Microsoft Releases CrowdStrike Recovery Tool, Admits BSOD Issue Affected 8.5 Million Windows Devices

Microsoft has released an official Recovery Tool that allows developers and system administrators to quickly recover computers affected by the CrowdStrike attack. While there is already a step-by-step solution that resolves the Blue Screen of Death (BSoD) issue, manually resolving the issue can take a long time, especially if only a few people know about it or are authorized to do so. Meanwhile, some organizations will have to deal with hundreds, if not thousands, of affected computers.

The CrowdStrike patch that caused a massive IT outage last Thursday was installed remotely and rolled out to those affected via an automatic update. However, fixing the problem it caused can only be done by a user working directly on the affected machine, meaning thousands of IT staff will be working overtime this week to try to fix the problem.

Microsoft estimates that more than 8.5 million Windows computers have been affected by the update and has already dispatched staff to help customers fix the problem. The Redmond company has also worked directly with CrowdStrike, as well as other enterprise vendors like Google Cloud Platform and Amazon Web Services, to find the most effective approaches to fixing all affected computers.

While the software giant says the 8.5 million figure is less than 1% of all Windows computers worldwide, it has still had a significant impact on thousands of organizations and critical infrastructure around the world. In addition to impacting airports and airlines, media organizations like the BBC, hospitals, and even the 911 hotline in several states were offline for hours after the rogue update disabled their systems.

For those unfamiliar, CrowdStrike is a security solutions provider and an alternative to Microsoft’s own enterprise-grade Microsoft Defender for Endpoint. Since these security programs operate at the kernel level, a kernel-level error means your computer can become unresponsive and crash. However, restarting won’t fix the problem, as the problem will still occur at the same point after you restart your computer.

Microsoft provides a set of prerequisites and step-by-step instructions for using the new Recovery Tool. For example, you’ll need at least 8 GB of free space on the affected computer. You’ll also need administrator privileges, a BitLocker recovery key for all computers using BitLocker encryption, and a bootable USB drive of at least 1 GB. It’s also helpful to tell users how to download and prepare a USB drive and how to enter Safe Mode to recover their system. After doing so, the computer can restart as if nothing had happened.

Microsoft’s announcement regarding the CrowdStrike issue focuses on the steps the company is taking to help its customers fix the problem. However, we can’t help but notice that the software giant is casting a shadow over CrowdStrike. Microsoft said, “CrowdStrike helped us develop a scalable solution that will help Microsoft’s Azure infrastructure accelerate remediation of the flawed CrowdStrike update.” It added, “It’s also a reminder of how important it is for all of us in the technology ecosystem to prioritize safe deployment and disaster recovery using existing mechanisms.”

This massive IT outage has shown us how vulnerable our systems are when we rely on just a few vendors. This random error has caused massive inconvenience worldwide and millions of dollars in lost productivity. How much more damage could malicious actors do if they managed to gain access to these channels?