4 ms·

Crowdstrike Falcon sensor issue crashes Windows hosts worldwide

35 points by withinrafael 2y ago

dreamlvr1989 2y ago
is this due to a product update ? this cant be due to a signature update
gnabgib 2y ago
Related live HN discussion Windows Bluescreen and Boot Loops (update: caused by a Crowdstrike update) (41 points, 22 minutes ago) https://news.ycombinator.com/item?id=41002195 https://news.ycombinator.com/item?id=41002195
withinrafael 2y ago
At time of submission, the official Tech Alert (TA) [1] states: > CrowdStrike is aware of reports of crashes on Windows hosts related to the Falcon Sensor. Symptoms include hosts experiencing a bugcheck\blue screen error related to the Falcon Sensor. Our Engineering teams are actively working to resolve this issue and there is no need to open a support ticket. Status updates will be posted below as we have more information to share, including when the issue is resolved. [1] https://supportportal.crowdstrike.com/s/article/Tech-Alert-Windows-crashes-related-to-Falcon-Sensor-2024-07-19 https://supportportal.crowdstrike.com/s/article/Tech-Alert-W...
deleted 2y ago
[deleted]
jdleel 2y ago
This is very serious.
- guidedlight 2y ago
  However our internal support ticket says that Crowdstrike have provided a fix which is already being rolled out. I don't have any details.
  - edren3 2y ago
    internally or globally?
ramjane01 2y ago
Does renaming the file C-00000291*.sys also works
- aenis 2y ago
  It does, but it is not clear whether the thing still works. The machines we treated to this workaround boot and work ok, but appear as 'offline' in the CS host management console. The updates from CS are very vague at this point.
vijuvijustar 2y ago
is there a fix ? servers , hosts everthing is down
vijuvijustar 2y ago
is there a fix , more than 12000 pcs are affected
dreamlvr1989 2y ago
is this due to a crowdstrike version change?
mozaka 2y ago
This is the fix: Current fix is to boot into safe mode and change the name of the CrowdStrike folder in c:\windows\system32\drivers\Crowdstrike Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally.
- ramjane01 2y ago
  This is manual method how to do it in one go for whole organisation
  - asdfaoeu 2y ago
    I think that is the method.
atulhadke007 2y ago
Mozaka ,by said steps ,Is this worked?pls confirm
ramjane01 2y ago
This is a manual method how to do in in one go
_lvbh 2y ago
If this causes a blue screen on login/boot, it’s hard for me to see a way to deploy a fix organization-wide since it doesn’t really give time for remediation to run before the crash. I’ve never been part of a large org before; is this common & how far down does management software go? (As in can it be run before crowdstrike starts) P.s. There is a surprisingly high number of newly created accounts posting unhelpful/repetitive comments here. Wonder what’s going on
Shaney02005 2y ago
lol am i glad that i never have such a system as that on my pc directely . i dont use cloudstrike i know how stupid bluescreen caused by security systems are . i use a firewall in a different and security in a different way nowadays due to blue screen problems of older firewalls/virus programs . if in ur home u have more then one pc/tablet/laptop etc , use a small pc(for pro,s just use a server pc) as ur main Firewall carrier , and let urself or someone else with the knowledge instal that pc and make sure its connected to only ur own devices it can scan ur pcs internet traffic via ur own local network , on ur own laptoptablet , usea simpler virus scanner just in case ur not at home to scan when on vacation etc(just free one) then its better , cause if the pc carrying the firewall crashes non pc in the network is actually affected by it , only security is down , and btw Windows software is not really good in seeying such a firewall system
- MisterASCII 2y ago
  [dead]
LancePereira 2y ago
Temp workaround Can confirm the below stops the BSOD Loop Go into CMD from recovery options change to C:\Windows\System32\Drivers Rename Crowdstrike to Crowdstrike_Fucked Start windows Its not great but at least that means we can get some windows back..
atulhadke007 2y ago
Can anyone share which version is impacted crowdstrike?
Torz 2y ago
[dead]
taltay123 2y ago
https://stackoverflow.com/questions/78768073/your-device-ran-into-problem-and-needs-to-restart https://stackoverflow.com/questions/78768073/your-device-ran...
nsjolj 2y ago
[flagged]
ramjane01 2y ago
How to delete this file in cloud servers in azure and aws
ramjane01 2y ago
How to delete this file in cloud servers in azure and aws
nlasdhl 2y ago
[dead]
AnnaW213 2y ago
someone has already found the cause of this problem :) https://www.instagram.com/reel/C9mkHPktdKO/ https://www.instagram.com/reel/C9mkHPktdKO/
anonim333eu 2y ago
someone has already found the cause of this problem :) https://www.instagram.com/reel/C9mkHPktdKO/ https://www.instagram.com/reel/C9mkHPktdKO/
ybarragan 2y ago
Can't get passed the blue screen I have tried rebooting then turning back on holding windows key and R at the same time and still nothing. any recommendations

