Global Internet Outage – How to Recover CrowdStrike BSOD?

What Is CrowdStrike BSOD?

On July 19, 2024, a large number of Windows users encountered a blue screen of death when trying to use their computers. What’s worse, it even affects many airlines, banks, emergency systems, and more. According to the statements of CrowdStrike, it is not a security incident or cyberattack.

CrowdStrike BSOD (csagent.sys BSOD) is triggered by a bug in a driver update that CrowdStrike pushed out to Windows. To address this CrowdStrike BSOD, you need to delete a few driver files from the system or rename the related folder.

If you are still stuck in CrowdStrike BSOD at the moment, scroll down to get 4 effective ways to overcome it.

MiniTool ShadowMaker TrialClick to Download100%Clean & Safe

How to Fix CrowdStrike Blue Screen of Death on Windows 10/11?

Fix 1: Delete Problematic Files in WinRE

Windows Recovery Environment (WinRE) can repair most common cases of unbootable operating systems with some troubleshooting and diagnostic tools. It also allows you to repair CrowdStrike blue screen error. To do so:

Move 1: Enter Windows Recovery Environment

Step 1. Power off your computer > press the Power button again to start it > press the Power button again when you see the Windows logo on the screen.

Step 2. Repeat this process for 2 or more times until prompted by the Automatic Repair screen.

Step 3. Click on Advanced options to enter Windows Recovery Environment.

Also see: How to Boot into Windows Recovery Mode on Bootable/Unbootable PCs

Move 2: Delete the C-00000291*.sys Files

Step 1. In Windows Recovery Environment, click on Advanced options and then hit Command Prompt.

Step 2. In the command window, type the following command and hit Enter to delete the C-00000291*.sys files.

del C:\Windows\System32\drivers\CrowdStrike\C-00000291*.sys

Step 3. Once done, turn off your computer and then restart it.

Fix 2: Delete Problematic Files in Safe Mode

Since csagent.sys BSOD is caused by the third-party cybersecurity software CrowdStrike, you can also enter Safe Mode to delete the problematic files. Here’s how to do it:

Move 1: Boot into Safe Mode

Step 1. Power off your computer > press the Power button again to start it > press the Power button again when you see the Windows logo on the screen.

Step 2. Repeat this process for 2 or more times until prompted by the Automatic Repair screen.

Step 3. Click on Advanced options to enter Windows Recovery Environment.

Step 4. Go to Troubleshoot > Advanced options > Startup Settings > Restarts.

Step 5. Press F4, F5, or F6 according to your needs.

• F4 – enable Safe Mode.
• F5 – enable Safe Mode with Networking.
• F6 – enable Safe Mode with Command Prompt.

Windows Device Encryption vs BitLocker Encryption – Differences

This post provides information about Windows Device Encryption vs BitLocker Encryption. Besides, you can know how to enable them on Windows.

Read More

Move 2: Delete the Problematic File

Step 1. Press Win + E to open File Explorer.

Step 2. Go to C drive > Windows > System > drivers > CrowdStrike.

Step 3. In the CrowdStrike folder, find files that start with C-00000291 and end with .sys. Select these files, right-click on them and choose Delete.

Step 4. Close all the open windows and restart your computer to check if CrowdStrike BSOD is gone.

Most of the time, you can exit Safe Mode after a simple restart. However, sometimes, your computer still boots into Safe Mode after restarting. In this case, you need to follow these steps to get out of Safe Mode:

Step 1. Press Win + R to open the Run box.

Step 2. Type msconfig and hit Enter to launch System Configuration.

Step 3. Go to the Boot tab > uncheck Safe boot > hit OK.

Fix 3: Rename Related Files or Folders

It is reported that renaming the CrowdStrike folder or the csagent.sys file also does the trick. To do so:

Step 1. Enter Safe Mode.

Step 2. Press Win + E to open File Explorer.

Step 3. Navigate to: C:\Windows\System32\drivers\CrowdStrike\csagent.sys and renamethe csagent.sys file.

Alternatively, you can also navigate to C:\Windows\System32\drivers\CrowdStrike and then rename the CrowdStrike folder directly.

Step 4. After that, reboot your computer in normal mode to check if csagent.sys BSOD is still there.

Fix 4: Block CSAgent Service via Registry Editor

To fix CrowdStrike BSOD, another way is to modify the Windows registry items to block the CSAgent service. Here’s how to do it:

Step 1. Boot your computer into Safe Mode.

Step 2. Press Win + R to open the Run box.

Step 3. Type regedit.exe and hit Enter to launch Registry Editor.

Step 4. Go to the following path to find the CSAgent key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSAgent

Step 5. In the right pane, right-click on the Start entry > select Modify > change its Value data to 4 > hit OK.

Step 6. Quit Registry Editor and reboot your computer.

Final Words

That’s all you can do to fix CrowdStrike BSOD on Windows 10/11. Which method saves your day? Most importantly, it’s better to create a backup of your crucial data in daily life with MiniTool ShadowMaker. Once the same problem occurs, it only takes a few clicks to restore your data and your work flow won’t be affected.