Fix the CrowdStrike BSOD on Windows (July 2024)

  1. Boot into Safe Mode or the Windows Recovery Environment (after a few failed boots: Troubleshoot > Advanced options > Command Prompt). If the disk is encrypted, you will need the BitLocker recovery key.
  2. Go to C:\Windows\System32\drivers\CrowdStrike.
  3. Delete the file matching C-00000291*.sys.
  4. Restart normally.

From the command prompt (in WinRE the system drive may not be C:, check with dir):

del C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys

For VMs that don't boot at all, attach the disk to another VM, delete the file and attach it back.

More info: CrowdStrike remediation hub.

Written by Daniel Ruiz Peláez, Systems & Infrastructure Engineer (Linux, VMware, Proxmox, Active Directory, networking and security). These are notes from real problems I have solved.

← Back to all posts