Microsoft Releases New Recovery Tool to Fix Windows Systems Hit by CrowdStrike Outage

Key Takeaways:

• Microsoft has released a Recovery Tool to quickly restore Windows machines affected by the recent CrowdStrike outage.
• The CrowdStrike bug caused a widespread IT outage, affecting around 8.5 million Windows devices globally.
• The new tool eliminates the need for manual steps to streamline the recovery process for organizations with numerous affected devices.

Microsoft has released a new Recovery Tool designed to help IT administrators quickly restore Windows machines impacted by the recent CrowdStrike outage. This tool automates the recovery process by creating a bootable USB to expedite the restoration of affected devices.

Last week, cybersecurity firm CrowdStrike released a buggy update for its Falcon security software, causing Windows systems to crash with a blue screen of death (BSOD) error message. The company confirmed that the bug doesn’t affect macOS and Linux machines. Microsoft estimates the outage impacted around 8.5 million Windows devices globally, disrupting TV networks, airlines, 911 call centers, and other businesses worldwide.

On Friday, CrowdStrike announced that it had identified the issue and rolled out an update to fix the bug that had caused the massive IT outage. Microsoft noted that some customers had to reboot their affected machines up to 15 times to apply the CrowdStrike update. However, some organizations reported that they still haven’t received the automatic update.

It’s important to note that this requires administrators to manually boot into Safe Mode and delete the corrupted file from each computer. This process can be particularly time-consuming for organizations with hundreds of affected Windows devices.

How does the CrowdStrike recovery tool work?

Microsoft’s new Recovery Tool automates the recovery process, helping users get their machines up and running again. The tool boots into the Windows PE environment via USB, accesses the machine’s disk, and automatically deletes the problematic file. This recovery option requires users to have administrative privileges and a BitLocker recovery key for each Windows PC.

Based on early feedback, Microsoft has added two new options to help users recover Windows devices using Safe Mode and Preboot Execution Environment (PXE). The Safe Mode option enables users to recover a BitLocker-enabled PC without the BitLocker recovery keys. This tool also allows users to create either a USB or ISO recovery file and fix the USB size check.

Prerequisites

Microsoft has provided step-by-step instructions and prerequisites for the new Recovery Tool. Users will need at least 8GB of free space on the affected Windows 64-bit client and a USB drive with a minimum of 1GB and a maximum of 32GB of storage. The tool will delete all the data on the USB drive, and automatically format it to FAT32.

Microsoft notes that customers can download the Recovery Tool from the Microsoft Download Center. It’s recommended to test this tool on multiple devices before using it in production environments. Microsoft also outlined troubleshooting steps to help customers recover Windows virtual machines (VMs) running on Azure, and we invite you to check out the official blog post for more details.