Objective
Corrective actions for CrowdStrike Falcon Sensor issue crashing Windows host
Audience
Environment
The computer may be in recovery mode
Procedure
If the computer is restarting in a loop and does not enter the following screen, contact K-State IT Support
If at the recovery screen, select the following options
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=efbd63c9-334c-467b-8a47-db085a3176d7.png&beidInt=2)
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=e4b6b473-924a-4ba1-99da-44ac5eef4ef2.png&beidInt=2)
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=74928732-456e-44d5-821a-d8a5139ca474.png&beidInt=2)
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=221d958a-dc3a-4a55-b85a-f6dec0920f44.png&beidInt=2)
IF YOU GET THIS SCREEN AFTER SELECTING COMMAND PROMPT STAY ON THE SCREEN AND CONTACT THE K-STATE IT SUPPORT
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=a163449e-e020-4305-aa7e-bbee46e215e4.png&beidInt=2)
Type into the command prompt the following commands:
cd /d C:\\Windows
cd System32\drivers\CrowdStrike
As shown by the picture
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=fb599b94-cf11-400e-845d-218871a5ddc7.png&beidInt=2)
Then Type into the command prompt the following command : del "C-00000291*.sys"
![](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=3fc3df18-ba2c-405e-bf30-06b9c4913dd3.png&beidInt=2)
There is no success indication after this command is entered. If no error is shown after entering this command, restart your computer.
If in recovery mode:
1. Select "See advanced repair options"
2. Reboot into safe mode or windows recovery environment
3. Navigate to the Command Prompt and select "Run as administrator"
![Click to View Full Image Uploaded Image (Thumbnail)](https://support.ksu.edu/TDPortal/Images/Viewer?fileName=4b4185a9-56bd-4048-9923-92ec2e9a20e7-thumb.jpg&beidInt=2)
4. When you are in the Command Prompt, please type in: cd C:\Windows\System32\drivers\CrowdStrike
NOTE: There cannot be any spaces behind at the end of the command you input. If it is not the same then it will give an
5. Boot the host normally.
Notes
For customers using Bitlocker - it is a major stumbling block for a manual safe reboot. Decryption keys may need to be distributed.
https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-process