KB5042426: CrowdStrike issue impacting Windows servers causing an 0x50 or 0x7E error message on a blue screen

Berlaku Untuk

Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server, version 23H2

For information about this issue with CrowdStrike on Windows endpoints (clients), see KB5042421.

Summary

Microsoft has identified an issue impacting Windows Servers hosted on-premises that are running the CrowdStrike Falcon agent. These servers might encounter error messages 0x50 or 0x7E on a blue screen and experience a continual restarting state.

We have received reports of successful recovery from some customers attempting multiple restart operations on affected Windows servers.

We are working with CrowdStrike to help provide customers with the most up-to-date remediation steps to resolve this issue. Please check back for updates on this ongoing issue.

Resolution

Important

We have released a USB tool to help automate this manual repair process. For more information, see New recovery tool to help with CrowdStrike issue impacting Windows devices.

To resolve this issue, follow these instructions for your Windows server environment.

Hyper-V hosts
Physical servers

To mitigate this issue on VMs hosted on Hyper-V hosts, follow these steps:

IMPORTANT To complete the following steps, you must have a recovery image saved on a DVD.

Power off the affected server from the Hyper-V Management console. Right-click the VM and then click Settings.
Under IDE controller in the left navigation pane, click DVD Drive and then click Browse to select the Windows Server OS ISO. The ISO should be of the same Windows version as the affected server.
Once the ISO is loaded, click BIOS in the left navigation pane and then move CD to the top of the Startup order in the right-side pane.
Start the VM from the console and then press any key once you are on the Press any key to boot from CD or DVD screen. This starts the VM into Windows Pre-Installation Environment.
On the Windows Setup screen, click Next and then click the Repair your computer option.
On the Choose an option screen, click Troubleshoot and then click Command prompt.
If your System drive is different than C:\, type C: and then press Enter. This will switch you to the C:\ drive.
Type the following command and then press Enter:

Note

CD C:\Windows\System32\drivers\CrowdStrike

Note In this example, C is your system drive. This will change to the CrowdStrike directory.
Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, type the following command and then press Enter:

Note

dir C-00000291*.sys
Permanently delete the file(s) found. To do this, type the following command and then press Enter:

Note

del C-00000291*.sys
Restart your device.

To resolve this issue on Physical servers, follow the steps in the following methods.

Note

In the following methods, we use the Dell iDRAC remote management console. For example, access the Remote Management Interface for the affected server. This might be different for each vendor depending on the OEM (such as iLO for HP, iDRAC for Dell, CIMC for Cisco).
Navigate to the section of the interface that allows you to start the remote console or virtual console.

Method 1: Mounting the ISO from Remote Console

Navigate to Virtual Media in the Remote Console section of the management console.
Locate the option for mounting an ISO or inserting virtual media. This option might be labeled as Virtual Media, Virtual DVD, or so on.
Select the option to mount or attach an ISO image. You will be prompted to browse for the ISO file on your local system.
Browse and select the ISO file which is of the same version as the affected server version.
Confirm the selection and wait for the management console to upload and mount the ISO to the server.
Once the ISO is mounted, open the server’s operating system or management interface.
On the Choose an option screen, select Troubleshoot and then select Command Prompt.
If your system drive is different than C:\, type C: and then press Enter. This will switch you to the C:\ drive.
Type in the following command and then press Enter:

Note

CD C:\Windows\System32\drivers\CrowdStrike

Note In this example, C is your system drive. This will change the directory to the CrowdStrike directory.
Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, type the following command and then press Enter:

Note

dir C-00000291*.sys
Permanently delete the file(s). To do this, type the following command and then press Enter.

Note

del C-00000291*.sys
Restart your device.

Method 2: Mounting the ISO from Web console

In the Virtual Console window, click the Boot button to access the Boot menu.
From the Boot menu, select Virtual CD/DVD/ISO. Confirm your selection by clicking Yes in the Boot Controls dialog box.
Click the Power button in the Virtual Console window.
Choose Reset system (warm boot) from the Power Controls menu.
Confirm the selection by clicking Yes in the Confirm Power Action dialog box.
After the server completes the POST process, it will start from the selected .ISO image. Select the virtual CD/DVD drive as the boot device. Restart the server to enter the Windows Pre-Installation Environment.
After your device restarts to the Choose an option screen, click Troubleshoot and then click Command Prompt.
If your system drive is different than C:\, type C: and then press Enter. This will switch you to the C:\ drive.
Type the following command and then press Enter:

Note

CD C:\Windows\System32\drivers\CrowdStrike

Note In this example, C is your system drive. This will change to the CrowdStrike directory.
Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, type the following command and then press Enter:

Note

dir C-00000291*.sys
Permanently delete the file(s). To do this, type the following command and then press Enter:

Note

del C-00000291*.sys
Restart your device.

Contact CrowdStrike

If after following the above steps, if you still experience issues logging into your device, please reach out to CrowdStrike for additional assistance.

References

Third-party information disclaimer