CrowdStrike Update Causes BSOD Issues Globally

Banks, airlines, supermarkets, broadcasters, and more are experiencing Blue Screen of Death (BSOD) issues today following an update from cybersecurity provider CrowdStrike. This update has caused computers to become trapped in a BSOD loop.

Go Straight to the CrowdStrike Falcon Sensor Audit

Organizations worldwide, including Sky News, Lufthansa, Delta Airlines, and Prague Airport, are reporting BSOD issues this morning. A faulty update from CrowdStrike has caused affected PCs and servers to go offline and enter a recovery boot loop, preventing them from starting up properly.

To help you identify and mitigate these BSOD issues more effectively, we’ve created a video demonstrating how our CrowdStrike Falcon Sensor audit can be used alongside other data points to ease the mitigation process.

Approximately 20% of Devices Affected

Our data indicates that about 20% of all business Windows devices have the CrowdStrike agent installed and could be at risk. This correlates with the numerous issues reported by organizations.

Lufthansa has reported that the company’s booking retrieval capabilities may be limited, but they are actively working on a solution. Prague Airport is also affected, with the check-in system outage causing delays for some departures. Meanwhile, Sky News has been unable to broadcast this morning due to infrastructure issues.

CrowdStrike Workaround

CrowdStrike has published a technical advisory (TA) on their website with details on resolving the BSOD issues. The CrowdStrike engineering team has identified the problematic content deployment and reverted those changes.

Workaround Steps:

1. Boot Windows into Safe Mode or the Windows Recovery Environment.
2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory.
3. Locate and delete the file matching “C-00000291*.sys”.
4. Boot the host normally.

Find Affected Devices

We’ve created a CrowdStrike Falcon Sensor audit to identify which devices might be affected. This audit provides an overview of all devices with a Sensor installed that might have received the problematic update causing the BSOD.

Devices no longer reporting back and should be are likely stuck in the recovery boot loop, giving you an accurate list to begin remediating the BSOD issues.

Additionally, Lansweeper can provide BitLocker recovery keys for each device, ensuring you have all the necessary data to start remediation if any BitLocker-encrypted devices are affected.

Know Your IT

The Lansweeper Deepscan engine discovers any asset in your corporate network without installing any software on them. There’s no environment or asset Lansweeper can’t handle.

Learn how Lansweeper can benefit your bussiness

Book a live demo with our specialist to discover how Lansweeper helps you to minimize risks & optimize your IT.