Windows Crowdstrike Recovery
How to fix the non-bootable Windows issue caused by Crowdstrike?
Windows 10 / Windows 11:
On the Windows recovery screen, please click “See advanced repair options”
On the Troubleshoot window, please click “Advanced options”
On the Advanced options menu, click on “Command Prompt”
Now the system will prompt you to unlock the drive with the Bitlocker recovery key:
Note the unique “Recovery Key ID,” and the unique “Drive Label”
Important: Please note the first 2 letters of the Drive Label at the bottom either FS or AP
Obtain the Bitlocker recovery key from one of these websites:
If the Drive Label starts with FS************, use https://mbam3.lehigh.edu/selfservice. (go.lehigh.edu/bitlockers). (Need first 8 characters of Recovery Key ID for the drive)
If the Drive Label starts with AP************, use
If you have any issues getting the recovery key, please put a ticket at http://lehigh.edu/help
After entering the key, a command prompt window will show up:
Type this command to list the disks on your system:
wmic logicaldisk list brief
Find the “DeviceID” (letter) for the hard drive in your computer that Windows is installed on. In this case, the “Windows” volume was on the drive with DeviceID “C:” (This will be the case for most systems).
Delete the offending file. Type this command exactly using your DeviceID (drive letter). Also: note the asterisk at the end of the filename.:
del /p C:\windows\system32\drivers\CrowdStrike\C-00000291*.sys
Then you will get a confirmation message that says are you sure you want to delete that file?
Please press Y but make sure that you are deleting the right file.
Finally, restart your computer.
For immediate help, contact the LTS Help Desk (Hours)
EWFM Library | Call: 610-758-4357 (8-HELP) | Text: 610-616-5910 | Chat | helpdesk@lehigh.edu
Submit a help request (login required)