CrowdStrike outage: is your Windows PC affected?

A blue screen alone does not identify the 19 July 2024 CrowdStrike outage. First check whether the PC could have received the faulty Falcon configuration update, then decide who should handle it. For a work or school device, that person is normally your IT team—not whoever finds a repair download first.

This guide reflects public information available through 22 July 2024. It covers Windows 10 and Windows 11 client PCs; servers and cloud-hosted machines need their own recovery instructions.

Was your PC in scope?

CrowdStrike says it released a sensor configuration update at 04:09 UTC on 19 July and reverted it at 05:27 UTC. Windows hosts running Falcon Sensor 7.11 or later that were online during that window and received the update may have been affected. CrowdStrike said the incident was not a cyberattack; its technical note says Linux and macOS systems were not affected by this channel file. CrowdStrike’s 20 July technical note .

Microsoft’s client guidance describes affected endpoints showing a 0x50 or 0x7E stop code and repeatedly restarting. Those symptoms fit the incident only when the device also matches the Falcon and timing details; a stop code by itself does not identify the cause. Microsoft’s endpoint guidance .

Microsoft estimated that about 8.5 million Windows devices were affected, less than one per cent of all Windows machines. That estimate explains the disruption to organisations without meaning that every home PC was involved. Microsoft’s 20 July update .

Choose the next step

What to send IT before anyone attempts a repair

A useful incident report separates what you can see from what IT needs to verify. You do not need to start Windows or alter system files to collect the basic details.

• Identify the device: its asset tag or computer name if known, who uses it, and how IT can reach you while it is offline.
• Record when the failure began and the exact stop code or on-screen message. Say whether it keeps restarting or reaches a recovery screen.
• Tell IT about any repair already attempted and any important work stored only on that PC. Let them confirm Falcon installation, affected update exposure and the recovery plan.
• If a BitLocker recovery screen appears, tell IT that it is asking for a key. Do not put the recovery key or account password into an ordinary ticket or send it to an unsolicited helper.

While waiting, do not delete CrowdStrike files, reset the PC or disable security controls just because another machine was repaired that way. The incident-specific fix is for confirmed affected systems; a different crash needs its own diagnosis.

Confirmed affected? Hand off to the recovery guide

For the administrator carrying out the repair, our companion guide covers BitLocker prerequisites and the Windows PE or Safe Mode recovery steps . Keep the incident assessment here separate from that repair workflow.

Avoid fake recovery tools

On 20 July, Australia’s cyber security agency warned that malicious websites and unofficial code were claiming to fix the CrowdStrike outage. Download recovery tools only from Microsoft’s official Download Center, and use CrowdStrike’s official guidance for Falcon-specific instructions. ASD’s Australian Cyber Security Centre advisory .

The faulty configuration had been reverted, but machines that were already stuck in a restart loop could still need local recovery. The useful first question is therefore whether the computer matches the affected Windows-and-Falcon conditions—not whether it merely shows a blue screen.