How to Fix the CrowdStrike Update BSOD Issue, and What It Taught Us
The CrowdStrike blue-screen outage of 19 July 2024 was caused by a faulty Falcon sensor content update, and the fix was to boot into safe mode and delete one file, C-00000291*.sys, then restart. Microsoft estimated about 8.5 million Windows devices were affected, making it the largest IT outage in history, and it was a defective update rather than an attack. This article was written that morning as a workaround guide and is kept, updated in September 2026, both as a record of what to do if you meet a boot loop caused by a bad driver, and for the lessons it left for every small business.
What happened
Early on Friday 19 July 2024, CrowdStrike pushed a content update to its Falcon endpoint sensor. A defect in the file caused the sensor’s kernel driver to crash Windows, and because the sensor loads at boot, affected machines crashed again on every restart. Airlines, hospitals, banks and broadcasters went dark; most small businesses were spared only because they run other security products. CrowdStrike identified the problem within about an hour and withdrew the update, but every machine that had already received it needed hands-on repair, and many were in data centers or on desks a long way from the people who could do it.
The fix, as it was
Keep rebooting
Microsoft’s early guidance was to restart the computer repeatedly, up to fifteen times. Some machines picked up the corrected file before the driver crashed and recovered on their own. It worked often enough to be worth trying first.
Delete the faulty file
- Start Windows in safe mode, or from the Windows Recovery Environment open a command prompt.
- Go to the CrowdStrike directory, C:\Windows\System32\drivers\CrowdStrike.
- Delete the file matching C-00000291*.sys.
- Restart normally.
BitLocker
Safe mode and the recovery environment require the BitLocker recovery key on an encrypted drive, and this is where many businesses were stuck: the keys were in a management system that was itself down, or had never been recorded. If your computers use BitLocker, the recovery keys should be stored in Microsoft Entra ID or your management platform and exported somewhere reachable during an outage.
What it taught us
- Staged rollouts matter. Updates that reach every machine in the world within an hour can break every machine in the world within an hour. CrowdStrike now offers controlled deployment of content updates, and a good provider tests before broad release.
- Keep the recovery keys. Encryption you cannot unlock in an emergency is a lock on your own door.
- Have a manual day. Know how invoices, phones and customer service work for a day without computers. The businesses that coped best had thought about it before.
- Backups and recovery plans are not just for ransomware. Our disaster recovery plan guide covers a vendor outage as one of the scenarios.
- Match the tool to the business. CrowdStrike is built for large enterprises. Most businesses with fewer than a few hundred employees are better served by a lighter alternative with a managed response team, which is what we run: SentinelOne with Huntress, on our published rates.
If you are looking at a Windows machine stuck in a boot loop today, the method above, safe mode and remove the offending driver or update, still applies whatever caused it, and our IT support team can walk you through it or come to you.
Free tools from OAC Technology
- Managed services pricing calculator: a monthly figure for managed IT, in about a minute
- How much managed IT services cost: our published per-device rates and three worked examples
- What to expect as a client: how onboarding works, week by week
Common questions
What caused the CrowdStrike blue screens in July 2024?
A faulty content update to the CrowdStrike Falcon sensor, released on 19 July 2024, caused Windows computers running it to crash on boot. Microsoft estimated about 8.5 million Windows devices were affected. It was a defective update, not an attack, and it did not affect Mac or Linux machines.
How was it fixed?
By starting Windows in safe mode or the recovery environment and deleting the faulty channel file, named C-00000291*.sys, from the CrowdStrike directory, then rebooting normally. CrowdStrike later released tooling to automate it. Computers with BitLocker needed the recovery key first.
Is the fix still needed?
No. Any machine still affected was repaired long ago, and CrowdStrike changed how it tests and rolls out content updates afterwards. The steps are kept here because the same recovery method, safe mode plus removing a bad driver or update, applies to other boot failures.
What should a small business have learned from it?
Keep BitLocker recovery keys where you can reach them in an outage, keep a tested backup, know how you would work for a day without computers, and prefer security tools whose updates roll out in stages. None of those are specific to CrowdStrike.
Is CrowdStrike still a good choice?
It remains a strong enterprise product. For businesses under a few hundred employees it is usually more than they need and more than they want to pay, which is why we deploy SentinelOne with Huntress managed response instead; our comparison of alternatives explains the reasoning.
Talk to us
Call 952-548-5558 or contact us; the first conversation is free and there is no long-term contract.
