Global BSOD

[Rroff]

No, it's showing in BIOS but not in diskpart.

Is the recovery/system partition not on the same disc?

 

[visibleman]

Does anyone know how I can force BitLocker to prompt for a drive key for unlocking? Currently the machines are going straight to the CMD window without prompting to unlock the C: drive, and the drive is then invisible within the CMD window.

TIA

Are you booting into WinRE, as you will be prompted for the systems BitLocker key? Once unlocked, use CMD from there.

Alternatively, try the reboot method of fixing CrowdStrike, ie - make sure CrowdStrike will push the latest update and then reboot the system up to 15 times. If the network stack stays up long enough then the agent should download the latest update.

Alternatively i would be looking on CrowdStrike support portal, and/or phoning your rep, as i believe they have a dedicated page with instructions on fixes.

 

[Murphy]

At least Windows robust recovery system allowed people to rollback to a known good state.

 

[Rroff]

At least Windows robust recovery system allowed people to rollback to a known good state.

Personally I've a somewhat perverse amusement from the whole situation as it is just a glimpse of what can happen when things I've railed against in this context are ignored.

 

[Vanquish-Storm]

Question is still why the likes of the NHS, or their cloud provider, are updating without clean room testing - let's see the list of hi-tech companies that weren't impacted , like ours.

It was forced down by crowdstrike I believe. Didn’t get the option to test.

 

[Ogoshi]

its only common practice for companies running waffer thin IT departments. I work in Pharma and my compnay was totally unaffected because we don't just blindly accept all security updaters. All updates get rinsed in snadbox first using clones of our production encironments ebfore anyone even thinks about signing off approvals to push to production. the reaosn its such a big problem is becuase of a combination of greed and laziness. A lot of big corporations don't bother even sandboxing windows updates and jsut let them get auto pushed to live environments for the sole reason that its cheap and easy. Why pay for someone to look at testing something that comes from a big multinational conglomorate ?????

Presumably this doesn’t happen at significant pace, and you then end up exposed to the latest security threats while your AV and any other software goes unpatched?

 

[Nemiyen]

I usually find that Windows updates are tested in a dev environment or on a few "noddy" servers but AV updates to definitions or pro active threat systems are just left to their own devices. I've never liked this myself and is why the AV definitions for my OT systems are done manually.

All of our office systems don't use Crowdstrike (thank God!) but we do have S1 and have had a few others in the past and I expect it could have the same impact if there's a bad update pushed out.

 

[Dirk Diggler]

Is the recovery/system partition not on the same disc?

I think so, BIOS is password locked so we might need to wait for an engineer to arrive as they won't share the password (understandable, TBF). I'm just trying to get some machines up and running over the weekend and into the start of the week.

The Win10 boxes are prompting for BitLocker so I'm getting them done, but the Win11 machines are gubbed.

 

[Sinbad2000]

Can't remember the brand now, but I had a 3rd antivirus update many years that caused Windows to go into a boot loop after an update to it, had to enter safe mode and remove it in order to get Windows to boot normally. Quite a few things can cause this but they really shouldn't be allowed to if its possible. It is a bit worrying that if my Avast AV did a really bad update then my OS could be bricked on reboot that even safe mode may not easily get me out of. If MS has to significantly lock down parts of the OS in order to prevent any old 3rd party programs breaking the OS this easily then it really needs to be done.

McAfee.

Same CEO, btw.

 

[Sinbad2000]

It was some file full of zeroes, some basic automated testing should have caught this:

https://twitter.com/i/web/status/1814299095261147448

Nope. That's most likely the "updated" file pushed by Crowdfail.
Other researches have posted content of the actual file.

 

[MadMossy]

Seen this in the news, the irony that a cyber security company is actually the bigger threat to cyber security makes me laugh.

 

[Raiden85]

Seen this in the news, the irony that a cyber security company is actually the bigger threat to cyber security makes me laugh.

They've caused more damage than the criminals they are protecting against