Microsoft has released an updated recovery tool to help IT administrators fix problems caused by the CrowdStrike Falcon agent on Windows systems. The tool offers two repair options, making it easier to address the issues on affected devices, including Windows clients, servers, and those hosted on Hyper-V.
The recovery tool can be downloaded from the Microsoft Download Center, and includes detailed instructions for both recovery methods.
Recovery Options Available
Microsoft provides two main recovery methods:
1. Recover from WinPE (Windows Preinstallation Environment)
2. Recover from Safe Mode
Recover from WinPE
This method is recommended for its efficiency and simplicity. It doesn’t require local administrator rights, making it a convenient option. However, if BitLocker is enabled, you’ll need to enter the BitLocker recovery key manually. For third-party disk encryption, follow the vendor’s instructions.
Steps for WinPE Recovery:
1. Insert the USB key into the affected device.
2. Reboot and enter the BIOS boot menu by pressing F12 (or follow the manufacturer’s instructions).
3. Select the option to boot from the USB drive.
4. Enter the BitLocker recovery key if prompted.
5. The tool will run the remediation script recommended by CrowdStrike.
6. Remove the USB drive and reboot normally.
Recover from Safe Mode
This option is useful for devices with TPM-only protectors or when the BitLocker recovery key is unavailable. It requires access to a local administrator account.
Steps for Safe Mode Recovery:
1. Insert the USB key into the affected device.
2. Reboot and enter the BIOS boot menu by pressing F12 (or follow the manufacturer’s instructions).
3. Select the option to boot from the USB drive.
4. The tool will set the machine to boot in Safe Mode.
5. Reboot into Safe Mode.
6. Run the repair.cmd script from the USB drive.
7. The tool will remove impacted files and restore the normal boot configuration.
8. Reboot the device normally.
Additional Considerations
For devices that cannot connect to a USB drive, reimaging the device might be a better solution. It’s also advisable to test the recovery steps on several devices before applying them widely.
Creating Bootable Recovery Media
To create the bootable recovery media, you’ll need:
– A Windows 64-bit client with at least 8GB of free space.
– Administrative privileges on the Windows client.
– A USB drive with 1GB to 32GB capacity (data on the USB drive will be wiped).
Steps to Create WinPE Recovery Media:
1. Download the Microsoft Recovery Tool from the Microsoft Download Center.
2. Extract the PowerShell script from the downloaded solution.
3. Run MsftRecoveryToolForCSv2.ps1 from an elevated PowerShell prompt.
4. The ADK will download and media creation will start, taking several minutes.
5. Choose to generate an ISO or USB drive and specify the drive letter.
Using Recovery Media on Hyper-V Virtual Machines
The recovery media can also fix issues on Hyper-V virtual machines. Create an ISO when making the recovery media and follow the hypervisor vendor’s instructions for non-Hyper-V VMs.
Steps to Recover Hyper-V Virtual Machines:
1. Add a DVD Drive under Hyper-V settings > SCSI Controller.
2. Add the recovery ISO as an Image file under Hyper-V settings > SCSI Controller > DVD Drive.
3. Change the boot order to move the DVD Drive to the first boot entry.
4. Start the virtual machine and boot to the ISO image.
5. Follow the WinPE or Safe Mode recovery steps as described.
6. Restore the boot order to its original settings.
7. Reboot the virtual machine normally.
Background on the CrowdStrike Falcon Agent Issue
On July 20, many Windows users experienced the Blue Screen of Death (BSOD) due to a problem with the “csagent.sys” file related to CrowdStrike’s Falcon Sensor. This caused major disruptions for users, including banks, media companies, tech firms, and airports. The Australian government confirmed it was not a cybersecurity incident and urged calm.
Conclusion
Microsoft’s recovery tool offers a crucial solution for IT administrators dealing with the CrowdStrike Falcon agent issues. By following the detailed steps and selecting the appropriate recovery method, users can restore their devices to normal operations.- Inputs from Cyber express
– Rashmi Kumari
–
