Should you be affected by system crashes and a ‘blue screen of death’ following the major IT outage affecting industries across the world, the recommended next steps are below.
Current Action
- CrowdStrike Engineering has identified a content deployment related to this issue and reverted those changes.
- If hosts are still crashing and unable to stay online to receive the Channel File Changes, the following steps can be used to workaround this issue.
Reboot
There may be a simple way to bypass the ‘blue screen of death’ and boot successfully. The first thing to try is turning your machine on and off again multiple times. Windows has an in-built mechanism for detecting failed boots caused by corrupted drivers and will attempt to load a backup configuration.
If this method does not work, apply the steps below.
Workaround Steps for individual hosts:
- Reboot the host to give it an opportunity to download the reverted channel file. If the host crashes again, then:
-
- Boot Windows into Safe Mode or the Windows Recovery Environment
-
-
- Note: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation.
-
-
- Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory
- Locate the file matching “C-00000291*.sys”, and delete it.
- Boot the host normally.
Note: Bitlocker-encrypted hosts may require a recovery key.
Workaround Steps for public cloud or similar environment including virtual:
Option 1:
- Detach the operating system disk volume from the impacted virtual server
- Create a snapshot or backup of the disk volume before proceeding further as a precaution against unintended changes
- Attach/mount the volume to to a new virtual server
- Navigate to the %WINDIR%\\System32\drivers\CrowdStrike directory
- Locate the file matching “C-00000291*.sys”, and delete it.
- Detach the volume from the new virtual server
- Reattach the fixed volume to the impacted virtual server
Option 2:
- Roll back to a snapshot before 0409 UTC.
AWS-specific documentation:
Azure environments:
- Please see this Microsoft article.
Bitlocker recovery-related KBs:
- BitLocker recovery in Microsoft Azure
- BitLocker recovery in Microsoft environments using SCCM
- BitLocker recovery in Microsoft environments using Active Directory and GPOs
- BitLocker recovery in Microsoft environments using Ivanti Endpoint Manager
- BitLocker recovery in Microsoft environments using ManageEngine Desktop Central
- BitLocker recovery in Microsoft environments using IBM BigFix
As the situation develops, guidance on the matter will evolve. We will share the recommended next steps here as it evolves and are here to help should you need us.
Please feel free to contact our experts if you need further advice.
