The recent CrowdStrike Falcon update has damaged the services that depend on Microsoft Windows. Microsoft has acknowledged the issue and released a tool to fix it. In this guide, we show you how to use the Microsoft Recovery Tool to fix the CrowdStrike issue on Windows.
Microsoft Recovery Tool to fix CrowdStrike issue on Windows
We have already covered solutions for the CrowdStrike BSOD issue on Windows computers. Now that Microsoft has released an official recovery tool that you can download and use it to fix the CrowdStrike BSOD.
UPDATE: The Microsoft tool for recovering devices impacted by the CrowdStrike issue has now been updated to include PXE boot as an option. The new release includes enhanced recovery via safe boot, ISO/USB generation, improved ADK detection, and a fix for USB disk size checks.
Requirements to use Microsoft Recovery Tool
Not everyone can use the Microsoft recovery tool to fix the CrowdStrike issue. Microsoft has laid out a few requirements you need to meet. The requirements to use the Microsoft Recovery tool are:
- Windows 64-bit client with a minimum of 8GB of free space to run the tool and create a bootable USB drive. The device must not have been impacted by the CrowdStrike issue.
- Administrator account with all the privileges
- An empty USB drive with a minimum of 1GB storage. If there is any data on the USB drive, it will be wiped out in the process
- BitLocker recovery key for the BitLocker-enabled devices impacted by the CrowdStrike BSOD.
The two repair options are as follows:
- Recover from WinPE – this option produces boot media that will help facilitate the device repair.
- Recover from safe mode – this option produces boot media so impacted devices can boot into safe mode. The user can then login using an account with local admin privileges and run the remediation steps.
Read: How to find BitLocker Recovery Key with Key ID in Windows 11
How to use the Microsoft Recovery Tool for CrowdStrike BSOD
If you have met the requirements put by Microsoft to be able to use the Recovery tool, follow the below steps to use the Microsoft Recovery Tool to fix the CrowdStrike BSOD on Windows.
- Download the Recovery tool from Microsoft Download Center.
- Extract the Recovery Tool that you have downloaded in the ZIP format
- In the extracted folder find the MsftRecoveryToolforCS file and run it in the elevated PowerShell.
- When you run the PowerShell prompt, the Assessment and Deployment Kit (ADK) will download and install. Please wait for it to complete the process successfully. During the process, you will be asked to select a driver directory. Select N to skip it.
- It will prompt you to insert the USB drive and specify the drive letter. Follow the instructions on the screen to do so.
- After the USB is created, remove it from your Windows client.
- Now, plug in the USB drive on the CrowdStrike impacted Windows client and reboot it.
- Press F12 or the manufacturer’s commands to enter the BIOS settings during the reboot.
- In the BIOS boot menu, select the USB drive and boot with it.
- The tool starts running on the Windows client. If the Windows client has BitLocker encrypted drives, you will be prompted to enter the recovery key. Enter the BitLocker Recovery key, including the dashes between them.
- After running the tool successfully, reboot the device to see if it fixed the CrowdStrike issue.
The updated version of this CrowdStrike recovery tool can save you from the BSOD, even without BitLocker recovery keys.
You can read the Microsoft post for further details.
Read: FixWin is the best PC Repair software to fix Windows problems
How to boot Windows in safe mode in CrowdStrike?
To boot Windows in Safe mode in CrowdStrike BSOD, click on See advanced repair options on the Recovery screen. Select Troubleshoot and go to Advanced options. Then, select Startup settings and click Restart. During the restart press 4 or F4 keys on your keyboard to boot into safe mode.
Was the CrowdStrike outage fixed?
Both Microsoft and CrowdStrike have acknowledged the issue and released instructions for manually fixing it. CrowdStike has instructed the affected users to delete the C-00000291*.sys file in the CrowdStrike directory on the Windows client. Microsoft has released a new recovery tool that can be run with a USB drive on the affected Windows clients.
Related read: How to Recover Data after a Blue Screen of Death in Windows?
