Microsoft has released an updated Windows recovery tool for machines impacted by the CrowdStrike Falcon update, with the new tool offering two repair options.

A CrowdStrike Falcon update brought the world to its knees, crippling systems across industries. Unfortunately, because CrowdStrike’s cybersecurity software runs at such a low level, computers that were impacted by the bad update could not even boot, making it difficult to recover from.

Microsoft outlines the two repair methods:

Recover from WinPE (recommended option)

This option quickly and directly recovers systems and does not require local admin privileges. However, you may need to manually enter the BitLocker recovery key (if BitLocker is used on the device) and then repair impacted systems. If you use a third-party disk encryption solution, please refer to vendor guidance to determine options to recover the drive so that the remediation script can be run from WinPE.

Recover from safe mode

This option may enable recovery on BitLocker-enabled devices without requiring the entry of BitLocker recovery keys. For this option, you must have access to an account with local administrator rights on the device. Use this approach for devices using TPM-only protectors, devices that are not encrypted, or situations where the BitLocker recovery key is unknown. However, if utilizing TPM+PIN BitLocker protectors, the user will either need to enter the PIN if known, or the BitLocker recovery key must be used. If BitLocker is not enabled, then the user will only need to sign in with an account with local administrator rights. If third-party disk encryption solutions are utilized, please work with those vendors to determine options to recover the drive so the remediation script can be run.

Additional considerations

Some devices may not be allowed to connect to a USB drive. In this case, it may be better to reimage the device.

Instructions for downloading and using the new recovery tool can be found here.