KB5042429: New recovery tool to help with CrowdStrike issue impacting Windows devices

As a follow-up to the CrowdStrike Falcon agent issue impacting Windows clients and servers, we have released an updated recovery tool with two repair options to help IT administrators expedite the repair process. The tool automates the manual steps in KB5042421 (client) and KB5042426 (server). Download the signed Microsoft Recovery Tool from the Microsoft Download Center. You can use the tool to recover Windows clients, servers, and Hyper-V virtual machines (VM).

There are two repair options:

Recover from Windows PE: this option uses boot media that automates the device repair.
Recover from safe mode: this option uses boot media for affected devices to boot into safe mode. An administrator can then sign in using an account with local administrative privileges and run the remediation steps.

Determine which option to use

This option to recover from Windows PE quickly and directly recovers systems and doesn't require local administrative privileges. If the device uses BitLocker, you may need to manually enter the BitLocker recovery key before you can repair an affected system.

If you use a non-Microsoft disk encryption solution, refer to guidance from that vendor. They should provide options to recover the drive so that you can run the remediation script from Windows PE.

This option to recover from safe mode may enable recovery on BitLocker-enabled devices without requiring the entry of BitLocker recovery keys. You need access to an account with local administrator rights on the device.

Use this option for devices in the following situations:

It uses TPM-only protectors.
The disk isn't encrypted.
The BitLocker recovery key is unknown.

If the device uses TPM+PIN BitLocker protectors, the user will either need to enter the PIN or you need to use the BitLocker recovery key.

If BitLocker isn't enabled, then the user only needs to sign in with an account with local administrator rights.

If you use a non-Microsoft disk encryption solution, refer to guidance from that vendor. They should provide options to recover the drive so that you can run the remediation script from safe mode.

Additional considerations

Although the USB option is preferred, some devices may not support USB connections. For these situations, see the section on how to Use Preboot Execution Environment (PXE) for recovery.

If the device can't connect to a PXE network, and USB isn't an option, try the manual steps in the following articles:

KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen
KB5042426: CrowdStrike issue impacting Windows servers causing an 0x50 or 0x7E error message on a blue screen

Otherwise, reimaging the device might be a solution.

With any recovery option, first test it on multiple devices before you use it broadly in your environment.

Create the boot media

Prerequisites to create the boot media

A Windows 64-bit client with at least 8 GB of free space on which you can run the tool to create the bootable USB drive.
Administrative privileges on the Windows client from prerequisite #1.
A USB drive with a minimum size of 1 GB and no larger than 32 GB. The tool deletes all existing data on this drive and automatically formats it to FAT32.

Instructions to create the boot media

To create recovery media, from the 64-bit Windows client in prerequisite #1, use the following steps:

Download the signed Microsoft Recovery Tool from the Microsoft Download Center.
Extract the PowerShell script from the downloaded file.
Open Windows PowerShell as an administrator and run the following script: MsftRecoveryToolForCS.ps1
The tool downloads and installs the Windows Assessment and Deployment Kit (Windows ADK). This process might take several minutes to complete.
Choose one of the two options for recovering affected devices: Windows PE or safe mode.
Optionally select a directory that contains driver files to import into the recovery image. We recommend you select N to skip this step.
1. The tool imports any SYS and INI files recursively under the specified directory.
2. Certain devices, such as Surface devices, might need additional drivers for keyboard input.
1. Insert the USB drive when prompted and provide the drive letter.
2. Once the tool completes creating the USB drive, remove it from the Windows client.
Instructions to use the recovery option

If you created media in the previous steps for Windows PE, use these instructions on affected devices.

Prerequisites to use the boot media for Windows PE recovery
- You may need the BitLocker recovery key for each BitLocker-enabled and affected device.
  - If the affected device uses TPM+PIN protectors, and you don't know the PIN for the device, then you may need the recovery key.
  Instructions to use the boot media for Windows PE recovery
  1. Insert the USB key into an affected device.
  2. Restart the device.
  3. During restart, press F12 to access the BIOS boot menu.
  Note: Some devices may use a different key combination to access the BIOS boot menu. Follow manufacturer-specific instructions for the device.
  
  Note: For non-Microsoft device encryption solutions, follow any steps provided by the vendor to gain access to the drive.
  1. If BitLocker isn't enabled on the device, you may still be prompted for the BitLocker recovery key. Press Enter to skip and continue.
  If you created media in the previous steps for safe mode, use these instructions on affected devices.
  
  Prerequisites to use the boot media for safe mode recovery
  - Access to the local Administrator account.
  - If the affected device uses BitLocker TPM+PIN protectors, and you don't know the PIN for the device, then you may need the BitLocker recovery key.
  Instructions to use the boot media for safe mode recovery
  1. Insert the USB key into an affected device.
  2. Restart the device.
  3. During restart, press F12 to access the BIOS boot menu.
  Note: Some devices may use a different key combination to access the BIOS boot menu. Follow manufacturer-specific instructions for the device.
  
  Use recovery media on Hyper-V virtual machines
  
  You can use the recovery media to remediate affected Hyper-V virtual machines (VM). When you create the boot media, select the option to generate an ISO file.
  
  Note: For non-Hyper-V VMs, follow instructions provided by your hypervisor vendor to use the recovery media.
  
