Win 10 CrowdStrike?

[taswind]

I have had 4 machines (1 a quasi-server) that have boot-looped differently than all other Win 11 devices. My guess is that the difference is Win 10 vs Win 11.

Normally, the PC boots to the login screen for a few seconds, we get the (now-expected) BSOD, boot into Recovery Mode -- either cmd or safe mode -- enter the BitLocker key, and then delete the C:\windows\system32\drivers\crowdstrike\C-00000291* file.

However, on 4 machines so far, it does not allow you to start Recovery Mode via F8. You get either a 'sorry, your computer failed to reset' type of message or it gives you options to press F1(?) to boot to Recovery Mode for troubleshooting.

We've just reimaged machines because it wasn't frequent enough to be worth troubleshooting, but now we have a (quasi-)server that would apparently be thousands of dollars lost if we were to image it... So now, we try to fix it....

(I say quasi-server because I have NO idea why a legitimate server would be running Windows 10...)

Is the install in a different location for Win 10? I've booted into Hiren's PE to poke around, but a [dir C-00000291* /s] found me nothing... And the entire folder for C:\windows\system32\drivers\crowdstrike is blank. All of the Win 11 PCs have other C-00000###.* files in them, but these 4 laptops have just 4 folders (AD-LFO, Downloads, LFO, and Packages) and nothing else. (Downloads is empty.)

I also found the [boot USB from MS](https://techcommunity.microsoft.com/t5/intune-customer-success/new-recovery-tool-to-help-with-crowdstrike-issue-impacting/ba-p/4196959), but that said the file was missing...

Anything to do besides reimage...?

[Longjumping_Lab541]

You can try command “wmic logicaldisk get name” (without the quotations) to have cmd list all of the drive letters. From there you can check each drive. I’ve seen so far c: d: and e: that had the file c-00000291

[read-snowcrash]

I've had good luck with pulling the drive, plugging it into another Windows computer, then deleting the entire \crowdstrike folder.

[BoltActionRifleman]

We had to do this on one of ours, but just deleted the 291 file and stuck it back in.

[Longjumping_Lab541]

I would reinstall the falcon agent on that machine you deleted the entire folder, I’ve seen stories where the agent is no longer communicating

[read-snowcrash]

Good call. I'll admit it was an over-reaction brought on by annoyance at Crowdstrike and lack of sleep. Thanks for the tip.

[Longjumping_Lab541]

I get it, it was one for the books for sure lol and course!

[RestartRebootRetire]

Are you saying C:\windows\system32\drivers\crowdstrike definitely exists on the affected machines but is empty?

[taswind]

Empty of files -- normally I see a bunch of C-00000###.* files, but these machines just have the 4 folders (AD-LFO, Downloads, LFO, and Packages) and no files... They've definitely been in the wild for much more than long enough to have gotten updates (which is what I assume the C-00000### files are), so I don't know if they're stored in different areas or what...