NgcCtnrSvc crashes 3 times in ucrtbase.dll (0xc0000005), then Windows 11 25H2 lock screen has no credential UI

Question

NgcCtnrSvc crashes 3 times in ucrtbase.dll (0xc0000005), then Windows 11 25H2 lock screen has no credential UI

牧之王 0

Summary

On Windows 11 Pro 25H2, the Microsoft Passport Container service (NgcCtnrSvc) repeatedly crashes inside ucrtbase.dll with exception 0xc0000005. After the third crash, Service Control Manager stops restarting it. A later lock/unlock attempt can then show only the blurred lock-screen background, with no password/PIN input or other credential UI.

This occurred twice across August 11–12, 2026. Ctrl+Alt+Del and Win+Ctrl+Shift+B did not restore the credential UI; a full reboot was required.

I am reporting the component crash rather than asking for generic lock-screen troubleshooting.

Environment

Windows 11 Pro, version 25H2
Current OS build: 26200.9168 after installing KB5121003
Crash-time service host: svchost.exe_NgcCtnrSvc version 10.0.26100.8737
Faulting module: ucrtbase.dll version 10.0.26100.8875
Exception: 0xc0000005 (access violation)
Current NgcCtnrSvc.dll content/version: 10.0.26100.9168 after KB5121003
dsregcmd /status reports NgcSet: NO for the current user
No physical smart-card reader detected
No DATEV/mIDentity or other matching smart-card middleware installed
No third-party Windows Credential Provider detected
Windows smart-card services (SCardSvr, ScDeviceEnum, SCPolicySvc, CertPropSvc) are Manual and Stopped
Enabled Windows SmartCard event channels contain zero records

Observed sequence

The computer is running normally.
NgcCtnrSvc crashes three times within seconds.
Service Control Manager records two restart attempts and then a final 7034 termination after the third crash.
On a later lock/unlock attempt, the lock-screen acrylic/blur background appears but the credential field never appears.
Keyboard recovery sequences do not restore the UI.
Rebooting restores normal sign-in.

The exact trigger is not known.

Event evidence

Three separate batches were recorded (local time, UTC+8):

2026-08-11 18:29:35, 18:29:47, 18:30:07
2026-08-11 18:47:50, 18:48:03, 18:48:24
2026-08-12 08:35:23, 08:35:31, 08:35:47

Each batch has the same pattern:

Application Error, Event ID 1000
Faulting application: svchost.exe_NgcCtnrSvc
Application version: 10.0.26100.8737
Faulting module: ucrtbase.dll
Module version: 10.0.26100.8875
Exception code: 0xc0000005
Fault offsets: clustered at 0x00000000000ee8b7–0x00000000000ee8fc
(0x00000000000ee8bc repeated across different batches)

Service Control Manager, Event ID 7031
The Microsoft Passport Container service terminated unexpectedly.
(repeated twice)

Service Control Manager, Event ID 7034
The Microsoft Passport Container service terminated unexpectedly.
It has done this 3 time(s).

The repeating offset range suggests the same code path rather than unrelated random crashes.

WER referenced temporary .mdmp files, but they had already been removed when investigated. The WER archive directories are ACL-protected, so no call stack was available.

Relevant negative evidence

Around the incidents there were no corresponding events for:

LogonUI.exe, LockApp.exe, CredentialUIBroker.exe, dwm.exe, or ShellExperienceHost.exe crash/hang
GPU TDR / Display Event 4101
Kernel-Power 41 or unexpected shutdown Event 6008
BugCheck or WHEA hardware errors
Resource Exhaustion Detector / low-memory events

The system has Intel Iris Xe and NVIDIA T550 graphics, but no same-time display-stack failure was recorded.

Update timeline

KB5121003 requested a restart earlier on August 12 and completed installation after two planned servicing restarts at approximately 13:39 local time. After the update:

NgcCtnrSvc.dll was replaced with the signed build 10.0.26100.9168
Its SHA-256 matches the corresponding WinSxS component
NgcCtnrSvc is currently running
No further NgcCtnrSvc crash has been recorded yet

This is encouraging, but there is not enough observation time to conclude that KB5121003 fixed the exact defect.

