How to fix CrowdStrike BSODs in three minutes — fix requires manual changes, but they are simple

vanadiel007

Distinguished
Oct 21, 2015
249
242
18,960
Blows my mind banks and a whole bunch of others are just applying updates across the board without first testing them in house to ensure they will not cause issues.

I mean, they were lucky this was not a virus or backdoor that slipped it's way into the update process.

Totally unacceptable that companies just update their machines without checking anything and just blindly trust updates.
 
  • Like
Reactions: NinoPino
Sounds like it is much more complex if you have bitlocker on it.

Can you even think to be the guy who walks into a datacenter with cabinets as far as you can see with multiple server per cabinet and know you have to physically touch every device.....even if the fix is "easy"
 

mac_angel

Distinguished
Mar 12, 2008
611
113
19,160
Doesn't work for me. Fiance works for Roger's Communications remotely. I can't get her laptop to boot into safe mode at all. I was given the recovery key and Admin password from their IT to try, but no luck.

no access to the BIOS as of yet ( to get into Boot Options). I didn't get that password from them. A level 2 tech should be calling at some point, but not expecting it to be today.
 
Last edited:

rgd1101

Don't
Moderator
what the laptop? what os?

yeah is not that simple. business pc/laptop usually lockdown. user won't have admin access to get to that crowdstrike folder. for remote they will have to get the admin account/password to delete a file. and that is without bitlocker.
 
  • Like
Reactions: mac_angel
This is why I always have a bootable usb with a linux distro (usually Mint) on hand so that I can access my disks and files when Windows just won't work. In this case once you know which file to delete you can easily navigate to it and delete it without having to do the Windows recovery dance.
 
  • Like
Reactions: rgd1101

emike09

Distinguished
Jun 8, 2011
166
160
18,760
Totally unacceptable that companies just update their machines without checking anything and just blindly trust updates.
Most companies don't have the resources to check every single update for every server or workstation in a dev environment. Do you know how many updates that would be? Especially for Crowdstrike which can be updated more than once a day. Their updates are transparent and happen in the background without user interaction, which makes that even harder. You'd need guys on staff where that's all they do.
 
  • Like
Reactions: NinoPino

NinoPino

Respectable
May 26, 2022
328
195
1,860
This is why I always have a bootable usb with a linux distro (usually Mint) on hand so that I can access my disks and files when Windows just won't work. In this case once you know which file to delete you can easily navigate to it and delete it without having to do the Windows recovery dance.
Can you do this also with Bitlocker ?
 

vanadiel007

Distinguished
Oct 21, 2015
249
242
18,960
Most companies don't have the resources to check every single update for every server or workstation in a dev environment. Do you know how many updates that would be? Especially for Crowdstrike which can be updated more than once a day. Their updates are transparent and happen in the background without user interaction, which makes that even harder. You'd need guys on staff where that's all they do.

For banking systems and airlines to be down and have to cancel 2,000 flights, just imagine the cost of that versus the cost of proper support staffing.

It's unacceptable and irresponsible to perform blind updates.
 

NinoPino

Respectable
May 26, 2022
328
195
1,860
For banking systems and airlines to be down and have to cancel 2,000 flights, just imagine the cost of that versus the cost of proper support staffing.

It's unacceptable and irresponsible to perform blind updates.
My opinion is that the updating system should be changed grouping update with monthly frequency. And never going straight online without admin confirmation.