What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If a Windows PC began rebooting or showing a blue screen during the July 19, 2024 CrowdStrike Falcon incident, the targeted workaround is to start Windows in Safe Mode or the Windows Recovery Environment and remove only the Channel File 291 driver file matching C-00000291*.sys. This is not a general fix for every blue-screen error, and it should be used only when the symptoms, Falcon installation and file match this incident.
What caused the CrowdStrike Windows crash?
CrowdStrike distributed a Rapid Response Content update to Falcon sensors between 04:09 and 05:27 UTC on July 19, 2024. According to CrowdStrike’s preliminary review, Windows hosts running Falcon Sensor 7.11 or later that received the content could crash because of a logic error in Channel File 291. The sensor operates at a low system level, so its failure could trigger a kernel crash and a Windows stop screen rather than an ordinary application error.
As an Amazon Associate I earn from qualifying purchases.
This was a content or configuration update, not necessarily a new full sensor installation. CrowdStrike said the incident was not caused by a cyberattack. CrowdStrike’s stated impact scope covered Windows hosts; its review said Mac and Linux hosts were not affected. See CrowdStrike’s preliminary incident review and its technical explanation.
Confirm that this is the CrowdStrike incident
Before deleting anything, check several clues together:
#1 Best Overall
- Dual USB-A & USB-C Bootable Drive – compatible with nearly all Windows PCs, laptops, and tablets (UEFI & Legacy BIOS). Works with Surface devices and all major brands.
- Fully Customizable USB – easily Add, Replace, or Upgrade any compatible bootable ISO app, installer, or utility (clear step-by-step instructions included).
- Complete Windows Repair Toolkit – includes tools to remove viruses, reset passwords, recover lost files, and fix boot errors like BOOTMGR or NTLDR missing.
- Reinstall or Upgrade Windows – perform a clean reinstall of Windows 7 (32bit and 64bit), 10, or 11 (amd64 + arm64) to restore performance and stability. (Windows license not included.). Includes Full Driver Pack – ensures hardware compatibility after installation. Automatically detects and installs drivers for most PCs.
- Premium Hardware & Reliable Support – built with high-quality flash chips for speed and longevity. TECH STORE ON provides responsive customer support within 24 hours.
- The PC repeatedly restarts, will not complete Windows startup or shows a blue screen.
- The stop code is
0x50or0x7E, the codes cited in Microsoft’s incident guidance. - CrowdStrike Falcon is installed.
- The failure began during or soon after July 19, 2024.
- The Windows installation contains a file beginning with
C-00000291-and ending in.sysunder%WINDIR%System32driversCrowdStrike.
The file’s presence is not proof by itself. An unrelated blue screen should not be treated by deleting arbitrary driver files. If the timing, Falcon installation or file pattern does not match, use normal Windows stop-error diagnostics instead.
Fastest option when Windows can still start
CrowdStrike said a reboot could allow some online hosts to receive the reverted content. Connect to a reliable wired network where practical, restart once or more, and then verify that Falcon is healthy. Do not delete files pre-emptively from a functioning computer unless your organization’s recovery procedure specifically requires it.
Official Windows 10 and Windows 11 recovery steps
Microsoft’s KB5042421 procedure applies to Windows 10 and Windows 11 endpoints. If the machine keeps crashing, use this sequence:
- Hold the power button for about 10 seconds to turn the PC off, then turn it on.
- At the sign-in screen, hold Shift and select Power > Restart. If Windows cannot reach the sign-in screen, force startup into the Windows Recovery Environment (WinRE) by interrupting startup as directed by the device manufacturer.
- Select Troubleshoot > Advanced options > Startup Settings > Enable Safe Mode, then restart. Some devices use F11 rather than F4 to select a startup option.
- If Windows requests it, enter the BitLocker recovery key.
- Open Command Prompt in Safe Mode or WinRE. Identify the actual Windows volume before running commands.
- Change to that volume and the CrowdStrike directory. For example:
C:
cd WindowsSystem32driversCrowdStrike
dir C-00000291*.sys- Confirm that the listing contains the Channel File 291 pattern, then delete only matching files:
del C-00000291*.sys- Run
dir C-00000291*.sysagain and confirm that no matching files remain. - Shut the computer down completely and power it on again.
These commands are the targeted workaround documented by Microsoft and CrowdStrike. Do not remove other .sys files or unrelated CrowdStrike files. Microsoft’s instructions are at KB5042421.
Check the drive letter before using Command Prompt
WinRE commonly uses X: for the recovery environment, while the installed Windows system may be C:, D: or another letter. Running the command against X: or another disk will not repair the installed system and could lead you to inspect the wrong directory.
At Command Prompt, test likely volumes until you find the one containing the Windows folder:
C:
dir C:Windows
D:
dir D:WindowsUse the drive that contains the affected installation, then run the cd, dir and del commands on that volume. If no volume contains the expected CrowdStrike directory and file pattern, stop rather than deleting a different driver.
When BitLocker asks for a recovery key
BitLocker is not the cause of the CrowdStrike crash. It is an encryption safeguard that may require verification before WinRE or Safe Mode can access the disk. A personal Windows user should retrieve the key through Microsoft’s official account-based recovery process. In a business, the key may be stored in Microsoft Entra ID, Active Directory or the organization’s device-management system; contact IT or the identity administrator rather than repeatedly power-cycling the machine.
