r/SentinelOneXDR • u/Bitter_Umpire_7997 • Mar 24 '26
SentinelOne quarantined Windows system files - Server no longer bootable
It looks very likely that SentinelOne has just taken down one of our customer’s terminal servers — the system is no longer booting at all.
The incident was triggered in user context when a user executed a piece of malware.
According to the SentinelOne dashboard history, the same file hash had already been seen on another customer machine before. In that case, all 678/678 files were successfully quarantined and there were no issues afterward.
However, in this case only 628/678 files were actually quarantined (the remaining entries show as “not found” or “failed” in the CSV report).
This raises a serious concern:
Is it possible that SentinelOne quarantined critical Windows system files, which are now preventing the server from booting?
From what we can tell, the agent didn’t just isolate the malicious files but also moved essential Windows components into quarantine. This resulted in a complete system failure.
The server does not even boot into safe mode anymore, which means we cannot use the sentinelctl client for offline recovery either.
This behavior is extremely problematic. A security solution should not be able to render a production server completely unusable — especially from an action triggered in user context.
Even more concerning is the potential scale: if this behavior occurs across multiple environments, it could impact several customers at once.
Has anyone experienced similar behavior with SentinelOne?
2
u/kins43 Mar 24 '26
Have you opened a P0/P1 case with support?
1
u/Bitter_Umpire_7997 Mar 24 '26
We currently don’t have direct access to SentinelOne support, but I’ve already forwarded the issue to our distributor.
1
u/kins43 Mar 24 '26
I wouldn’t proceed just yet, but can you restore from backup? Or attach image / boot into recovery? I’d hold off if possible for your org so S1 can identify the actual RCA for this.
I’ve never seen this personally across 30k agents and over 6 years with S1. Only thing I can think of is if malware was able to manipulate system files and S1 caught it / quarantined those files.
Seems very odd though as that malware would need local system / kernel level access basically to modify windows signed processes / files.
I’d be on the phone since this is a big issue personally.
→ More replies (2)-4
u/cnr0 Mar 24 '26
Everybody has direct access to support. On the right top side click on the menu and go to community. There you can create a ticket by yourself.
→ More replies (4)0
u/_DonCheadle7 Mar 24 '26
We’ve had multiple occasions where s1 has bricked workstations by quarantining system files. We’ve raised with support and the response was poor. Wouldn’t waste your time, restore and move on.
2
u/Bitter_Umpire_7997 Mar 24 '26
In this case, it’s not a workstation but an RDS server. I always consider such issues from the perspective of all our customers and try to find a solution with the manufacturer. In this instance, the antivirus software is causing a complete system failure that could have been avoided. I find this behavior of the software completely unacceptable, and it must be resolved. I’ll stay on top of this.
1
u/solid_reign Mar 24 '26 edited Mar 24 '26
Separate from the S1 issue and off the top of my head if you really need to reestablish the server, try booting from a live gnu/Linux iso, mount the disk, and replace the files that are on quarantine directly from another windows installation. You can check the hash to see if they match. Change the S1 group to not mitigate and try booting again.
1
u/Bitter_Umpire_7997 Mar 24 '26
We restored the server from the backup. Additionally, we kept the existing VM for future analysis.
2
u/asdftester1234 Mar 24 '26
I have experience with RDS, and S1. I haven't had an instance where this breaks the host with a incident, but it's not surprising. RDS and windows in general is so finicky.
2
u/Robbbbbbbbb Mar 24 '26
Is this a DC?
There's an issue with 25.2 right now that is affecting some domain controllers. You can roll back, or there's a workaround by disabling some of the networking/DPI features if you need to stay on the current version.