Microsoft has recently rolled out an enhanced Recovery Tool for the CrowdStrike issue. This PowerShell script provides two repair options and aims to assist IT administrators in expediting the resolution process for the prevalent CrowdStrike Falcon agent issue that has been affecting both Windows clients and servers.

The recovery (PowerShell with Admin privileges) steps for Windows clients, servers, and OSs hosted on Hyper-V. The two repair options are as follows:

Recover from WinPE; this option creates boot media that will assist in repairing the device.
Recover from safe mode; this option creates boot media, allowing affected devices to boot into safe mode. Users can then log in using an account with local admin privileges and perform the necessary remediation steps.

When encountering the issue, administrators had to follow a specific process to address it. This involved restarting the impacted Windows devices into Safe Mode or the Recovery Environment. Once in one of these modes, administrators would have to locate and manually remove the faulty kernel driver from the C:\Windows\System32\drivers\CrowdStrike folder.

This particular solution works well for a limited number of machines. However, manually implementing these fixes can present significant challenges when dealing with organizations with hundreds or even thousands of impacted Windows devices. It can be time-consuming, prone to errors, and complex to manage at scale.

Microsoft's specialized recovery tool is designed to automatically detect and remove the problematic CrowdStrike update from Windows devices. This tool acts swiftly to address the issue and allows the affected devices to boot up normally again, minimizing downtime and disruption for users.

Detailed instructions from the Microsoft Security Bulletin are available here: https://techcommunity.microsoft.com/t5/intune-customer-success/new-recovery-tool-to-help-with-crowdstrike-issue-impacting/ba-p/4196959

Similar:

Major Services Worldwide Disrupted by Cloud Outage: What You Need to Know and How to Fix It