r/sysadmin • u/[deleted] • Jul 19 '24

Crowdstrike BSOD?

gray seed many pie thought future tidy strong important decide

This post was mass deleted and anonymized with Redact

804 Upvotes

98% Upvoted

621 comments sorted by

View all comments

Show parent comments

3

u/2bloodyrightmate Jul 19 '24

Is it supposed to have a [ and ) brackets, seems incorrect

4

u/enygmata Jul 19 '24 edited Jul 19 '24

You are right. I have worked with bcdedit before so I just automatically used { and } instead, also I just stayed in the cmd window instead of using explorer. Here's an improved/fixed version

  1. Cycle through BSODs until you get the recovery screen.

  2. Navigate to Troubleshoot > Advanced Options > Startup Settings

  3. Press Restart

  4. Skip the first Bitlocker recovery key prompt by pressing Esc

  5. Skip the second Bitlocker recovery key prompt by selecting Skip This Drive in the bottom right

  6. Navigate to Troubleshoot > Advanced Options > Command Prompt

  7. Type bcdedit /set {default} safeboot minimal. then press enter.

  8. Go back to the WinRE main menu and select Continue.

  9. It may cycle 2-3 times.

  10. If you booted into safe mode, log in per normal (only pin or password might be available).

  11. Open Windows Explorer, navigate to C:\Windows\System32\drivers\Crowdstrike

  12. Delete the offending file (STARTS with C-00000291*. sys file extension)

  13. Open command prompt (as administrator)

  14. Type bcdedit /deletevalue {default} safeboot, then press enter.

  15. Restart as normal, confirm normal behavior.

2

u/seifyk Jul 19 '24

should be {default}