Headlines everywhere on Friday, the 19th of July, 2024 were about the massive computer outages caused by a faulty update to the CrowdStrike antivirus software. It seems some config file choked up a kernel module causing Windows machines to fail with the infamous Blue Screen of Death.
I recently started a new job and was perhaps a little smug in the fact that in my new job I am no longer responsible for hundreds of endpoints running CrowdStrike.
I shut down my home PC Friday night to install a memory upgrade and after powering it back on I was met with the very same Blue Screen of Death.
"A critical process died" it told me, with no information about what said process actually was.
System Restore failed. sfc /scannow failed. dism /cleanup-image failed. Everything I could find failed. I couldn't even just reinstall Windows over the existing installation because apparently that requires being already booted into the OS that currently isn't running.
The log files from dism led me to believe the problem might be related to registry corruption, but my attempts at replacing system registry files with clean ones from an install wim were not successful.
I was grasping at straws. Starting from scratch with a clean install is daunting and would have set me back weeks. I was contemplating pulling out an old SSD and just running with Linux Mint for a while.
Through desperation, I downloaded Hiren's BootCD PE so I could poke around a little more. None of the tools included there were able to resolve the issue either, but just having access to a standard Explorer shell and a web browser helped.
Finally I came across ShadowCopyView, a program that can explore the System Restore images that Windows (can) take regularly. In one last desperate effort, I moved out all of the system registry files from C:\Windows\System32\config and used ShadowCopyView to replace them with copies from an automatic restore point the previous Monday.
That actually did the trick. I was able to reboot into my primary Windows partition and sign in like normal.
I have no idea what may have been lost in a few days of registry updates, and I have no idea what may have caused the problem to begin with. But I am happy I was able to find something in the end that would get me back into my system without having to reinstall everything from scratch.
... Although maybe I should anyway.
And should anyone encounter something similar in the future, these were the kind of errors I was seeing that a Google search wasn't really coming up with anything useful:
dism.log: failed to open registry root
dism.log: failed to query for path to user profiles directory
dism.log: failed to load the default user profile registry hive
dism.log: failed to load offline store from boot directory
srttrail.txt: pending package install
strtrail.txt: boot manager generic failure