KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (2024)

Table of Contents
Summary Resolution Recovery methods Contact CrowdStrike References FAQs References

For information about this issue with CrowdStrike on Windows servers, see KB5042426.

Summary

Microsoft has identified an issue impacting Windows endpoints that are running the CrowdStrike Falcon agent.These endpoints might encounter error messages 0x50 or 0x7E on a blue screen and experience a continual restarting state.

We have received reports of successful recovery from some customers attempting multiple restart operations on affected Windows endpoints.

We are working with CrowdStrike to provide the most up-to-date information available on this issue. Please check back for updates on this ongoing issue.

Resolution

Important:We have released a USB tool to help automate this manual repair process. For more information, seeNew recovery tool to help with CrowdStrike issue impacting Windows devices.

To resolve this issue, follow these instructions for your version of Windows.

Windows 11Windows 10

  1. Hold the power button for 10 seconds to turn off your device and then press the power button again to turn on your device.

  2. On the Windows sign-in screen, press and hold theShift key while you selectPower >Restart.

  3. After your devicerestarts to theChoose an optionscreen, selectTroubleshoot.

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (1)

  4. On the Troubleshoot screen, selectAdvanced options>Startup Settings> Enable safe mode.​​​​​​​​​​​​​​

    ​​​​​​​

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (2)

  5. Restart your device.

    NoteYou may be asked to enter yourBitLocker recovery key. When the device restarts, continue pressing F4 and then it will log you in to safe mode. Please note, for some devices, you need to press F11 to log in through safe mode.

  6. Once in safe mode, right-click Start, clickRun,typecmdin the Open box, and then click OK.

  7. If your system drive is different than C:\, type C: and then press Enter.This will switch you to the C:\ drive.

  8. Type the following commandand then press Enter:

    CD C:\Windows\System32\drivers\CrowdStrike

    Note In this example, C is your system drive. This will changeto the CrowdStrike directory.

  9. Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, typethe followingcommand and then press Enter:

    dir C-00000291*.sys

  10. Permanently delete the file(s) found. To do this,type the followingcommand and then press Enter.

    del C-00000291*.sys

  11. Manually search for any files that match “C-00000291*.sys” and delete them.

  12. Restart your device.

  1. Hold the power button for 10 seconds to turn off your device and then press the power button again to turn on your device.

  2. On the Windows sign-in screen, press and hold theShiftkey while you selectPower>Restart.

  4. On the Troubleshoot screen, selectAdvanced options>Startup Settings>Enable safe mode.​​​​

    ​​​​​​​

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (4)

  5. Restart your device.

    NoteYou may be asked to enter yourBitLocker recovery key.

  6. When the device restarts, continue pressing F4 and then it will log you in to safe mode.

  7. Once in safe mode, right-click Start, clickRun,typecmdin the Open box, and then clickOK.

  8. If your system drive is different than C:\, type C: and then press Enter.This will switch you to the C:\ drive.

  9. Type in the following command and then press Enter:

    CD C:\Windows\System32\drivers\CrowdStrike

    NoteIn this example C is your system drive.This will change to the CrowdStrike directory.

  10. Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, typethe followingcommand and then press Enter:

    dir C-00000291*.sys

  11. Permanently delete the file(s) found. To do this,type the followingcommand and then press Enter.

    del C-00000291*.sys

  12. Manually search for any files that match “C-00000291*.sys” and delete them.

  13. Restart your device.

Recovery methods

If you receive the Windows Recovery screen, use one of the following methods to recover your device.

Method 1: Use Enable safe mode

Windows 11Windows 10

  1. Hold the power button for 10 seconds to turn off your device and thenpress the power button again to turn on your device.

  2. On the Windows sign-in screen, press and hold theShiftkey while you selectPower >Restart.

  3. After your device restarts to theChoose an optionscreen, selectTroubleshoot>Advanced options>Startup Settings>Enable safe mode. Then, restart your device.

    NoteYou mightbe asked to enter yourBitLocker recovery key. When the device restarts, continue pressing F4 and then it will log you in to safe mode. Please note, for some devices, you need to press F11 to log in through safe mode.

  4. If the screen asks for a BitLocker recovery key,useyour phone andlog ontohttps://aka.ms/aadrecoverykey.Log on withyour Email ID and domain account password to find the BitLocker recovery key associated with your device.

    To locate your BitLocker recovery key, click Manage Devices > View Bitlocker Keys > Show recovery key.

  5. Select the name of the device where you see the BitLocker prompt.In the expanded window,select View BitLocker Keys. Go back to your device and input the BitLocker key that you see on your phone or secondary device.