  Instructions to recovery Hyper-V virtual machines
  1. On an affected VM, add a DVD Drive under Hyper-V settings >SCSI Controller.
  Use PXE for recovery
  
  For most customers, the other recovery options will help restore your devices. However, if devices are unable to use the option to recover from USB, for example, because of security policies or port availability, IT admins can use PXE to remediate.
  
  To use this solution, you can use the Windows Imaging Format (WIM) image that the Microsoft recovery tool creates in an existing PXE environment. The affected devices need to be on the same network subnet as the existing PXE server.
  
  Alternatively, you can use the PXE server approach outlined below. This option works best when you can easily move the PXE server from subnet to subnet for remediation purposes.
  
  Prerequisites for PXE recovery
  1. A 64-bit Windows device that hosts the boot image. This device is referred to as the “PXE server.”
    1. The PXE server can run on any supported Windows client 64-bit OS.
    2. The PXE server should have internet access to download the Microsoft PXE tool from the Microsoft Download Center. You can also copy it to the PXE server from another system on your network.
    3. The PXE server should have inbound firewall rules created for UDP ports 67, 68, 69, 547, and 4011. The downloaded PXE tool (MSFTPXEToolForCS.exe) updates the Windows Firewall settings on the PXE server. If the PXE server uses a non-Microsoft firewall solution, create rules following their recommendations.
    Note: This script doesn't clean up the firewall rules. You should remove these firewall rules after remediation is complete. To remove these rules from the Windows Firewall, open Windows PowerShell as an administrator and run the following command: MSFTPXEInitToolForCS.ps1 clean
    
    Configure the PXE server
    1. Download the Microsoft PXE tool from the Microsoft Download Center. Extract the contents of the zip archive to any directory. It contains all of the necessary files.
    2. Open Windows PowerShell as an administrator. Change to the directory where you extracted the files and run the following command: MSFTPXEInitToolForCS.ps1
      1. The script scans for the Windows ADK and Windows PE Add-On installation on the PXE server. If they're not installed, the script installs them. To proceed with installation, review and accept the license terms.
      2. The script generates the remediation scripts and creates a valid boot image.
      3. If required, accept the prompt and provide a path containing the driver files. Driver files may be required for keyboard or mass storage devices. Generally, you won't need to add drivers. If you don't need any additional driver files, select N .
      4. You can configure the PXE server to deliver a default remediation image or a safe mode image. You'll see the following prompts:
        1. Boot to WinPE to remediate the issue. It requires entering BitLocker recovery key if system disk is BitLocker encrypted.
        2. Boot to WinPE configure safe mode and run repair command after entering safe mode. This option is less likely to require BitLocker recovery key if system disk is BitLocker encrypted.
      5. The script generates the required distribution files and provides the path where it copies the PXE server tool.
      Note: If you want to run multiple PXE servers for different subnets, copy the directory with the PXE server tool, and rerun steps 3 & 4.
      
      Additional information about PXE
      - PXE boot in Configuration Manager
      - Advanced troubleshooting for PXE boot issues
      - You want to PXE Boot? Don't use DHCP Options
      Use PXE to recover an affected device
      
      The affected device must be on the same subnet as PXE server. If the devices are in different subnets, configure IP helpers in your network environment to enable the discovery of the PXE server.
      
      If the affected device isn't configured for PXE boot, follow these steps:
      1. On the affected device, access the BIOS\UEFI menu.
        
        This action is different across different models and manufacturers. Refer to documentation provided by the original equipment manufacturer for the specific make and model of the device.
        
        Common options for accessing the BIOS\UEFI involve pressing a key like F2, F12, DEL, or ESC during the startup sequence.
        
        When you PXE boot the affected device, the behavior will depend upon whether you chose Windows PE or safe mode recovery media for the PXE server.
        
        For more information on these options, see the additional steps to use the Windows PE or safe mode recovery options.
        
        For the Windows PE recovery option, the user is prompted to boot to Windows PE and the remediation script runs automatically.
        
        For the safe mode recovery option, the device boots to safe mode. The user needs to sign in with the local Administrator account and manually run the script.
        
        In safe mode and signed in as the local Administrator, open Windows PowerShell as an administrator.
        
        Run the following commands:
        del %SystemRoot%\System32\drivers\CrowdStrike\C-00000291*.sys
        bcdedit /deletevalue safeboot
        shutdown -r -t 00
        
        Once complete, restart the device normally by responding to the prompt on the screen. Access the BIOS\UEFI menu and update the boot order to remove PXE boot.
        
        Contact CrowdStrike
        
        If after following the above steps, if you still experience issues logging into your device, please reach out to CrowdStrike for additional assistance.
        
        Additional information
        
        For more information on the issue impacting Windows clients and servers running the CrowdStrike Falcon agent, see the following resources:
        
        A wide variety of Windows information is available from Windows release health (aka.ms/WRH).
        
        Detailed recovery steps are available in the following articles:
        
        KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen
        
        KB5042426: CrowdStrike issue impacting Windows servers causing an 0x50 or 0x7E error message on a blue screen
        
        Point-in-time restore for Windows 365 Enterprise
        
        Point-in-time restore for Windows 365 Business
        
        References
        Third-party information disclaimer
        The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. We make no warranty, implied or otherwise, about the performance or reliability of these products.
        
        We provide third-party contact information to help you find technical support. This contact information may change without notice. We do not guarantee the accuracy of this third-party contact information.