Crowdstrike: What % of sys admins can remotely boot to safe mode, given BSOD? What kinds of setups would make this possible? For those who can't do it, what is their least bad option? |
Crowdstrike: What % of sys admins can remotely boot to safe mode, given BSOD? What kinds of setups would make this possible? For those who can't do it, what is their least bad option? |
The solution didn’t bother with safe mode, it used a boot image that would search for the offending file on all the drives and deleted it, then rebooted back onto the normal boot drive.
With specialization, so few people know all the various pieces to be able to quickly solution something. Good generalists are often overlooked, but they are the saviors in these moments.
But probably above 1%, given that it's a serious enough tail risk that you might keep an old geezer around who remembers how to do it just in case something mission critical happens.
This is also Windows world, where everything to do PXE booting is literally click and click.
Devops/SRE and "cloud" are also different, I would say Devops/SRE's would have no experience w/ general windows deployment. Cloud can be 50/50 if they are on Azure, doing Windows servers and mass deployment/runbooks there.
AS for the old geezer, those are the ones I'd be worried about. While in the XP days pxe boot was a bit new, and USB booting was finally getting implemented in bios's - they are the ones that'd probably suggest a windows recovery via DVD.
And not to mention, the skills really for this are really low - the barrier is bitlocker, whether the key was backedup on the AD server and/or if the ad server was essentially bricked as well. There'd be a few, and if they go down, then disaster recovery would be the other half and hopefully they wouldn't restore backups - but thats another side of the coin here.
tl;dr the clients are easy enough to fix, any proper org can reimage a computer probably in an hour or 2 per client - if needbe can re-AD join them and be almost up and ready, if non-encrypted (rare but sure) then a quick repair would probably work if org was not aware of how to boot and delete says file in system32.
I was thinking I could go around to companies doing their updates, for a fee of course. Waste a weekend, but make a bunch o money. But then it struck, how will I find the customers as their computers are down ...
Ideally one you just built without crowdstrike.
If you have important data trapped in userspace, print out some bitlocker keys and get in the car lmao.