Microsoft USB Rescuer: Aid for CrowdStrike Failure Victims

Microsoft released a tool for system administrators to simplify the process of eliminating the “BSOD” on computers running Windows 10 and 11. The issue was caused by an incorrect update of the Crowdstrike software. The solution involves using a bootable USB drive and a special script named MSFTRECOVERYTOOLFORCS.ps1.

Prior to this tool release, Crowdstrike had issued a patch to address a logical error that resulted in numerous BSOD occurrences. However, many computers were unable to automatically receive this fix due to their non-operational state.

Recovering the functionality of IT systems affected by the Crowdstrike error in Windows could typically take weeks. System administrators were required to manually restore PCs, servers, and laptops as remote connections were disabled. Safe mode and specific commands or registry work were necessary for the recovery process.

Microsoft Recovery Tool streamlines this recovery process by bypassing the manual booting into safe mode and the manual removal of the problematic Crowdstrike update file. It simplifies the recovery using Windows PE via a USB drive. The tool gains access to the affected computer’s disk and automatically removes the problematic Crowdstrike file, enabling the device to boot correctly.

This method offers the advantage of not requiring safe mode boot or administrator privileges on the computer. The tool interacts directly with the disk, without loading a local Windows copy. In cases where the disk is encrypted with Bitlocker, the Microsoft tool will prompt for a BitLocker recovery key before proceeding with the correction process.

It should be noted that the MSFTRECOVERTOOLFORCS.PS1 script may encounter some functional issues in certain instances.