CloudStrike Microsoft BSOD Workaround
If you are impacted by the current Blue Screen of Death outage affecting Windows users who have implemented CloudStrike Services, here is a workaround to get your systems working quickly.
![](https://www.turbogeek.co.uk/wp-content/uploads/2024/07/CrowdStrike_Logo_2023_Secondary_Red-1024x534.png)
Quick Guide – Follow these Steps
- Boot Windows into Safe Mode or the Windows Recovery Environment
- Navigate to the C:\Windows\System32\drivers\CrowdStrike directory.
- Locate the file matching “C-00000291*.sys” and delete it.
- Boot the host normally.
Full Detailed Guide
The steps below expand upon the quick guide above.
Step 1 – Boot into Safe Mode or WRE
SAFE MODE
Safe Mode starts Windows in a basic state, using a limited set of files and drivers. This can help troubleshoot problems caused by software or drivers.
Here are a three ways to get into Safe Mode:
From Settings (Windows 10/11/Server):
- Press
Windows key + I
to open Settings. - Click “Update & Security” (or “System” in Windows 11).
- Click “Recovery”.
- Under “Advanced startup”, click “Restart now”.
- After restarting, choose “Troubleshoot” > “Advanced options” > “Startup Settings” > “Restart.”
- After another restart, choose “Safe Mode” (option 4) or “Safe Mode with Networking” (option 5).
From the Sign-in Screen (All Versions):
- Restart your computer.
- At the sign-in screen, hold down the
Shift
key while clicking the “Power” button > “Restart.” - Follow the steps above from “Troubleshoot” onwards.
Using the F8 Key (Older Systems):
- Restart your computer.
- Repeatedly press
F8
before the Windows logo appears. - Choose “Safe Mode” from the Advanced Boot Options menu.
WRE
Booting into the Windows Recovery Environment (WinRE):
WinRE is a recovery environment that can help fix serious system problems. You can access it using similar methods as for Safe Mode:
From Settings or the Sign-in Screen:
- Follow the same steps as for Safe Mode, but choose “Troubleshoot” instead of “Startup Settings.”
- From there, you can access various recovery options, such as “System Restore,” “Startup Repair,” or “Command Prompt.”
From a Recovery Drive:
- If you’ve created a recovery drive, insert it and boot from it.
- Choose your keyboard layout and language.
- Select “Troubleshoot” to access WinRE.
Note: The exact steps might vary slightly depending on your Windows version. If you encounter any difficulties, you can search for more detailed instructions on the Microsoft support website or your computer manufacturer’s website.
Important: If your drive is protected by BitLocker, you will need your recovery key.
Step 2 – Navigate to Windows CloudStrike System Folder
This directory is the default installation location for the CrowdStrike Falcon sensor drivers. These drivers are essential for the operation of the CrowdStrike security software, but sometimes, specific files (like C-00000291*.sys
) can cause issues like Windows’s Blue Screen of Death (BSOD).
C:\Windows\System32\drivers\CrowdStrike
Using File Explorer (Safe Mode/WinRE):
- Open File Explorer.
- In the address bar, type (or copy and paste):
C:\Windows\System32\drivers\CrowdStrike
- Press
Enter
. - This should directly open the CrowdStrike directory, where you can locate and manage files as needed.
Using Command Prompt (Safe Mode/WinRE):
- Open Command Prompt (as administrator if possible).
- Type:
cd C:\Windows\System32\drivers\CrowdStrike
- Press
Enter
. - You will now be in the correct directory within Command Prompt, and you can use commands like
dir
to list files ordel
to delete them.
Step 3 – Delete C-00000291*.sys
C-00000291
: This is the base name of the file, representing a specific CrowdStrike driver component.*.sys
: This indicates that it’s a system file (driver) used by Windows.*
(asterisk): This is a wildcard character, meaning the file name can have any characters after “C-00000291”. For example, you might seeC-00000291.sys
,C-00000291_1.sys
, etc
Once you’re in the CrowdStrike
directory, look for files that start with “C-00000291” and end with “.sys”. You might need to scroll or sort files by name to find them easily.
Deleting the File:
In File Explorer:
- Right-click on the matching file(s) and select “Delete”.
- Confirm the deletion when prompted.
In Command Prompt:
- Type the following command, replacing
<filename>
with the actual name of the file you want to delete:del <filename>
- For example, if the file is named
C-00000291.sys
, you would type:del C-00000291.sys
- Press Enter to delete the file.
Step 4 – Reboot
Now simply reboot the computer and let it boot into Windows
Good Luck – I know a lot of sysadmins are tired and have been up all night fixing this clusterf**k
Recent Comments