Recovery options for Azure Virtual Machines (VM) affected by CrowdStrike Falcon agent

Hello Z004KR5J-A01 ,

I recommend enabling Boot Diagnostics to view the startup screen and troubleshoot the issue further.

To address this problem, please follow these steps:

1. Create a disk from a snapshot: Create a snapshot of your original OS disk and then convert it into a new disk. Ensure you select the appropriate storage type.
2. Attach the new disk: Attach the newly created disk to any existing VM in the same region.
3. Remove the problematic file: Access the attached disk using Explorer, navigate to Windows/System32/Drivers/CrowdStrike, and permanently delete the file starting with "C-00000291*.sys".
4. Detach the disk: Close Explorer, return to the Azure portal, and detach the disk.
5. Swap the OS disk: Replace the OS disk of your main virtual machine with the modified disk.
6. Start the VM and enable Boot Diagnostics: Start the virtual machine and wait for the startup screen to appear.
7. No registry changes should be ideally required.

Please let me know if the issue persists after following these steps.

Above steps worked for us.