Microsoft outage?

[The_Mowgs]

Is crowdstrike baked into Windows then? Or is it windows users that use crowdstrike?

All Windows devices which has Crowdstrike EDR installed. Capitec also affected. If the Vodacom servers which is running e-filing have CS installed it is going to be a fun day.

 

[Paul Kemp]

Aren't you in UK? Why up and about so early

I’m one of those horrible morning people.

 

[gregmcc]

Aren't you in UK? Why up and about so early

It's 7:48 - that's not early

 

[maumau]

I’m one of those horrible morning people.

Oh tks, but eeeeek

 

[SAguy]

• Tell whole company there is global microsoft "outage"
• People panicking and asking infrastructure team if they can come into the office to get it fixed asap because they need to work

 

[gregmcc]

Might be the worlds biggest DDoS

Hospitals, banks, media, airlines hit by major IT outage

Cyber-security firm Crowdstrike said its update had caused the problem on computers running Windows.

www.bbc.co.uk

 

[maumau]

It's 7:48 - that's not early

Oh yes, forgot you're also in UK . Early to be working though?

 

[SAguy]

It’s a leap year, had to be down for a day otherwise it would be Microsoft 366 this year

 

[Jan]

https://www.reddit.com/r/crowdstrike/comments/1e6vmkf/bsod_error_in_latest_crowdstrike_update

 

[blunt]

yep, wife works for a large company in UK and their systems are down

 

[LCBXX]

CrowdStrike low-key protesting Lewis Hamilton's move to Ferrari next year?

 

[Kosmik]

We seem fine but majority of VMs are bare bones linux and the azure services are barebone app and functions, all seem fine.

Some headaches with MS auth though.

 

[mjzar]

https://www.reddit.com/r/sysadmin/comments/1e6vq04/many_windows_10_machines_blue_screening_stuck_at

 

[Creag]

We're affected. Down all morning. My laptop loops a blue screen and then switches off. At least we are being kept informed by SMS.

 

[gregmcc]

Going to be a bad day.

 

[SAguy]

I wonder if I should check in with my crowdstrike account manager, shame

 

[SAguy]

So hear me out. If this is causing BSOD, then even if CS fixes the issue - how will it get deployed to endpoints.
Unless they have Microsoft supporting them and helping to find a way to fix this without us having to fix every single machine in safe mode or something

 

[gregmcc]

Will have to boot into rescue mode and apply the fix when CS release it. That's going to be a long and slow process.

I can't imagine there will be some way to script this as the machine is not reachable over the network.

 

[Jan]

So hear me out. If this is causing BSOD, then even if CS fixes the issue - how will it get deployed to endpoints.
Unless they have Microsoft supporting them and helping to find a way to fix this without us having to fix every single machine in safe mode or something

This is what I'm thinking.

Right now the workaround means some poor techie needs to hit every machine, Safe Mode, hit the CrowdStrike drivers directory, delete some files, reboot, confirm fix, rince-repeat

 

[SAguy]

https://www.reddit.com/r/crowdstrike/comments/1e6vmkf/bsod_error_in_latest_crowdstrike_update

CrowdStrike Engineering has identified a content deployment related to this issue and reverted those changes.

Workaround Steps:

1. Boot Windows into Safe Mode or the Windows Recovery Environment
2. Navigate to the C:\Windows\System32\drivers\CrowdStrike directory
3. Locate the file matching “C-00000291*.sys”, and delete it.
4. Boot the host normally.