Awareness – Windows Based Machines Issue

Queue Associates and all Microsoft Solutions Partner community members have been notified of a significant issue affecting Machines running Windows Client and Windows Server with the CrowdStrike Falcon agent. This issue may cause VMs to encounter a bug check (BSOD – Windows crash screen) and become stuck in a restarting state. The problem began at 04:09 UTC on July 18, 2024, when the update started rolling out.

Recovery Options: Microsoft’s Recommendations

For Azure Based Systems

• Restart: Multiple restarts (up to 15) may be required for recovery: Azure VM Restart Guide
• Restore from Backup: Preferably from before 04:09 UTC on July 18: Azure VM Backup Restore Instructions
• Repair OS Disk: Attach the OS disk to a repair VM and delete the faulty file.
  • Path: Windows/System32/Drivers/CrowdStrike/C00000291*.sys
  • OS Disk Repair Instructions

For On Premise Systems

• Boot Windows into Safe Mode or the Windows Recovery Environment
• Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
• Locate the file matching “C-00000291*.sys” and delete it.
• Boot the host normally.

Queue Associates’ Support

Queue Associates, a leading global Microsoft Solutions Partner with over 30 years of expertise, is here to support our clients and others utilizing Microsoft services through this issue. If you encounter problems, please reach out to us for assistance. Stay updated with the latest information from Microsoft and CrowdStrike.

For more details, visit the Microsoft Azure Status page.