Microsoft has released a custom repair tool to find and remove the flawed CrowdStrike update that affected about 8.5 million Windows on Friday.
See also: CrowdStrike actively assists affected customers
CrowdStrike released a faulty update that caused sudden crashes on millions of Windows devices around the world, leading to blue screens of death (BSOD) and reboot loops.
This bug caused massive outages as companies suddenly discovered that all of their Windows devices were no longer working. This outage affected airports, hospitals, banks, corporations , and government agencies worldwide.
To resolve the fix, administrators needed to restart affected Windows devices in Safe ModeorRecovery Environment and manually remove the kernel driver program from the C:WindowsSystem32driversCrowdStrike.
However, as organizations deal with hundreds, if not thousands, of affected Windows devices, manually performing these fixes can be problematic, time-consuming, and difficult.
To help IT administrators and support staff, Microsoft has released a custom repair tool that automates the removal of the problematic CrowdStrike version from Windows devices so they can boot normally again.
“ The signed Microsoft Recovery Tool can be found in the Microsoft Download Center: https://go.microsoft.com/fwlink/?linkid=2280386 ,” Microsoft says
See also: CrowdStrike: Many devices are working again after the “blackout”
To use Microsoft's repair tool, IT staff needs a 64-bit Windows client PC with at least 8 GB of space, administrative privileges on that device, a USB drive with at least 1 GB of storage , and a Bitlocker recovery key, if required.
It should be noted that you will need a 32 GB or smaller USB flash, as otherwise you will not be able to format it with FAT32, which is required to boot the drive.
The CrowdStrike update remediation tool is created via a PowerShell script obtained from Microsoft, which must be run with administrator privileges. When executed, it will format a USB drive and then create a custom WinPE image, which is copied to the drive and made bootable. You can then boot the affected Windows device with the USB key, and it will automatically run a batch file named CSRemediationScript.bat.
This batch file will prompt you to enter any necessary Bitlocker recovery keys. The script will then look for the CrowdStrike kernel driver in the C:\Windows\system32\drivers\CrowdStrike and, if found, will automatically delete it. When it is finished, the script will prompt you to press any key and device will restart. Now that the CrowdStrike driver has been deleted, the device should boot back into Windows and be available.
Unfortunately, the biggest hurdle for Windows administrators is retrieving the necessary Bitlocker recovery keys. Therefore, identifying and retrieving them should be the first steps taken before attempting to recover their devices with the help of Microsoft's CrowdStrike driver repair tool.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: CrowdStrike global outage hits Mercedes F1 team too
CrowdStrike is a leader in cybersecurity, offering a variety of solutions aimed at detecting and preventing cyber threats. One of the core components of the platform is the CrowdStrike driver, which runs on endpoints to facilitate real-time monitoring and response capabilities. This lightweight driver is integrated into the Falcon platform, enabling advanced threat intelligence, behavioral analysis, and rapid mitigation of potential breaches. Leveraging a cloud-native architecture, the CrowdStrike driver provides organizations with increased visibility and protection against sophisticated cyberattacks ,ensuring a comprehensive security posture across their digital environments.
Source: bleepingcomputer
