CrowdStrike recovery: BitLocker checks and USB repair steps

For an administrator repairing a Windows 10 or 11 PC confirmed to be affected by the 19 July 2024 CrowdStrike incident, Microsoft’s recovery tool offers two paths. Windows PE runs the repair automatically; Safe Mode needs an account with local administrator rights. Choose by the credentials and encryption setup you actually have.

This guide reflects official recovery guidance for the July 2024 incident, available through 23 July 2024. It covers affected Windows client PCs, not servers, virtual machines or large PXE deployments. The steps are based on Microsoft’s documentation, not a Jitsumi recovery test.

Not sure this is the right incident? Start with the CrowdStrike scope checks and IT handoff guide . Do not use this incident-specific repair for an unexplained blue screen.

Before you start

If this is a work or school computer, contact your IT team first. They may control the local administrator account, hold the BitLocker recovery key, and need to coordinate recovery across managed devices.

Microsoft’s recovery tool creates boot media from a separate 64-bit Windows PC. The Microsoft instructions call for administrator access and at least 8 GB of free space on that PC. A USB drive must be between 1 GB and 32 GB; the tool erases it and formats it as FAT32. Keep anything important on that drive somewhere else.

Before choosing a route, establish whether the affected drive uses BitLocker, whether you can obtain its recovery key, and whether an account with local administrator rights is available. These are separate requirements: a recovery key unlocks the encrypted drive; it is not the Windows sign-in password. Keep keys private and use the organisation’s approved recovery process.

Create the USB for the chosen route

Use the signed recovery-tool download linked from Microsoft’s KB5042429 . Avoid third-party repackaged fixes.

1. On the working PC, extract the downloaded package and run its MsftRecoveryToolForCS.ps1 script in Windows PowerShell as an administrator. The tool downloads and installs the Windows Assessment and Deployment Kit.
2. Select Windows PE or Safe Mode using the access checks below. Follow Microsoft’s driver prompts for the target hardware, then choose USB media.
3. Check the USB drive letter before confirming: its existing contents will be erased. Once creation finishes, remove it from the working PC.

Choose Windows PE if automatic repair fits

Windows PE is the simpler route when you have the BitLocker key if the device asks for it, or when the system drive is not encrypted. The device boots from the USB and the Microsoft tool runs the remediation automatically. It does not require signing in with a local administrator account.

For a BitLocker-protected drive, have the device’s recovery key available before using Windows PE. Do not assume that a normal Windows sign-in password—or a PIN used for ordinary startup—will satisfy a recovery-key prompt. If the required credential is unavailable, pause and review the Safe Mode conditions or contact the device’s administrator.

1. Insert the Windows PE recovery USB into the affected PC and use its manufacturer’s boot-menu instructions to boot from USB. F12 is common, but not universal.
2. Follow the tool’s prompts, supplying the matching BitLocker recovery key when required. The tool performs the remediation; do not substitute manual deletion of unrelated files.
3. After the repair completes, remove the USB and restart normally.

Choose Safe Mode when you have a local administrator account

Microsoft lists Safe Mode for devices with TPM-only BitLocker protection, no encryption, or an unknown recovery key. It may avoid a key prompt, but it is not a guaranteed way around BitLocker: Microsoft warns that a recovery key can still be required. TPM plus PIN protection requires the PIN or recovery key. You must also be able to sign in with local administrator rights.

1. Boot the affected PC from the Safe Mode recovery USB using its manufacturer’s boot-menu instructions. Follow the prompts that configure the PC to restart into Safe Mode.
2. Sign in with an account that has local administrator rights. In an elevated command prompt, run repair.cmd from the root of the USB drive. The script applies the remediation and restores normal boot settings.
3. Follow the completion prompts to restart normally and remove the recovery USB so the PC does not boot from it again. If a key is requested or the script fails, stop and resolve that specific requirement rather than repeatedly changing boot settings.

If the drive uses a non-Microsoft encryption product, use that vendor’s recovery guidance. Microsoft’s instructions note that encryption products can change how the boot media accesses the drive.

Verify recovery before returning the PC to use

After the PC restarts, confirm that Windows reaches the sign-in screen and can restart normally again. If it is managed, let IT confirm that normal security management and required applications are working before treating it as fully recovered. Microsoft recommends testing the recovery process on multiple devices before using it broadly in an organisation.

If neither path matches the encryption setup or available account, stop and ask the device administrator for help. If USB boot is unavailable, use Microsoft’s separate manual or deployment guidance rather than improvising this workflow. Do not reset or reimage a PC merely to get past the restart loop; first confirm the recovery key, data backup and organisation’s recovery plan.

Sources

• Microsoft: KB5042429, recovery tool and Windows endpoint recovery options