1202
Major IT outage affecting banks, airlines, media outlets across the world (www.abc.net.au)
submitted 2 years ago* (last edited 2 years ago) by to c/technology@lemmy.world
539 comments fedilink hide all child comments
 

All our servers and company laptops went down at pretty much the same time. Laptops have been bootlooping to blue screen of death. It's all very exciting, personally, as someone not responsible for fixing it.

Apparently caused by a bad CrowdStrike update.

Edit: now being told we (who almost all generally work from home) need to come into the office Monday as they can only apply the fix in-person. We'll see if that changes over the weekend...

you are viewing a single comment's thread
view the rest of the comments
[–] 102 points 2 years ago* (last edited 2 years ago) (5 children)

Here's the fix: (or rather workaround, released by CrowdStrike) 1)Boot to safe mode/recovery 2)Go to C:\Windows\System32\drivers\CrowdStrike 3)Delete the file matching "C-00000291*.sys" 4)Boot the system normally

  • permalink
  • fedilink
  • source
  • hideshow 10 child comments
    •
  • [–] 60 points 2 years ago (7 children)

    It's disappointing that the fix is so easy to perform and yet it'll almost certainly keep a lot of infrastructure down for hours because a majority of people seem too scared to try to fix anything on their own machine (or aren't trusted to so they can't even if they know how)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 68 points 2 years ago (4 children)

    They also gotta get the fix through a trusted channel and not randomly on the internet. (No offense to the person that gave the info, it’s maybe correct but you never know)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 8 points 2 years ago

    True, but knowing what the fix might be means you can Google it and see what comes back. It was on StackOverflow for example, but at the time of this comment has been taken offline for moderation - whatever that means.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 50 points 2 years ago (1 child)

    This sort of fix might not be accessible to a lot of employees who don't have admin access on their company laptops, and if the laptop can't be accessed remotely by IT then the options are very limited. Trying to walk a lot of nontechnical users through this over the phone won't go very well.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 17 points 2 years ago (1 child)

    Yup, that's me. We booted into safe mode, tried navigating into the CrowdStrike folder and boom: permission denied.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 11 points 2 years ago (1 child)

    Half our shit can't even boot into safe mode because it's encrypted and we don't have the keys rofl

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 32 points 2 years ago* (1 child)

    Might seem easy to someone with a technical background. But the last thing businesses want to be doing is telling average end users to boot into safe mode and start deleting system files.

    If that started happening en masse we would quickly end up with far more problems than we started with. Plenty of users would end up deleting system32 entirely or something else equally damaging.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 15 points 2 years ago (1 child)

    It might not even be that. A lot of places have many servers (and even more virtual servers) running crowdstrike. Some places also seem to have it on endpoints too.

    That's a lot of machines to manually fix.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago

    That is unfortunate but also leads me to a different question

    Why do people like windows server? I've had to use it a couple of times for work and although it's certainly better than just using the desktop windows it's so heavy compared to running something like Debian

    In our case, the fact we were using windows server actually made it a worse experience for customers aswell because the hardware was not up to it (because budget constraints) so it just chugged and slowed down everything making it a terrible experience for everyone involved (not to mention how often it'd have to be rebooted because a service wouldn't restart)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 9 points 2 years ago (1 child)

    And people need to travel to remote machines to do this in person

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    You can do it over the phone. I just did a few dozen this morning and it was relatively easy.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago

    "yes, now open the file explorer. No, that's internet explorer.... Yes, with the files. Now go to this pc.... No, I know you are at this pc, but the entry on the left. No that's the keyboard. On the screen. Where it says this pc, on the left. The left. The left. ... That's the start menu. Okay, let's try this a different way. On the keyboard, press the windows key and r. No, simultaneously. The windows key is the one with the flag. Yes. R. As in Romeo. Yes I know a window appeared, very good. Now type c colon backslash windows backslash system 32... Yes like the numbers. No, that's a semicolon. Yes. Shift. On the keyboard. Simultaneously. And another backslash drivers. Click OK. What error? Why did you type that after the colon? It needs to go at the end. Yes, the end. Yes. Yes. Now click OK. What error? Read the text you typed to me. Why didn't you delete the semicolon? Yes. Yes. What error?! AHHHHHHHHHHHHHHHH"

    yeah, sometimes that's just not an option...

  • permalink
  • fedilink
  • source
  • parent
  • [–] 45 points 2 years ago (1 child)

    I'm on a bridge still while we wait for Bitlocker recovery keys, so we can actually boot into safemode, but the Bitkocker key server is down as well...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 13 points 2 years ago (2 children)

    Man, it sure would suck if you could still get to safe mode from pressing f8. Can you imagine how terrible that'd be?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •