5 ms·

Naive question, if it’s a blue screen of death with a boot loop, how are they going to restore things? Don’t tell me the answer is going to every system manuall

Naive question, if it’s a blue screen of death with a boot loop, how are they going to restore things? Don’t tell me the answer is going to every system manually.

chgs 2y ago
Go to every system manually, boot to safe mode, rename the sys files, run a fix. Easier to just rebuild from the image. For every windows machine your company has. lol.
CaliforniaKarl 2y ago
Lots of systems (not all) are able to reboot, and have CrowdStrike download the fix before the bad code is able to crash things. But otherwise, yes, you have to go to systems manually.
ogurechny 2y ago
Well, it seems that Windows is not yet accessible remotely when it crashes. If system administrator had too much free time, and configured every system to probe network on booting, and there is no encryption, it is possible to boot from a minimal Linux image with a script that automatically renames the driver and restarts. The corporate version of the same approach uses Intel AMT (or however else it is called), but it is only available on licensed hardware from big suppliers. Otherwise, you can distribute flash drives with the same auto-executing fix to everyone who is able to enter firmware setup, and boot from USB. If it's not available for security reasons, more manual work is required. But what happens next? If Crowdstrike handled all the security measures, and there was no additional firewall rules, address checks, and so on, your network is now as open as it can be. I suppose certain groups have been celebrating, and uploading gigabytes of data from networks whose detection systems became severed.
misswaterfairy 2y ago
Going to every system manually, then delete a file via command line in Windows' recovery environment.
muixoozie 2y ago
Remote access control (e.g. iDRAC) or physical access.

5 ms·

Naive question, if it’s a blue screen of death with a boot loop, how are they going to restore things? Don’t tell me the answer is going to every system manuall

by shubhamjain 2y ago

Naive question, if it’s a blue screen of death with a boot loop, how are they going to restore things? Don’t tell me the answer is going to every system manually.

chgs 2y ago
Go to every system manually, boot to safe mode, rename the sys files, run a fix. Easier to just rebuild from the image. For every windows machine your company has. lol.
CaliforniaKarl 2y ago
Lots of systems (not all) are able to reboot, and have CrowdStrike download the fix before the bad code is able to crash things. But otherwise, yes, you have to go to systems manually.
ogurechny 2y ago
Well, it seems that Windows is not yet accessible remotely when it crashes. If system administrator had too much free time, and configured every system to probe network on booting, and there is no encryption, it is possible to boot from a minimal Linux image with a script that automatically renames the driver and restarts. The corporate version of the same approach uses Intel AMT (or however else it is called), but it is only available on licensed hardware from big suppliers. Otherwise, you can distribute flash drives with the same auto-executing fix to everyone who is able to enter firmware setup, and boot from USB. If it's not available for security reasons, more manual work is required. But what happens next? If Crowdstrike handled all the security measures, and there was no additional firewall rules, address checks, and so on, your network is now as open as it can be. I suppose certain groups have been celebrating, and uploading gigabytes of data from networks whose detection systems became severed.
misswaterfairy 2y ago
Going to every system manually, then delete a file via command line in Windows' recovery environment.
muixoozie 2y ago
Remote access control (e.g. iDRAC) or physical access.