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (5)

  6. When the device restarts, continue pressing F4 and then it will log you in to safe mode.

  7. Once in safe mode, right-click Start, clickRun,typecmdin the Open box, and then clickOK.

    ​​​​​​​

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (6)

  8. If your system drive is different than C:\, type C: and then pressEnter.This will switch you to the C:\ drive.

  9. Type the following command and then press Enter:

    Tip: CD C:\Windows\System32\drivers\CrowdStrike

    NoteIn this example, C is your system drive.This will changeto the CrowdStrike directory.

  10. Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, typethe followingcommand and then press Enter:

    dir C-00000291*.sys

  11. Permanently delete the file(s) found. To do this,type the followingcommand and then press Enter.

    del C-00000291*.sys

  12. Manually search for any files that match “C-00000291*.sys” and delete them.

  13. Restart your device.

  1. Hold the power button for 10 seconds to turn off your device and then press the power button again to turn on your device.

  2. On the Windows sign-in screen, press and hold theShiftkey while you selectPower >Restart.

  3. After your device restarts to theChoose an optionscreen, selectTroubleshoot>Advanced options>Startup Settings>Enable safe mode. Then restart your device again.

    NoteYou mightbe asked to enter yourBitLocker recovery key. When the device restarts, continue pressing F4 and then it will log you into safe mode. Please note, for some devices, you need to press F11 to log in through safe mode.

  4. If the screen asks for a BitLocker recovery key, then useyour phone andlog on tohttps://aka.ms/aadrecoverykey.Log on with your Email ID and domain account password to find the bit locker recovery key associated with your device.

    To locate your BitLocker recovery key, click Manage Devices > View Bitlocker Keys > Show recovery key.

  5. Select the name of the device where you see the BitLocker prompt.In the expanded window, select View BitLocker Keys. Go back to your device and input the BitLocker key that you see on your phone or secondary device.

  6. When the device restarts, continue pressing F4 and then it will log you in to safe mode.

  7. Once in safe mode, right-click Start, clickRun,typecmdin the Open box, and then clickOK.

    ​​​​​​​

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (7)

  8. If your system drive is different than C:\, type C: and then press Enter.This will switch you to the C:\ drive.

  9. Type in the following command and then press Enter:

    Tip: CD C:\Windows\System32\drivers\CrowdStrike

    NoteIn this example, C is your system drive.This will change to the CrowdStrike directory.

  10. Once in the CrowdStrike directory, locate the file matching “C-00000291*.sys”. To do this, typethe followingcommand and then press Enter:

    dir C-00000291*.sys

  11. Permanently delete the file(s) found. To do this,type the followingcommand and then press Enter.

    del C-00000291*.sys

  12. Manually search for any files that match “C-00000291*.sys” and delete them.

  13. Restart your device.

Method 2: Use System Restore

Windows 11Windows 10

  1. Hold the power button for 10 seconds to turn off your device and then press the power button again to turn on your device.

  2. On the Windows sign-in screen, press and hold theShiftkey while you selectPower >Restart.

  3. After your device restarts to theChoose an optionscreen, selectTroubleshoot>Advanced options>System Restore.

  4. If the screen asks for a BitLocker recovery key, useyour phone andlog on tohttps://aka.ms/aadrecoverykey.Login with your email id and domain account password to find the bit locker recovery key associated with your device.

    To locate your BitLocker recovery key, click Manage Devices > View Bitlocker Keys > Show recovery key.

  5. Select the name of the device where you see the BitLocker prompt.In the expanded window, select View BitLocker Keys. Go back to your device and input the BitLocker key that you see on your phone or secondary device.

    ​​​​​​​

    KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (8)

  6. Click Nexton System Restore.

  7. Select the Restore option in the list, clickNext, and then clickFinish.

  8. Click Yesto confirm the restore.

    NoteThis will perform just the Windows system restore and personal data should not be impacted. This process might take up to 15 minutes to complete.

  1. Hold the power button for 10 seconds to turn off your device and then press the power button again to turn on your device.

  2. On the Windows sign-in screen, press and hold theShiftkey while you selectPower >Restart.

  3. After your device restarts to theChoose an optionscreen, selectTroubleshoot>Advanced options>System Restore.

  4. If the screen asks for a BitLocker recovery key, useyour phone andlog on tohttps://aka.ms/aadrecoverykey.Log in with your Email ID and domain account password to find the bit locker recovery key associated with your device.

    To locate your BitLocker recovery key, click Manage Devices > View Bitlocker Keys > Show recovery key.

  5. Select the name of the device where you see the BitLocker prompt.In the expanded window, select View BitLocker Keys. Go back to your device and input the BitLocker key that you see on your phone or secondary device.

  6. Click Nexton System Restore.

  7. Select the Restore option in the list, click Next, and then clickFinish.​​​​​​​

  8. Click Yesto confirm the restore.

    NoteThis will perform just the Windows system restore and personal data should not be impacted. This process might take up to 15 minutes to complete.