Expected result

The credential UI should always appear after locking, and NgcCtnrSvc should not enter a three-crash/final-stop state.

Actual result

The service repeatedly access-violates in ucrtbase.dll; afterward the system can become impossible to unlock because the credential UI is absent.

Actions already taken / deliberately not taken

Full reboot restores operation temporarily.
Windows was updated to build 26200.9168.
System files checked during the investigation are Microsoft-signed.
I have not manually taken ownership of or deleted the Ngc folder.
I have not run certutil -DeleteHelloContainer, because NgcSet: NO and the command can remove device-stored WebAuthn/FIDO passkeys.
I have not cleared the TPM.
I have not disabled or changed the startup/recovery configuration of NgcCtnrSvc.

Nearly identical Windows 11 25H2 crash signature and three-failure sequence, but triggered by DATEV mIDentity/SmartVerify middleware. Their workaround disabled a DATEV-specific smart-card lifetime plugin. That software is not installed on this PC: https://www.datev-community.de/t5/Technisches-zu-Software/Windows-Login-und-DATEV-mIDentity-Smartcard/td-p/540951
Microsoft Q&A report where Windows Hello options repeatedly disappear and Event Viewer later shows Microsoft Passport Container terminating up to three times; no confirmed permanent solution: https://learn.microsoft.com/en-us/answers/questions/5512020/windows-hello-sign-in-options-repeatedly-and-spont
A different Passport Container failure was resolved by rebuilding the NGC container, but it did not document the same ucrtbase.dll / 0xc0000005 signature: https://www.elevenforum.com/t/the-microsoft-passport-container-service-terminated-unexpectedly-errors-after-secondary-files-drive-replacement.28065/
Microsoft documents NgcCtnrSvc as Manual/trigger-start and advises against reconfiguring it: https://learn.microsoft.com/en-us/windows/iot/iot-enterprise/optimize/services
Microsoft documents that certutil -DeleteHelloContainer removes associated Hello, WebAuthn, and FIDO credentials: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil#-deletehellocontainer
Windows 11 25H2 release health (no public entry found for this exact crash signature): https://learn.microsoft.com/en-us/windows/release-health/status-windows-11-25h2
KB5121003: https://support.microsoft.com/en-us/servicing/os/windows-11/2026/08/kb5121003-windows-11-24h2-25h2-security-update

Questions for Microsoft

Is NgcCtnrSvc → ucrtbase.dll → 0xc0000005, followed by the 7031/7034 three-crash sequence, a known Windows 11 25H2 defect?
Was this exact issue fixed in KB5121003 / build 26200.9168, even if it is not listed in the public release notes?
Why is NgcCtnrSvc being exercised in this way when NgcSet: NO, no smart-card hardware/middleware is present, and no third-party Credential Provider is installed?
Would certutil -DeleteHelloContainer be relevant here, or should it be avoided when there is no recognized Hello key/container?
What is the supported way to collect a targeted user-mode dump and useful ETW traces for the NgcCtnrSvc service without enabling dumps for every svchost.exe instance?
Is there a KIR, hotfix, diagnostic package, or internal known-issue reference that applies?

Any guidance from the Windows sign-in/identity team would be appreciated.

0 comments

1 answer

Your answer

Answer 1

Carl-L 21,910 Microsoft External Staff Moderator

Hello 牧之王,

Welcome to Microsoft Q&A forum.

As I checked, there are few questions that I cannot find any official article confirming it. Including whether this is a known defect or if it has been addressed, however, most of changes involving this won't be documented.

For your third question: NgcCtnrSvc is not limited to the Windows PIN services, it involves in broader infrastructure like account authentication or credentials provider as well, so NgcSet: NO doesn't mean that it should never works.
For the fourth questions: I wouldn't do that before getting any dump files or crash reports, since doing so might also delete all the evidence that we can collect.
To collect the dump, you can use these commands in an elevated PowerShell:
1. tasklist /svc (To obtain the exact PID of svchost.exe first).
2. procdump64.exe -ma -e -x C:\Dumps <PID>

I'm waiting for your reply.

