This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 98%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJR%3C/text%3E%3C/svg%3E)
Today morning 19/7/2024 10:00AM IST, Many users Laptop and servers got blue screen error and rebooted. some users getting this error multiple times.
Is there anyone having similar issue. We have this issue in our offices globally.
US, Malaysia, India, Vietnam
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 15%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBB%3C/text%3E%3C/svg%3E)
I fixed a lot of laptops form the blue screen of death
Solutions to Fix the Blue Screen of Death (BSOD):
-Using BitLocker Recovery Password:
Select "Advanced options" > "Troubleshoot" > "Advanced options"
> "Command Prompt".
Enter the BitLocker Recovery Password when prompted.
This will open CMD with the path X:\Windows\System32.
Type C: and press Enter. (You need to use the BitLocker Recovery to access Disk C).
Navigate to the CrowdStrike folder by typing:
cd C:\Windows\System32\drivers\CrowdStrike
Rename the file with the following command:
ren csagent.sys csagent.sys.old
Restart the device.
-If the BSOD References a Different File:
Run this command to find the file on Disk C
C:\ dir /s /p filename.sys
Copy the path of the file, then navigate to the directory using:
C:\ cd {path}\ then run
ren filename.sys filenameOld.sys
Restart the Windows device.
-Without BitLocker Recovery Password:
Click "Skip this drive".
In the Command Prompt, run: bcdedit /set {default} safeboot network
Reboot to access your account in Safe Mode.
Once logged in, open CMD by pressing Win + R, typing cmd, and hitting Enter.
Run the following command to rename the file:
ren C:\Windows\System32\drivers\CrowdStrike\csagent.sys csagentold.sys
Hold down the Shift button and click Restart to go back to the Advanced options.
Select "Advanced options" > "Troubleshoot" > "Advanced options"
> "Command Prompt".
Run the following command to prevent booting into Safe Mode on the next restart:
bcdedit /deletevalue {default} safeboot
Restart the device.
This solution has resolved issues on multiple Windows devices.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 11%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERR%3C/text%3E%3C/svg%3E)
In the step Reboot without bitlocker recovery key
When I did reboot after running that command, the system promted to bit locker recovery page again.
can you help me on this?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 9%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWL%3C/text%3E%3C/svg%3E)
Hello,
This blue screen error is not an isolated case. Many Microsoft users have encountered similar problems. You can choose one of the following solutions to solve your problem:
As a workaround, you can remove Crowdstrike.
1.Please temporarily disable Csagent by changing below key to 4:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Csagent\start
2.For multiple machines, you can try changing the key via GPO.
3.If the machine cannot boot into the OS, please boot into WinRE and change the key from the command prompt:
1) Type regedit to open registry editor.
2) In the tree view panel (left side), select the HKEY_LOCAL_MACHINE key
3) Select File > Load Hive...
4) Browse to the offline system's windows\system32\config folder
5) Select the SYSTEM hive
6) When prompted, give the loaded hive a name of offline _system
7) Check the default value to determine which control set we want to edit. HKEY_LOCAL_MACHINE\offline _system\SYSTEM\Select\Current <<< this is usually a 1. That would mean we need to edit ControlSet001
For this example, we will assume the default value is 1 (it almost always is).
8) Navigate to HKLM\offline _system\Services\Csagent\Start and disable it by modifying its Start type value to 4.
9) Unload the hive by selecting the offline _system key in the tree view (left side) and then selecting File > Unload Hive...
NOTE, if you don't unload the hive the changes will not be saved.
Another Workaround Steps:
For a permanent solution, please contact Crowdstrike for further explanation and action plans.
Hello
Is your problem solved?
If the above reply is helpful to you, please mark your reply as an answer, thank you very much!
If you have any further questions, please do not hesitate to contact us.
Thanks