If you or your organization was affected by the ‘Blue Screen of Death’ caused by a compatibility conflict within the new Crowdstrike sensor update, the following workarounds will help you fix the Crowdstrike BSOD issue.
Fix the Crowdstrike BSOD Issue
The recommended approach for fixing the issue is to delete the problematic .sys-file – but this requires administrative privileges. Because of the nature of the Crowdstrike issue, the devices can’t boot normally and hence cannot utilize Break Glass accounts etc.
If the user on the device does not have administrative privileges (e.g., if admin rights have been revoked), the following can be attempted to allow the device to boot up:
If the device is on-premises joined:
- Start the device in Safe Mode with Internet connection enabled.
- Log into the device with an AD user that’s member of the Domain Admins-group.
- The logged in user would then have administrative rights of the device.
If the device is Entra ID joined:
- Assign the role Microsoft Entra Joined Device Local Administrator to an Entra ID user
- Boot the device up in Safe Mode with Internet connection enabled.
- Login with the AD user which has the above role assigned to it.
- You should then have administrative rights over the device.
Uninstalling the Crowdstrike Console Application:
If you’re unable to access your device via an administrator account, a last resort is to actively uninstall the Crowdstrike Console application. To do this, follow the procedure below:
- Generate a CrowdStrike uninstall token from the CS Console.
- Start the device in Safe Mode with Internet connection enabled.
- Open a CMD-prompt, type in the following, and press Enter:
- CsUninstallTool.exe MAINTENANCE_TOKEN=<token_from_cs_console> /quiet
- E.g.: CsUninstallTool.exe MAINTENANCE_TOKEN=a0c76aa097218dc446082 /quiet
- Finally, reboot the device.
The above will uninstall the problematic CS application from the device.
Extra Steps: Verify and Update:
- After running the scripts, ensure that the affected devices are updated to a stable version of the CrowdStrike sensor (currently version 6.56.17010 is recommended).
- Reduce the number of devices in your QA group for future updates to minimize issues (Reddit).
How the Crowdstrike Debacle Unfolded
On July 20th, 2024, many users encountered a significant issue: the dreaded Blue Screen of Death (BSOD) caused by an update to Crowdstrike’s sensor version 6.58. This problem disrupted operations for organizations across the globe, and was met with urgent need for a solution.
Crowdstrike is a widely-used cybersecurity solution known for its proactive threat detection. However, the update released on July 18th, 2024, caused a BSOD on many systems, specifically those running Windows 10. This issue stemmed from a compatibility conflict within the new sensor update.
The BSOD was due to a conflict between the new Crowdstrike sensor and certain system configurations. Crowdstrike responded by pulling the faulty update and working on a solution to fix the Crowdstrike BSOD issue. However, the immediate concern was to restore affected systems.
Where to Next
Learn more about Admin By Request security solutions here, or download our Free Plan and get started with a POC today.