35 points by withinrafael 2y ago

dreamlvr1989 2y ago

is this due to a product update ? this cant be due to a signature update

Related live HN discussion Windows Bluescreen and Boot Loops (update: caused by a Crowdstrike update) (41 points, 22 minutes ago) https://news.ycombinator.com/item?id=41002195 https://news.ycombinator.com/item?id=41002195

withinrafael 2y ago

At time of submission, the official Tech Alert (TA) [1] states: > CrowdStrike is aware of reports of crashes on Windows hosts related to the Falcon Sensor. Symptoms include hosts experiencing a bugcheck\blue screen error related to the Falcon Sensor. Our Engineering teams are actively working to resolve this issue and there is no need to open a support ticket. Status updates will be posted below as we have more information to share, including when the issue is resolved. [1] https://supportportal.crowdstrike.com/s/article/Tech-Alert-Windows-crashes-related-to-Falcon-Sensor-2024-07-19 https://supportportal.crowdstrike.com/s/article/Tech-Alert-W...

deleted 2y ago

[deleted]

jdleel 2y ago

This is very serious.

guidedlight 2y ago
However our internal support ticket says that Crowdstrike have provided a fix which is already being rolled out. I don't have any details.
- edren3 2y ago
  internally or globally?

ramjane01 2y ago

Does renaming the file C-00000291*.sys also works

aenis 2y ago
It does, but it is not clear whether the thing still works. The machines we treated to this workaround boot and work ok, but appear as 'offline' in the CS host management console. The updates from CS are very vague at this point.

vijuvijustar 2y ago

is there a fix ? servers , hosts everthing is down

vijuvijustar 2y ago

is there a fix , more than 12000 pcs are affected

dreamlvr1989 2y ago

is this due to a crowdstrike version change?

mozaka 2y ago

This is the fix: Current fix is to boot into safe mode and change the name of the CrowdStrike folder in c:\windows\system32\drivers\Crowdstrike Workaround Steps: 1. Boot Windows into Safe Mode or the Windows Recovery Environment 2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys”, and delete it. 4. Boot the host normally.

ramjane01 2y ago
This is manual method how to do it in one go for whole organisation
- asdfaoeu 2y ago
  I think that is the method.

atulhadke007 2y ago

Mozaka ,by said steps ,Is this worked?pls confirm

ramjane01 2y ago

This is a manual method how to do in in one go

_lvbh 2y ago

If this causes a blue screen on login/boot, it’s hard for me to see a way to deploy a fix organization-wide since it doesn’t really give time for remediation to run before the crash. I’ve never been part of a large org before; is this common & how far down does management software go? (As in can it be run before crowdstrike starts) P.s. There is a surprisingly high number of newly created accounts posting unhelpful/repetitive comments here. Wonder what’s going on

Shaney02005 2y ago

lol am i glad that i never have such a system as that on my pc directely . i dont use cloudstrike i know how stupid bluescreen caused by security systems are . i use a firewall in a different and security in a different way nowadays due to blue screen problems of older firewalls/virus programs . if in ur home u have more then one pc/tablet/laptop etc , use a small pc(for pro,s just use a server pc) as ur main Firewall carrier , and let urself or someone else with the knowledge instal that pc and make sure its connected to only ur own devices it can scan ur pcs internet traffic via ur own local network , on ur own laptoptablet , usea simpler virus scanner just in case ur not at home to scan when on vacation etc(just free one) then its better , cause if the pc carrying the firewall crashes non pc in the network is actually affected by it , only security is down , and btw Windows software is not really good in seeying such a firewall system

MisterASCII 2y ago
[dead]

LancePereira 2y ago

Temp workaround Can confirm the below stops the BSOD Loop Go into CMD from recovery options change to C:\Windows\System32\Drivers Rename Crowdstrike to Crowdstrike_Fucked Start windows Its not great but at least that means we can get some windows back..

atulhadke007 2y ago

Can anyone share which version is impacted crowdstrike?

Torz 2y ago

[dead]

taltay123 2y ago

https://stackoverflow.com/questions/78768073/your-device-ran-into-problem-and-needs-to-restart https://stackoverflow.com/questions/78768073/your-device-ran...

nsjolj 2y ago

[flagged]

ramjane01 2y ago

How to delete this file in cloud servers in azure and aws

ramjane01 2y ago

How to delete this file in cloud servers in azure and aws

nlasdhl 2y ago

[dead]

AnnaW213 2y ago

someone has already found the cause of this problem :) https://www.instagram.com/reel/C9mkHPktdKO/ https://www.instagram.com/reel/C9mkHPktdKO/

anonim333eu 2y ago

someone has already found the cause of this problem :) https://www.instagram.com/reel/C9mkHPktdKO/ https://www.instagram.com/reel/C9mkHPktdKO/

ybarragan 2y ago

Can't get passed the blue screen I have tried rebooting then turning back on holding windows key and R at the same time and still nothing. any recommendations