Carl-L 21,910 Reputation points Microsoft External Staff Moderator

2026-08-14T10:27:43.54+00:00

Hello 牧之王,

Just checking in to make sure that you have received my reply. Please let me know if you have any updates.
牧之王 0 Reputation points

2026-08-15T01:51:19.31+00:00

Hi Carl,

Thank you for following up. I received your reply.

We installed Microsoft Sysinternals ProcDump v12.01 and attached it directly to the current NgcCtnrSvc host PID with -ma -e -n 1. We omitted -x because the official ProcDump documentation defines -x as launching a new image rather than attaching to an existing PID.

As of August 15, the issue has not recurred. NgcCtnrSvc remains running under the same PID; no new Application 1000 or SCM 7031/7034 events have appeared, and no dump has been generated. We will continue monitoring and update this thread if it recurs.

Because a full dump can contain authentication-related process memory, please advise a secure private upload channel if you need the dump.
Carl-L 21,910 Reputation points Microsoft External Staff Moderator

2026-08-15T13:56:36.1066667+00:00

Hello 牧之王,

Thanks for replying.

I'll create a private message channel for you to send the files. Only moderators and you can access that chat box. You can access it by clicking on "Message" button.
Carl-L 21,910 Reputation points Microsoft External Staff Moderator

2026-08-18T13:26:20.6866667+00:00

Hello 牧之王,

Just checking in to make sure that you have received my reply. Please let me know if you have any updates.
牧之王 0 Reputation points

2026-08-19T01:01:32.19+00:00

Hi Carl,

Yes, I received both your reply and the private-message channel. Thank you for following up.

As of August 19, the issue has still not recurred. ProcDump has remained active since August 13 and is still monitoring the same NgcCtnrSvc host process (PID 10324). NgcCtnrSvc is currently running, no dump has been generated, and no new related Application 1000 or Service Control Manager 7031/7034 events have appeared.

I will continue monitoring and will update the thread immediately if the crash recurs. One issue remains: the private-message attachment control currently does not accept .dmp or .zip files. If a dump is captured, could you please provide an official secure upload method that accepts one of those formats?

Best regards,

<PII removed>
Carl-L 21,910 Reputation points Microsoft External Staff Moderator

2026-08-19T13:20:09.36+00:00

Hello 牧之王,

Thanks for replying.

If you have any issues, feel free to come back and let me know.
鑫董 0 Reputation points

2026-09-18T10:33:36.3866667+00:00

I have reproduced what appears to be the same issue on Windows 11 25H2 build 26200.9457.

This time I captured the actual NgcCtnrSvc crash with ProcDump and analyzed the full dump in WinDbg.

The faulting stack is:

ucrtbase!memcpy NgcIsoCtnr!NgcUtils::CoMemAllocCopy NgcIsoCtnr!NgcIsoContainer::ExportRsaPublicKey ngcctnrsvc!NgcHandler::RsaExportPublicKey

The object being processed is a valid ECDSA P-256/FIDO public-key blob (ECS1, cbKey=32), but it reaches the RSA export path. The ECC X-coordinate bytes are interpreted as the RSA cbPublicExp length, producing a bogus ~3.16 GiB copy length and eventually an invalid read (0xC0000005).

After the three service crashes, Windows Hello, PIN and device-stored Passkeys all become unavailable until reboot.

I have now filed a private Feedback Hub report with Microsoft: https://aka.ms/AA13g7s7

I have retained the full crash dump and raw logs locally and can provide them privately to Microsoft if requested.

NgcCtnrSvc crashes 3 times in ucrtbase.dll (0xc0000005), then Windows 11 25H2 lock screen has no credential UI

Summary

Environment

Observed sequence

Event evidence

Relevant negative evidence

Update timeline

Expected result

Actual result

Actions already taken / deliberately not taken

Related reports and documentation

Questions for Microsoft

1 answer

Your answer