Write
OneWriteup
  • Login
  • Trending
  • Articles
  • Blog
  • Tutorials
  • News
  • Research
  • Top 10 Lists
  • Case Studies
  • Writeup
  • Interviews
  • Personal Stories
  • Infographics
No Result
View All Result
  • Trending
  • Articles
  • Blog
  • Tutorials
  • News
  • Research
  • Top 10 Lists
  • Case Studies
  • Writeup
  • Interviews
  • Personal Stories
  • Infographics
No Result
View All Result
OneWriteup
No Result
View All Result

How to fix Windows 10 BSOD (Blue Screen of Death) Stuck at Recovery Due to CrowdStrike?

FOUNDER by FOUNDER
August 19, 2025
Reading Time: 3 mins read
15
0
Share on FacebookShare on Twitter

 

Several media companies, tech firms, and educational institutions have reported encountering the Blue Screen of Death (BSOD) on Windows 10 systems. The affected PCs are stuck at the “Recovery” screen, displaying the message: “It looks like Windows didn’t load correctly. If you’d like to restart and try again, choose Restart my PC below.”

Update from Microsoft and CrowdStrike

In a statement to Windows Latest, Microsoft acknowledged the issue, attributing it to a recent update from a third-party software platform. Microsoft assured users that a resolution is forthcoming.

Security company CrowdStrike has confirmed that the massive Windows 10 BSOD outage is due to a new update to its sensors. CrowdStrike, known for its endpoint protection services, identified that the update is causing significant issues.

Identifying the Cause

On various social media platforms, there are widespread reports of BSOD errors linked to multiple versions of CrowdStrike sensors. Windows Latest’s tests revealed that the csagent.sys (or C-00000291*.sys) file is the culprit. Deleting or renaming this file or its containing folder can resolve the boot issue.

Fixing the Blue Screen of Death and “Recovery” Loop

windows BSOD error crowdstrike

Method 1: Use Safe Mode and Delete the Affected File

  1. Boot to Safe Mode:
    • On the Recovery screen, click “See advanced repair options.”
    • Select “Troubleshoot” > “Advanced options” > “Startup Settings” > “Restart.”
    • After restarting, press 4 or F4 to boot into Safe Mode.

    Alternatively, you can shut down the PC, turn it on, and repeatedly press F8 until the Advanced Boot Options menu appears. Select Safe Mode from there.

  2. Open Command Prompt:
    • In Safe Mode, open Command Prompt (Admin) or Windows PowerShell (Admin).
  3. Navigate to the CrowdStrike Directory:
    • Type cd C:\Windows\System32\drivers\CrowdStrike in Command Prompt.
  4. Delete the Affected File:
    • Locate the file matching the pattern C-00000291*.sys by running dir C-00000291*.sys.
    • Delete the identified file using del C-00000291abc.sys (replace abc with the actual file name).

Method 2: Use Safe Mode and Rename the CrowdStrike Folder

  1. Boot to Safe Mode:
    • Follow the same steps as in Method 1 to boot into Safe Mode.
  2. Open Command Prompt:
    • In Safe Mode, open Command Prompt.
  3. Navigate to the Drivers Directory:
    • Type cd \windows\system32\drivers in Command Prompt.
  4. Rename the CrowdStrike Folder:
    • Use the command ren CrowdStrike CrowdStrike_old to rename the folder.
  5. Restart the Computer:
    • This should allow the PC to boot to the desktop.

Method 3: Use Registry Editor to Block CSAgent Service

  1. Boot to Safe Mode:
    • Follow the same steps as in Method 1 to boot into Safe Mode.
  2. Open Registry Editor:
    • Use Win+R to open the Run dialog, type regedit, and press Enter.
  3. Navigate to the CSAgent Key:
    • Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSAgent.
  4. Edit the Start Value:
    • Find the Start entry on the right pane, double-click it, and change its value from 1 to 4.
    • Click OK to save the changes.
  5. Restart the Computer:
    • This change disables the CSAgent service, allowing Windows to boot normally.

Understanding the Registry Changes

The path HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CSAgent contains configuration settings for the CSAgent service, part of the CrowdStrike agent. The Start value determines when the service starts:

  • 0: Boot start (rarely used).
  • 1: System start (loaded by the I/O subsystem).
  • 2: Automatic start (loaded during system startup).
  • 3: Manual start (requires manual initiation).
  • 4: Disabled (service does not start).

Changing this value to 4 turns off the service, resolving the boot loop issue caused by csagent.sys.

By following these methods, you can resolve the BSOD and “Recovery” loop issues caused by the recent CrowdStrike update on Windows 10 systems.

Disclaimer: This blog is for educational purposes only, promoting awareness of ethical hacking and cybersecurity to help readers protect against cyber threats. All content is based on lawful experiments on our own systems. No illegal activities are endorsed. Users agree to apply the information responsibly and legally. The blog and author are not liable for any misuse. By using this blog, you agree to use all knowledge ethically and legally. [Read full disclaimer].

Buy me a coffee
FOUNDER

FOUNDER

Cybersecurity aficionado committed to disseminating expertise, crafting articles that empower others to resolve errors and fortify online defenses with ease.

Recently Posted

DNS Based Data Exfiltration Using Burp Collaborator Client

DNS Based Data Exfiltration Using Burp Collaborator Client

August 19, 2025
144
HOW To BECOME AN ETHICAL HACKER ROADMAP

Free Cybersecurity Roadmap for Ethical Hacking Career in 2025

August 19, 2025
886
How to use bloodhound tool for pentesting

How to use Bloodhound / Sharphound for Pentesting Active Directory?

August 19, 2025
726
Pass The Hash

How to perform Pass The Hash Attack on Active Directory in 2025?

August 19, 2025
173
Load More

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended

What is Kerberos Authentication Protocol How does it work

What is Kerberos Authentication Protocol? How does it work?

August 19, 2025
198
HOW To BECOME AN ETHICAL HACKER ROADMAP

Free Cybersecurity Roadmap for Ethical Hacking Career in 2025

August 19, 2025
886

Popular Story

  • Jailbreak Gemini 2.5 Pro: A Guide to CLI Access and Jailbreaking in Kali Linux

    Jailbreak Gemini 2.5 Pro: A Guide to CLI Access and Jailbreaking in Kali Linux

    207 shares
    Share 83 Tweet 52
  • How to use Bloodhound / Sharphound for Pentesting Active Directory?

    131 shares
    Share 52 Tweet 33
  • WhatsApp For Windows Runs Arbitrary Python Code

    23 shares
    Share 9 Tweet 6
  • How to Configure OpenVPN Server for Multi Clients Setup in Windows?

    52 shares
    Share 21 Tweet 13
  • Free Cybersecurity Roadmap for Ethical Hacking Career in 2025

    159 shares
    Share 64 Tweet 40

Support This Write-Up. Fund the Next

Buy me a coffee
OneWriteup

Discover expert cybersecurity articles, tutorials, and the latest trends to protect your digital world.

  • Disclaimer
  • About Us
  • Feedback
  • Contact Us
  • Report
  • Privacy Policy
  • Community Guidelines
  • Terms Of Service

© 2024 OneWriteup

No Result
View All Result
  • Trending
  • Articles
  • News
  • Blog
  • Tutorials
  • Research
  • Top 10 Lists
  • Case Studies
  • Interviews
  • Login

© 2024 OneWriteup

Welcome Back!

Login to your account below

Forgotten Password?

Retrieve your password

Please enter your username or email address to reset your password.

Log In