The July 2024 CrowdStrike outage and recovery

What happened

On 19 July 2024, a CrowdStrike Falcon content update caused affected Windows systems to crash. CrowdStrike's subsequent investigation identified an out-of-bounds memory read while processing Channel File 291, rather than a modification of Windows system files. The incident report explains the cause and response.

Outage impact

The outage disrupted organisations using affected Windows machines and services that depended on them. The original CrowdStrike technical alert identified these regions:

• EU-1
• US-1
• US-2
• US-GOV-1

Source: https://supportportal.crowdstrike.com/s/article/Tech-Alert-Windows-crashes-related-to-Falcon-Sensor-2024-07-19 (login required)

Recovery for the July 2024 incident

These steps concern machines affected by the 19 July 2024 CrowdStrike incident. They are not general instructions for diagnosing a Windows boot failure. Refer to CrowdStrike's incident report and your organisation's recovery procedure.

1. Boot the affected machine into Safe Mode or the Windows Recovery Environment.
2. Locate the Windows installation. Its drive letter can differ in the recovery environment.
3. In Windows\System32\drivers\CrowdStrike, locate the affected C-00000291*.sys file identified by the incident recovery guidance and remove it.
4. Restart the machine normally.

For a Windows installation on C:, the commands are:

cd /d C:\Windows\System32\drivers\CrowdStrike
del C-00000291*.sys
shutdown /r

You may need a BitLocker recovery key and local administrator credentials. Confirm that you are working on the affected Windows installation before deleting a file.

For support, email DataSolace or use our contact form.

What to review afterwards

The incident showed how an update to widely deployed security software could disrupt many organisations at once. Review which services depend on the same systems, how affected machines would be recovered and whether staff can access the recovery information during an outage.