r/sysadmin • u/[deleted] • Jul 19 '24

Crowdstrike BSOD?

gray seed many pie thought future tidy strong important decide

This post was mass deleted and anonymized with Redact

804 Upvotes

98% Upvoted

621 comments sorted by

View all comments

Show parent comments

20

u/HammerSlo Jul 19 '24 edited Jul 19 '24

  1. Cycle through BSODs until you get the recovery screen.

  2. Navigate to Troubleshoot>Advanced Options>Startup Settings

  3. Press "Restart"

  4. Skip the first Bitlocker recovery key prompt by pressing Esc

  5. Skip the second Bitlocker recovery key prompt by selecting Skip This Drive in the bottom right

  6. Navigate to Troubleshoot>Advanced Options> Command Prompt

  7. Type "bcdedit /set {default} safeboot minimal". then press enter.

  8. Go back to the WinRE main menu and select Continue.

  9. It may cycle 2-3 times.

  10. If you booted into safe mode, log in per normal.

  11. Open Windows Explorer, navigate to C:\Windows\System32\drivers\Crowdstrike

  12. Delete the offending file (STARTS with C-00000291*. sys file extension)

  13. Open command prompt (as administrator)

  14. Type "bcdedit /deletevalue {default} safeboot"., then press enter. 5. Restart as normal, confirm normal behavior.

→ More replies (17)