Sysadmin

7640 readers

21 users here now

A community dedicated to the profession of IT Systems Administration

No generic Lemmy issue posts please! Posts about Lemmy belong in one of these communities:
[email protected]
[email protected]
[email protected]
[email protected]

founded 1 year ago

MODERATORS

[email protected]

How to Bypass Bitlocker for Crowdstrike BSoD (fix) (lemmy.blahaj.zone)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

8 comments fedilink hide all child comments

Took me a few hours to figure this out, figured I'd pass it along. Forgive formatting, I'm on mobile.

How to Bypass Bitlocker for Crowdstrike BSoD

Only use this if the Bitlocker key is lost.

From the Bitlocker screen, select Skip This Drive. A command prompt will appear.

Type bcdedit /set {default} safeboot network and press Enter.

Type Exit to exit the command prompt, then select Shut Down

Hardwire the device to the network

Navigate to C:\Windows\System32\Drivers\Crowdstrike and delete C:\windows\system32\drivers\crowdstrike\c-00000291-*.sys

Win+R to open the Run menu, then type msconfig and press Enter

Go to Boot

Uncheck the box for SafeBoot

You will receive a warning about Bitlocker. Proceed.

Click OK and you will be prompted to restart. Do so.

Have the user login

Test their access to files

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 6 points 3 months ago (1 children)

Howso? It still requires authentication, same as if the laptop booted normally.

[–] [email protected] -5 points 3 months ago (2 children)

It means the drive isn't fully encrypted or the encryption is easy to bypass. That defeats the purpose of encrypting your drive.

If you can get to a login screen, you've compromised the device.

[–] [email protected] 14 points 3 months ago

That’s not what it means.

Bit locker is encryption at-rest. Logging in with an admin account means the system is no longer “at rest”. The admin is fully authorized to be operating that system.

[–] [email protected] 7 points 3 months ago (1 children)

Are you under the impression that you have to enter a Bitlocker key during each boot?

[–] [email protected] 1 points 3 months ago* (last edited 3 months ago)

Any system without network unlock usually requires a TPM PIN/PW every reboot. Your instructions (when read a certain way) imply that the command also bypasses the encryption without fetching a recovery key from the TPM or DC.

My home network (ISC DHCPD) behaves this way - either I type the TPM key or I type the 25-char key.