iStock.com/lcva2

Microsoft Releases CrowdStrike Recovery Tool To Fix 8.5M Windows Devices

July 22, 2024

Microsoft has introduced a new recovery tool, KB5042429, aimed at resolving the issues caused by the CrowdStrike Falcon agent that impacted 8.5 million Windows devices on Friday. This tool offers two main repair options to help IT administrators streamline the recovery process:

  1. Recover from Windows PE: This option uses boot media to automate repairs, suitable for quickly restoring systems without needing local administrative privileges. It’s efficient but may require the BitLocker recovery key for encrypted devices.
  2. Recover from safe mode: This option also uses boot media but boots the affected devices into safe mode. Administrators can then log in with local administrative privileges to manually run remediation steps.

To use these options, IT admins must create bootable media, either on a USB drive or as an ISO file for Hyper-V virtual machines. The tool guides users through creating this media from a Windows 64-bit client with administrative privileges.

For environments where USB or safe mode recovery isn’t feasible, the tool supports PXE (Preboot Execution Environment) recovery. This method requires setup on a Windows device acting as a PXE server, allowing affected devices to boot over the network for remediation.


Overall, Microsoft’s new recovery tool offers flexible solutions to mitigate the impact of the CrowdStrike issue, emphasizing ease of use and thorough testing before broad deployment across enterprise environments.

Originally, the global tech outage occurred on Friday due to a faulty software update from cybersecurity firm CrowdStrike, impacting airports, Social Security offices, jails, and other businesses using Microsoft devices. The issue arose from an interaction between CrowdStrike’s update and Microsoft Windows, affecting numerous Fortune 500 companies. Experts, including Munish Walther-Puri, highlighted the risks of relying heavily on a few cybersecurity providers.

Costin Raiu underscored the vulnerability of interconnected cloud systems to such incidents. The event sparked calls for improved digital resilience and policy measures. Despite CrowdStrike and Microsoft deploying a fix, affected machines remain problematic, with IT admins facing challenges in resolving issues, particularly in cloud-based and remotely deployed systems.


Recent News