be till after xmas now.
David6277 - 1 year ago
We have actually been chasing a 0xc000021a BSOD since Thanksgiving. This seems to be the same issue but unfortunately for the 1 affected laptop I kept around, it did not work. It does seem to think a little after copying the file over but returns back to 0xc000021a.
h_b_s - 1 year ago
"We have actually been chasing a 0xc000021a BSOD since Thanksgiving. This seems to be the same issue but unfortunately for the 1 affected laptop I kept around, it did not work. It does seem to think a little after copying the file over but returns back to 0xc000021a. "
Have you tried forcing a bad block scan? Even SSDs can get bad blocks not properly managed by wear leveling.
Sabredude - 1 year ago
So im having this same issue. My problem is when i restart to go into windows RE then i get the error all over again. Can i still use this workaround to fix this even though im getting the blue screen while trying to do this fix?
0s1r1s - 1 year ago
I have had three Windows 11 computers also have this issue so it's not limited to 10. 21h2 and 22h2.
It looks like I will advise my customers to lodge a complaint against Microsoft for the issue as I ended up needing to rebuild all three of them.
defective1up - 1 year ago
Interesting. Had this happen on a couple of workstations last week, same error. Was able to boot into Safe Mode with Networking, run a system file check, corruption was found and repaired, and on a reboot all was fixed. Maybe try that first before deleting/renaming a system file.
mugen10 - 1 year ago
it is working perfectly, thanks.
ksmey - 1 year ago
Should xcopy treat it as a file or a directory? Or, is it fine to use "copy" instead and avoid the prompt?
cgrafner - 1 year ago
As an IT consultant I have seen this a handful of times lately. Both Windows 10 and 11 computers. Might just be me but on every comuter with this problem I have been able to boot into safe mode and it boots fine. I don't have to do anything from there, I restart normal and everything is fine again.
wclegg3 - 1 year ago
Here is another workaround: On the blue screen under the option of Automatic Repair go to Trouble Shoot, then Advanced Options, Then Startup Settings, then click on the Restart Option. This will take you to a screen with Startup Settings. Enter the #7("Disable Driver Signature Enforcement" )and you will have good bootup. You will have yo do this with every bootup
Sabredude - 1 year ago
Dude...THANK YOU. Youre workaround is a life saver.
Alymsin - 1 year ago
After performing this, run sfc /scannow in an admin command prompt that way the file will get repaired. That way rebooting can be normal instead of needing to do this on every bootup.
0s1r1s - 1 year ago
I had previously tried sfc /scannow now in a computer with this issue and it didn't find any problems so I doubt it will work, even if you bypass Driver Signature Enforcement. But it's the best step to take after any BSOD issue in my opinion.
Sabredude - 1 year ago
Doesnt work. Im still having the issue.
Im using the bypassing DSE to get by but if theres any other updates happening, they are just being undone as a result of a improper bootup. Sooner or later this will affect me greatly.
0s1r1s - 1 year ago
Interesting. I'll have to try this if it happens again. But it seems this has now been patched by Microsoft. We can be assured it will reoccur at some point though.
Sabredude - 1 year ago
If its been patched, then how do i get it to work for me. This rig is still popping up the BSOD. Wheres this patch and can i manually install it.
0s1r1s - 1 year ago
If you go into the Windows Update section of Settings, Click on Update History, scroll the bottom and click on Uninstall Updates, look for KB5021233 and select uninstall.
Sabredude - 1 year ago
Okay, an update.
So after screwing with this for over an hour, i finally did get a scandisk to properly fix my os. It actually booted up normally for the first time in over a month. I then re downloaded the questionable update ( the one we are talking about ) and it seems it has been patched to work. My rig is now back to normal. Goddamn microsuck needs to pay attention to their pos updates. That was wreaking my ocd with keeping all my electronics up to date at all times.
itsjustecue - 1 year ago
Had this issue and was resolved by removing the latest quality update. However, computer would not boot into windows 10 and safe mode's "Windows Update" was broken due to the corrupt update. Needed to remove the "Quality Update" through Windows RE.
https://www.winhelponline.com/blog/uninstall-windows-10-update-offline-windows-recovery/
after removing the corrupt update, was able to boot into Windows 10 and then re-install the update. Hope that helps, seems simpler than other options.