Fatech IT Advisors’ Post

PSA: In regards to the national outages related to CrowdStrike, we understand many of you have been affected and we're here to help. We want to assure you that Sparkplug IP remains online and fully operational and our support team is standing by for anyone that needs additional help. For those impacted, CrowdStrike has provided a statement to help get servers back online. Here's a link with steps to follow: https://lnkd.in/gtZQ5TD4

A recent software update from #CrowdStrike caused widespread system crashes for #Microsoft Windows-based workstations and servers, leading to major disruptions. Manual intervention is required on each system to correct it. The following steps can be used to work around this issue: 🔄 Boot Windows into Safe Mode or the Windows Recovery Environment. 📁 Use File Explorer to navigate to the C:\Windows\System32\drivers\CrowdStrike directory. 🗑️ Locate the file matching 'C-0000029*.sys' and delete it. 🔄 Reboot the host normally. For ITS clients with machines protected by BitLocker, you may be prompted to enter an encryption key; if so, please contact the ITS help desk directly for assistance. If you need any additional assistance with these instructions, please contact the ITS help desk directly at helpdesk@itsolutions-inc.com or 215-886-7166. Please be aware that there may be delays and longer wait times than usual due to the high volume of support requests.

Here are the steps to remediate the Crowdstrike issue causing the outage. The steps are very simple, but require touching every affected machine: Workaround Steps for individual hosts: Reboot the host to give it an opportunity to download the reverted channel file. If the host crashes again, then: Boot Windows into Safe Mode or the Windows Recovery Environment NOTE: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation. Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory Locate the file matching “C-00000291*.sys”, and delete it. Boot the host normally. Note: Bitlocker-encrypted hosts may require a recovery key. For the latest updates go to: https://lnkd.in/eanRAgxK If you need assistance, please reach out. #crowdstrike #globaloutage #disasterrecovery

If you’ve got a blue screen of death and you have Crowdstrike Falcon deployed in your business this is the fix. 🚨 This will not be a quick fix and will have to be carried out manually on each machine 🚨 Workaround Steps  1. Boot Windows into Safe Mode or the Windows Recovery Environment.  2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory.  3. Locate the file matching “C-00000291*.sys” and delete it.  4. Reboot the host normally. Source: https://lnkd.in/gTWsUE7b... https://lnkd.in/gtZQ5TD4

https://lnkd.in/gwzqPq6F If you have been affected by the CrowdStrike BSOD: 1. Boot Windows into Safe Mode or the Windows Recovery Environment NOTE: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation. 2. Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory Locate the file matching “C-00000291*.sys”, and delete it. 3. Boot the host normally. Note: Bitlocker-encrypted hosts may require a recovery key.

Crowdstrike outage: Hello World, Should you hear from anyone impacted by the Crowdstrike outage, feel free to reach out to our team for help or share the following solution with them:   1. Boot into Safe Mode or Windows Recovery Environment: - Restart your system and press F8 repeatedly before Windows start to boot. Alternatively, you can use the Windows Recovery Environment. 2. Navigate to the CrowdStrike Directory: - Go to C:\Windows\System32\drivers\CrowdStrike. 3. Delete the Problematic File: -Locate the file matching “C-00000291*.sys” in the CrowdStrike directory and delete it 4. Restart Normally - Once deleted, restart your system normally. Hope this helps! For more detailed instructions, Here is an article of what happened:

🚨 Important Notice: CrowdStrike Update Crashes Windows Systems 🚨 A recent flawed update to drivers associated with CrowdStrike EDR solutions has caused a widespread outage, impacting numerous Windows systems worldwide, including servers and workstations. Affected systems are experiencing the infamous 'blue screen of death' and are struggling to boot correctly. To resolve this issue, the affected driver (csagent.sys or C-00000291*.sys) needs to be deleted using Safe Mode. However, many corporate users lack the necessary access rights to perform this action. This means corporate administrators may need to manually intervene on a company-wide level. Reportedly, this issue has impacted many critical infrastructure computers, including those in airports and airlines.

For those affected by the failure associated with the CrowdStrike Falcon sensor. CrowdStrike has put out an article with the four steps to fix the issue: Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally. https://lnkd.in/enjgM9QM

Crowdstrike Falcon Crisis Workaround Steps for Individual Hosts: 1. Reboot the Host: • Connect the host to a wired network (ethernet) for faster internet connectivity. • Reboot the host to allow it to download the reverted channel file. 2. If the Host Crashes Again: a. Boot into Safe Mode or Windows Recovery Environment: • Connect the host to a wired network (ethernet) for faster internet connectivity. • Use “Safe Mode with Networking” for easier remediation. b. Navigate to the CrowdStrike Directory: • For Windows: • Navigate to %WINDIR%\System32\drivers\CrowdStrike. • For Windows Recovery Environment/Preinstallation Environment (WinRE/WinPE): • Navigate to Windows\System32\drivers\CrowdStrike on the OS volume. c. Delete the Specific File: • Locate the file matching the pattern C-00000291*.sys. • Delete this file. d. Boot the Host Normally: • Reboot the host normally. 3. Note: • For BitLocker-encrypted hosts, you may need to provide the recovery key. These steps should help in resolving the issue with the host crashing due to the problematic channel file. #crowdstrike #falcon #DIY##microsoft #systemrecovery

❗❗ Attention! ❗ Technical issues for Windows users due to CrowdStrike update: refrain from installing new Windows updates at the moment ❗ Dear Customers, Today, many Windows users have encountered serious problems due to the latest update from CrowdStrike. If your computer has suddenly decided to surprise you with the "Blue Screen of Death" (BSOD), don't worry—you're not alone! ❗What happened? After installing the new CrowdStrike Falcon update, many systems started freezing and displaying blue screens. It seems that some computers decided they needed a little break, too. 💡 Our recommendations: As a reliable hosting service provider, we assure you that our servers are running smoothly. However, we strongly advise our customers using Windows to refrain from installing new updates until the situation is resolved. 🌏 Not just you: These issues have affected Windows users worldwide. Major companies and services have also faced widespread outages. But together, we can overcome this! 💬 What to do? If you encounter similar problems: 1. Do not install new updates. 2. Stay informed about the issue. 3. Share with friends and colleagues! Please inform your friends and colleagues about this issue so they can avoid potential troubles. The more people are aware, the better we can all prepare and handle the situation. #crowdstrike #windows #bsod