Crowdstrike fix

Cycle through BSODs until you get the recovery screen.
Navigate to Troubleshoot > Advanced Options > Startup Settings
Press "Restart"
Skip the first Bitlocker recovery key prompt by pressing Esc
Skip the second Bitlocker recovery key prompt by selecting Skip This Drive in the bottom right
Navigate to Troubleshoot > Advanced Options > Command Prompt
Type "bcdedit /set {default} safeboot network". then press enter.
Go back to the WinRE main menu and select Continue.
It may cycle 2-3 times.
If you booted into safe mode, log in per normal.
Either follow the manual steps or use the powershell below to
1. Open Windows Explorer, navigate to C:\Windows\\System32\drivers\Crowdstrike
2. Delete the offending file (STARTS with C-00000291\*. sys file extension)
3. Open command prompt (as administrator)
4. Type "bcdedit /deletevalue {default} safeboot"., then press enter.
Restart as normal, confirm normal behavior

Powershell to remove the bad Crowdstrike files

$badFileDate=Get-Date -Date  '2024-07-19 04:09:00Z'
$goodFileDate=Get-Date -Date  '2024-07-19 05:27:00Z'
Get-ChildItem -Path 'C:\Windows\System32\drivers\CrowdStrike' -Filter 'C-00000291*.sys' | Where-Object {$_.CreationTime -gt $badFileDate -and $_.CreationTime -lt $goodFileDate } | % {
    Remove-Item -Path $_.FullName
}
Start-Process -FilePath 'C:\Windows\System32\bcdedit.exe' -ArgumentList '/deletevalue {default} safeboot'

Global Protect Install

For remote users who either do not have Global Protect or Global Protect is not setup to allow VPN before Windows login. The manual steps are:

Reboot and make sure global protect is not present at the login screen
Install Global Protect from https://gateway.vcuhealth.org
run CMD as admin and run

Write-Host "Checking that powershell is being run as admin"
if ([bool](([System.Security.Principal.WindowsIdentity]::GetCurrent()).groups -match "S-1-5-32-544") -eq $false){
    Write-Warning "This needs to be run as admin"
    throw "This powershell needs to be run as admin"
}
Write-Host "Checking in PanGPS service is running"
if ($(Get-Service).Name -contains "PanGPS"){
    Write-Host "Stopping PanGPS service"
    Stop-Service -Name PanGPS -ErrorAction SilentlyContinue
}

#Set the MSI Install Lins
$msiOptions='/quiet CONNECTMETHOD="on-demand" SHOWSYSTEMTRAYNOTIFICATIONS="no" PORTAL="gateway.vcuhealth.org"'

Write-Host "Creating a temporary file for the MSI"
$installer=New-TemporaryFile
$installer.MoveTo("$($installer.DirectoryName)\$($installer.BaseName).msi")

Write-Host "Determining PC architecture for MSI download"
if ((gwmi win32_operatingsystem | select osarchitecture).osarchitecture -eq "64-bit"){
    Write-Host "Downloading 64 bit installer"
    Invoke-WebRequest -Uri "https://gateway.vcuhealth.org/global-protect/getmsi.esp?version=64&platform=windows" -OutFile $installer
}
else {
    Write-Host "Downloading 32 bit installer"
    Invoke-WebRequest -Uri "https://gateway.vcuhealth.org/global-protect/getmsi.esp?version=32&platform=windows" -OutFile $installer
}

Write-Host "Begining Installation of Global Protect"
Start-Process msiexec.exe -Wait -ArgumentList "/I $($installer.FullName) $msiOptions"
Write-Host "Installation of Global Protect Complete"

Write-Host "Waiting 10 seconds for the service to start"
for($i=10;$i-gt 0;$i-=1){
    Write-Host $i
    Start-Sleep -Seconds 1
}

Write-Host "setting up Global Protect Login before Windows Logon"
Start-Process -Wait "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -ArgumentList "-registerplap"
New-Item -Path "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL" -ErrorAction SilentlyContinue
New-ItemProperty -Path "HKLM:\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL" -Name "Portal1" -PropertyType "String" -Value "gateway.vcuhealth.org" -ErrorAction SilentlyContinue

Write-Host "Cleaning up the Installer"
Remove-Item -Path $installer.FullName
Write-Host "PLEASE REBOOT YOUR SYSTEM"