Contact CrowdStrike

If after following the above steps, if you still experience issues logging into your device, please reach out to CrowdStrike for additional assistance.

References

Start your PC in safe mode in Windows

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. We make no warranty, implied or otherwise, about the performance or reliability of these products.

We provide third-party contact information to help you find technical support. This contact information may change without notice. We do not guarantee the accuracy of this third-party contact information.

KB5042421: CrowdStrike issue impacting Windows endpoints causing an 0x50 or 0x7E error message on a blue screen (2024)

FAQs

Does CrowdStrike block malware? ›

For example, CrowdStrike is AV Comparatives approved, with a 99.2 percent malware block rate, and zero business false positives. In addition, the Falcon platform meets the compliance standards of PCI DSS Requirement No.

Show Me More ›
Is the blue screen of death fixable? ›

Though its scary name comes from a so-called “fatal” error, it's rare that BSOD issues aren't fixable. When Windows reboots after a BSOD, it automatically troubleshoots the issue to begin repairs.

Discover More ›
What causes the blue screen of death? ›

The blue screen of death can be caused by any problem that causes Windows to stop running safely. The BSOD can be triggered by software problems, such as incompatible driver updates, or hardware problems, like a hard drive that needs formatting or overheating caused by overclocking your CPU.

Tell Me More ›
Does CrowdStrike spy on you? ›

It diligently records program executions, file interactions, and network behaviors, all while ensuring the user's data remains confidential. Importantly, CrowdStrike refrains from delving into the contents of documents and transmitted data.

See More ›
Can CrowdStrike detect phishing? ›

Protecting From Phishing Attacks With CrowdStrike

With CrowdStrike Falcon® Complete managed detection and response (MDR), you can stop breaches on endpoints, workloads, and identities with expert management, threat hunting, monitoring and remediation.

View Details ›
Is CrowdStrike a virus scanner? ›

CrowdStrike is a web/cloud based anti-virus which uses very little storage space on your machine. CrowdStrike installs a lightweight sensor on your machine that is less than 5MB and is completely invisible to the end user.

Explore More ›
Why is my Windows 10 stuck on blue window screen? ›

In Windows 10, it is normal for the blue loading screen to appear for an extended period of time. If your computer stays on the blue loading screen for a long time, this may be because there are too many startup programs, or because the startup programs are not compatible with Windows 10.

Read More ›
How do I force a blue screen error? ›

You can do this by holding down the furthest most right "Control" key then pressing the "Scroll Lock" key twice. Once this is completed, a blue screen should pop up. If you are using Windows 8 or later, the Blue Screen is slightly different.

Get More Info ›
Why does Windows 10 keep blue screening? ›

If you maintain access to the desktop after seeing a blue screen error, the likelihood is that the issue can be related to an app installed recently, an out-of-date driver, or an update to Windows 10.

Keep Reading ›
How do I fix blue screen registry error Windows 10? ›

Some other methods that you can use to solve your registry errors;
  1. Update Windows PC to the latest version.
  2. Return to a previous restore point.
  3. Test automatic maintenance.
  4. Update system.
  5. Boot into Safe Mode.
  6. Unplus unnecessary devices.
  7. Update all the device drivers on your computer manually or automatically.
May 30, 2023

Explore More ›

References

Top Articles
Ask EviCore: Portal Support | EviCore by Evernorth
— Remote Sensing Tutorial 1 documentation
Yes Automotive Stellhorn
Nautimate Lazy Gecko
Ark Mindwipe Tonic Command
Powersave Nathan Gilroy
Marlin Markets Weekly Ad
Amanda Bellaci
No Hard Feelings Showtimes Near Cinemark Tinseltown Pueblo
Craigslist En Brownsville Texas
Crazy 8S Cool Math
Candy Crush Level 531 Frog
Latest Posts
Maximising Small Spaces: Creative Home Decor Ideas For Compact Living
No Man’s Sky multiplayer - How to join friends for co-op
Article information

Author: Dean Jakubowski Ret

Last Updated:

Views: 5405

Rating: 5 / 5 (50 voted)

Reviews: 89% of readers found this page helpful

Author information

Name: Dean Jakubowski Ret

Birthday: 1996-05-10

Address: Apt. 425 4346 Santiago Islands, Shariside, AK 38830-1874

Phone: +96313309894162

Job: Legacy Sales Designer

Hobby: Baseball, Wood carving, Candle making, Jigsaw puzzles, Lacemaking, Parkour, Drawing

Introduction: My name is Dean Jakubowski Ret, I am a enthusiastic, friendly, homely, handsome, zealous, brainy, elegant person who loves writing and wants to share my knowledge and understanding with you.