Microsoft Rolls Out Recovery Tool to Help Fix Windows PCs Affected by CrowdStrike Update

Microsoft has released a USB recovery tool to repair PCs and other machines impacted by the infamous CrowdStrike update, the company announced in a blog post. A bootable USB drive can be created using which IT admins can expedite the repair process and get disrupted devices back on track. Notably, CrowdStrike previously revealed that its faulty update for Falcon Sensor impacted nearly 8.5 million Windows devices globally, bringing up the dreaded ‘blue screen of death' (BSOD).

Microsoft's Recovery Tool

In a blog post under the ‘Intune Customer Success' section, Microsoft published an updated recovery tool with two repair options: recover from WinPE and recover from Safe Mode. The signed tool is available for download in the Microsoft Download Centre.

As per the company, the recover from WinPE option gives users a chance to recover their machines without requiring local admin privileges. However, it they have enabled BitLocker, then entering the BitLocker key may be mandatory to repair the impacted system. Microsoft says this option is recommended for most users.

On the other hand, if users do not have access to their BitLocker key, they can use the recover from Safe Mode option. It allows them to boot the Windows PC into safe mode. However, it will require them to login to the device with local admin privileges. Microsoft says this approach is only recommended for machines which are not encrypted or whose BitLocker key is unknown.

If the device does not allow connection of USB devices, it is better to image it, as per the company.

The USB drive which is to be created into a bootable recovery drive needs to have a minimum and maximum storage space of 1GB and 32GB respectively. Furthermore, the PC needs to run on a Windows 64-bit client. Microsoft says it must have at least 8GB of free space to run the recovery tool.

What Happened

Microsoft's new recovery tool aims to fix Windows PCs and servers affected by the CrowdStrike Falcon Sensor update. It was released on Friday and was shortly followed by reports of Windows PCs around the world being affected by the BSOD. It impacted Microsoft services including Azure, Store, and Office 365.

According to media reports, it disrupted services across institutions such as banks, airports, and IT companies. Airlines around the world cancelled or rescheduled their flights, citing “technical problems”. Furthermore, media outlets Australia's ABC News also claimed to be affected by the update.

CrowdStrike CEO George Kurtz issued a statement, revealing its cause to be a “defect in a single content update” for the Windows platform. It did not appear to impact devices running Linux or Mac.