PSA, repairing the Crowdstrike BSoD on Azure-hosted VMs
Hey! If you’re like us and have a bunch of servers in Azure running Crowdstrike, the past 8 hours have probably SUCKED for you! The only guidance is to boot in safe mode, but how the heck do you do that on an Azure VM??
I wanted to quickly share what worked for us:
1) Make a clone of your OS disk. Snapshot –> create a new disk from it, create a new disk directly with the old disk as source, whatever your preferred workflow is
2) Attach the cloned OS disk to a functional server as a data disk
3) Open disk management (create and format hard disk partitions), find the new disk, right click, “online”
4) Check the letters of the disk partitions: both system reserved and windows
5) Navigate to the staged disk’s Windows drive, deal with the Crowdstrike files. Either rename the Crowdstrike folder at Windows\System32\drivers\Crowdstrike as Crowdstrike.bak or similar, delete the the file matching “C-00000291*.sys”, per Crowdstrike’s instructions, whatever
From here, we found that if we replaced the disk on the server, we would get a winload.exe boot manager error instead! Don’t dismount your disk, we aren’t done yet!
6) Pull up this MS Learn doc: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/error-code-0xc000000e
7) Follow the instructions in the document to run bcdedit repairs on your boot directory. So in our case, that meant the following — replace F: and H: with the appropriate drive letters. Note that the document says you need to delete your original VM — we found that just swapping out the disk was OK and we did not need to actually delete and recreate anything, but YMMV.
bcdedit /store F:\boot\bcd /set {bootmgr} device partition=F:
bcdedit /store F:\boot\bcd /set {bootmgr} integrityservices enable
bcdedit /store F:\boot\bcd /set {af3872a5-} device partition=H:
bcdedit /store F:\boot\bcd /set {af3872a5-} integrityservices enable
bcdedit /store F:\boot\bcd /set {af3872a5-} recoveryenabled Off
bcdedit /store F:\boot\bcd /set {af3872a5-} osdevice partition=H:
bcdedit /store F:\boot\bcd /set {af3872a5-} bootstatuspolicy IgnoreAllFailures
8) NOW dismount the disk, and swap it in on your original VM. Try to start the VM.
