top of page

BitLocker enabled? Here's the workaround for you! CrowdStrike BSOD Falcon Sensor BitLocker CrowdStrike Solution

Writer's picture: Giuseppe CavaleriGiuseppe Cavaleri
Microsoft/ CrowdStrike outage has taken down most airports in India. I got my first hand-written boarding pass today. Photo included of hand written boarding pass.

You already know. And you need a solution to unbrick your BitLocked drive.


Along with other wider reported outages emergency services & hospitals are being disproportionately impacted. Hope this helps get a few back online while a real fix is prepared. I used to work in healthcare. I understand how critical uptime is.


Why trust a design blog? Because I've lived a few lives, am very tech savvy, and I've been in your shoes. I needed to unbrick my Windows 10 home edition which doesn't ship with BitLocker... but prompts users to BitLock encrypt their drives during initial setup anyways. It's fun learning the hard way. You just need to get to the desktop to delete a file: C-00000291*.sys". Here's your solution!


You likely saw this workaround shared around. But you have Bitlocker encryption enabled? And the recovery key is somewhere? Or! You have a home edition of Windows 10/11 with Bitlocker enabled?


1. Boot Windows into Safe Mode or WRE.


2. Go to C:\Windows\System32\drivers\CrowdStrike


3. Locate and delete file matching "C-00000291*.sys"


4. Boot normally.



Here's your solution, Bitlocked buddy:


Try this BitLocker CrowdStrike Solution:

1. Start machine, and restart a few times until you cycle through enough BSODs you get the recovery screen.


2. Navigate to Troubleshoot> Advanced Options> Startup Settings


3. Select "Restart"


4. Press Esc to skip the first Bitlocker recovery key entryfield


5. Using Esc, skip again the second Bitlocker recovery key entryfield by selecting Skip This Drive in the bottom right


6. Navigate to Troubleshoot> Advanced Options> Command Prompt


7. In CMD, type "bcdedit/set {default) safeboot minimal" & hit enter.


8. Go back to the Windows Recovery’s main menu & select Continue.


9. You may need to repeat steps 1 through 8 several times to boot in to Safe Mode


10. When you get in to safe mode, log in normally.


11. Open Windows Explorer, navigate to C:\Windows \System32\drivers\Crowdstrike


12. Delete C-00000291*.sys


13. As Administrator, run CMD


14. Type "bcdedit /deletevalue (default) safeboot", then press enter.


15. Restart normally


16. Confirm normal behavior 🤞


17. Repeat as needed for every impacted system.


18. Take breaks. Drink Water. It's gonna be a long weekend.


Good luck!


Along with other wider reported outages emergency services & hospitals are being disproportionately impacted. Hope this helps get a few back online while a real fix is prepared.

Text message from hospital staff: We are effectively crippled. Had to shut the clinic down and are treating emergent symptom management in the parking garage.
Reddit post: Due to the CloudStrike outage, all non-urgent procedures and appointments are cancelled today at Mass General and Brigham. Make sure you doulbe check your appointment before going!
Major outages for 911.gov emergency services began around 9:45pm per Downdetector.com
Metrics captured July 19th 2024 at 12:20am
Some 911.gov emergency services disruptions resolved around 2am July 19th per Downdetector.com
Metrics captured July 19th 2024 10:34am
Blue Screen of Death on a Toshiba MRI machine.
MRI bricked because Windows CrowdStrike.

There ought to be a lesson learned from this situation: that critical medical equipment should use a custom hardened OS or hardened Linux version stress tested to breaking in every conceivable way, but surely no hospital administrators nor device manufacturers with power to make those decisions will learn anything today.


Setup of a dual computer workstation in an engineering lab. Windows 11 bricked. Windows XP unfazed.
Windows 11 bricked. Windows XP unfazed.

Linocut print by Featherbone of a rabbit leaping. Text reads: Be cunning and full of tricks

 
 
 

コメント


bottom of page