Microsoft warns that the key may be required during this repair. Do not attempt to bypass BitLocker or guess the key.
If Safe Mode does not work
Use WinRE directly
From Troubleshoot > Advanced options, open Command Prompt and perform the same volume check and targeted deletion. If a suitable restore point exists, System Restore is another option, but it should be used with awareness of its effect on recent software and driver changes.
Use Microsoft’s recovery USB for multiple endpoints
Microsoft published a recovery tool with a Safe Mode-based option and a recovery-media option intended to speed repairs across fleets. Follow the current instructions in KB5042429. It is a remediation utility, not a general-purpose blue-screen fixer.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Repair the disk offline
For a boot-looping endpoint that cannot use local recovery, an authorized administrator can attach its operating-system disk to another working computer or recovery environment and remove only the matching file. Preserve a backup first and ensure the mounted disk is the affected Windows volume, not the recovery computer’s own system disk.
Rank #2
- High-speed USB 3.0 performance of up to 150MB/s(1) [(1) Write to drive up to 15x faster than standard USB 2.0 drives (4MB/s); varies by drive capacity. Up to 150MB/s read speed. USB 3.0 port required. Based on internal testing; performance may be lower depending on host device, usage conditions, and other factors; 1MB=1,000,000 bytes]
- Transfer a full-length movie in less than 30 seconds(2) [(2) Based on 1.2GB MPEG-4 video transfer with USB 3.0 host device. Results may vary based on host device, file attributes and other factors]
- Transfer to drive up to 15 times faster than standard USB 2.0 drives(1)
- Sleek, durable metal casing
- Easy-to-use password protection for your private files(3) [(3)Password protection uses 128-bit AES encryption and is supported by Windows 7, Windows 8, Windows 10, and Mac OS X v10.9 plus; Software download required for Mac, visit the SanDisk SecureAccess support page]
Servers, virtual machines and cloud PCs
On-premises Windows Server
Windows Server requires server-specific procedures and change control. Microsoft published separate server guidance; administrators should use the relevant release-health and KB instructions rather than applying desktop steps blindly. See Microsoft’s release-health guidance.
Virtual machines and cloud instances
CrowdStrike’s disk-repair method is:
- Detach the affected operating-system disk.
- Create a snapshot or backup before modifying it.
- Attach the disk to a functioning recovery VM.
- Open the attached disk’s Windows driver directory.
- Delete only
C-00000291*.sys. - Detach the disk, reattach it to the original instance and boot.
The complete vendor alert is available as a CrowdStrike technical alert. The same approach can apply in Azure, AWS or Google Cloud, but the exact detach, snapshot and attach controls differ by provider.
Windows 365 Cloud PCs
Microsoft said Windows 365 customers could try restoring a Cloud PC to a known-good state from before July 19, 2024. That is a separate recovery path from editing a local disk; use the organization’s Cloud PC administration controls and preserve any required data.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhat not to do
- Do not delete arbitrary
.sysfiles. - Do not treat the command as a universal Windows BSOD repair.
- Do not uninstall Falcon as the first response. Removing the entire security agent creates a separate protection gap and may require an administrative maintenance token.
- Do not edit a recovery VM’s own system disk when the affected disk is attached separately.
- Do not repeatedly reboot a production server without a recovery plan, backup or snapshot.
- Do not assume that a repaired Windows boot means Falcon protection is fully operational.
After Windows boots
- Confirm that Falcon is running locally and that the endpoint is reporting healthy in the organization’s management console.
- Apply current CrowdStrike and Microsoft remediation guidance through approved change procedures.
- Check that BitLocker recovery keys are escrowed and accessible to authorized staff.
- Validate business-critical applications, networking and backups.
- Document which systems were repaired and which required offline or cloud recovery.
The incident occurred on July 19, 2024. A new blue screen in 2026 should not automatically be attributed to it; confirm the stop code, Falcon installation, timing and Channel File 291 file pattern first.
Frequently asked questions
Frequently Asked Questions
Does this incident affect Windows 11 and Windows 10?
Yes. Microsoft’s KB5042421 endpoint guidance covers both Windows 10 and Windows 11, while CrowdStrike identified affected Windows hosts running Falcon Sensor 7.11 or later that received the faulty content.
Does it affect Mac?
CrowdStrike’s stated incident scope identified Windows hosts and said Mac and Linux hosts were not affected.
Was the CrowdStrike outage a hack?
CrowdStrike said the crash was caused by a faulty Rapid Response Content update and was not a cyberattack.
Can I delete the file from Command Prompt?
Yes, when you have confirmed the affected Windows volume and the file matches C-00000291*.sys. Delete only that pattern from the affected installation’s CrowdStrike directory.
What if the file is not present?
Do not force the workaround. Recheck the volume and directory, then investigate the stop code and other Windows diagnostics because the blue screen may be unrelated.
Should I uninstall CrowdStrike?
No. The documented remedy targets the faulty Channel File 291 file. Uninstalling Falcon is a separate administrative decision and can leave the endpoint without protection.
Does this procedure cover Windows Server?
Not automatically. Use Microsoft’s server-specific guidance and your organization’s recovery controls for Windows Server.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should I do for a virtual machine?
Take a snapshot or backup, detach the affected operating-system disk, attach it to a recovery VM, delete only C-00000291*.sys from the attached Windows directory, then reattach and boot.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
