CrowdStrike IT Outage Explained by a Windows Developer

How to Fix CrowdStrike Blue Screen Issue on Windows Machines

1. Understand the CrowdStrike Issue: CrowdStrike blue screens are caused by a bad update to the CrowdStrike software. This update led to machines crashing due to faults in the CrowdStrike code running in kernel mode.

2. Kernel Mode vs. User Mode: Kernel mode is where the operating system performs core functions like managing hardware and memory, while user mode is where applications run. When a kernel driver like CrowdStrike fails, it can lead to system crashes.

3. Identify the Problem: The CrowdStrike software operates in kernel mode to analyze application behavior for security purposes. This requires it to be integrated as a device driver in the kernel, granting it deep access to system functions.

4. Debugging the Issue: Access crash dump reports to analyze the cause of the blue screen. Look for errors in the driver code that may lead to system crashes, such as inadequate error checking and parameter validation.

5. Fixing the Blue Screen Issue:

   • Boot into Safe Mode: Restart the affected Windows machine and boot into Safe Mode, which loads a limited set of drivers.
   • Locate the CrowdStrike Driver: Navigate to the path C:\Windows\System32\drivers and find the file matching the pattern C########.sys (where C is followed by zeros and a number).
   • Delete the Problematic File: Delete the file with zeros in its name.
   • Reboot the System: After deleting the file, reboot the system normally. The absence of the problematic update file should resolve the blue screen issue.

6. Preventive Measures: Ensure that your system is regularly updated with certified drivers to avoid similar blue screen incidents in the future.

7. Further Assistance: If the issue persists or if you encounter any difficulties during the process, seek help from a professional IT technician or CrowdStrike support.

8. Feedback and Support: Share your experience with fixing the blue screen caused by CrowdStrike to help others facing similar issues. Consider subscribing to the Dave's Garage channel for more tech-related content and troubleshooting tips.

By following these steps, you should be able to resolve the CrowdStrike blue screen issue on your Windows machine effectively.