c:\system32\drivers\csagent.sys renaming this file on server with safe mode boot fixes the issue but disables agent
CrowdStrike Update: Windows Bluescreen and Boot Loops
31–40 of 1001 posts
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#32My entire emergency department got knocked offline by this. Really scary when you have ambulances coming in and are trying to stabilize a heart attack.
Update: 911 is down in Oregon too, no more ambulances at least.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#33Aren't they doing canary release? Seems weird this would not have been detected on a smaller scale before with a good release process.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#34[flagged]
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#35In terms of analysing risk factors to minimise something like this happening again, what are the factors at play here? A Crowdstrike update being able to blue-screen Windows Desktops and Servers. Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an operating system. This makes me think that, maybe, Crowdstrike were…
> Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an operating system.
It doesn't operate in user space, they install a kernel driver.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#36If the workstations are stuck in a boot loop, how will they be able to push a hotfix out?
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#37Uninstall the Current Version:
Open the Command Prompt as an administrator. Run the following command to uninstall the current version: shell
sc delete csagent
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#38In terms of analysing risk factors to minimise something like this happening again, what are the factors at play here? A Crowdstrike update being able to blue-screen Windows Desktops and Servers. Whilst Crowdstrike are going to cop a potentially existential-threatening amount of blame, an application shouldn't be able to do this kind of damage to an operating system. This makes me think that, maybe, Crowdstrike were…
At the end of the day, if you give an application a deep set of permissions, that's on you as an administrator, not the OS. This unchecked global rollout appears to just be a violation of every good software engineering practice we know.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#39If the workstations are stuck in a boot loop, how will they be able to push a hotfix out?
what we do is safemode the PC and then open the run CMD as admin. then issue this command. sc delete csagent. reinstall crowdstrike using previous version.
Re: CrowdStrike Update: Windows Bluescreen and Boot Loops
#40temporary fix is released