Primary Navigation

Fixing CrowdStrike Crash Blue Screen (A-Z Guide)

The CrowdStrike crash incident wreaked havoc on most of the world’s critical tech infrastructure, bogging down critical functions with looping bootup errors.

Fortunately, users aren’t left without options – we’ll walk you through exactly what you need to do to clear up your CrowdStrike Crash blue screen of death in no time at all!

Understanding the CrowdStrike Crash Problem

What To Do About CrowdStrike Blue Screen Of Death?

If you’ve been hit by the CrowdStrike Blue Screen of Death, kindly do the following:

    1. Interrupt your Windows bootup process by pressing and holding the power button, turning it off.

    2. Repeat this thrice to have your device open into Windows Recovery Environment (WinRE).

    3. If that doesn’t pan out, the following can be done for each particular PC brand. 

    • For Dell PCs, press F12 repeatedly when logo appears on screen. 
    • For HP PCs, press F11 once the logo appears on screen.
    • For Lenovo PCs, press F8 (or F8 + Fn) repeatedly when logo appears on screen.
    • For Asus PCs, press F9 repeatedly once you see the logo pop up.
    • For Acer PCs, press F12 the moment the Acer logo appears.

    4. Select “See Advanced Repair Options”.

    5. Navigate to “Troubleshoot”, then “Advanced Options”.

    6. Tap “Startup Settings”, then “Restart”.

    7. Select Option 6 (“Enable Safe Mode with Command Prompt”)

    8. Once PC has loaded in safe mode:

  • Click on the Start button or press the Windows key.
  • Type “cmd” or “Command Prompt” in the search bar.
  • Click on Command Prompt from the search results.

     9. Navigate to the Correct Directory:

If you see C:\Users\YourName>, type the following commands and press Enter after each line:

cd \

cd windows\system32\drivers\crowdstrike

If you see C:\Windows\system32>, type the following command and press Enter:
 

cd drivers\crowdstrike

It now should look like this C:\Windows\System32\drivers\CrowdStrike>

    10. Delete the Faulty File:

In the C:\Windows\System32\drivers\CrowdStrike> directory, type the following command and press Enter:

del C-00000291*.sys

Then restart the Computer, type the following command and press Enter to restart the computer:

shutdown /r

If you do everything correctly, your command list should end up like this: 

C:\Users\YourName>cd \
C:\>cd windows\system32\drivers\crowdstrike
C:\Windows\System32\drivers\CrowdStrike>del C-00000291*.sys
C:\Windows\System32\drivers\CrowdStrike>shutdown /r

 

There’s also been another method found that involves turning off Secure Boot and Switch Storage mode from RAID to AHCI/NVMe, but we would advise against testing it.

Switching storage modes is likely to cause corruption issues with drivers, turning an otherwise inconvenient blue screen situation into an unsalvageable mess when done improperly.

What Went Wrong On CrowdStrike’s End?

On July 19, 2024, CrowdStrike released a sensor configuration update that triggered a logic error within its code. Logic errors lead to unexpected outcomes, and these flawed configuration files caused blue screens for Windows machines operating across the globe.

While CrowdStrike did attempt to roll back the update within an hour of the issue being confirmed, the damage had already been done.

Thousands of airports, hospitals, and other sites dependent on Windows machines grinding down to an unproductive standstill – it could take hours, or even days, to disseminate the change to all affected Windows devices around the world.

Is My Data Security At Risk?

The silver lining to the situation is that it has been verified that the CrowdStrike blue screen of death has been confirmed to be an internal coding oversight, and not a cyberattack of any kind.

To put it simply, the code was looping an error that prevented it from functioning altogether. Cyber-attacks can happen in a lot of different ways, but all of them need the actual system functioning to tamper with it.

While inconvenient, this development poses no risk of compromising user data to malicious third-parties.