Skip to content

Commit

Permalink
Updating readme (#7)
Browse files Browse the repository at this point in the history
Co-authored-by: Chris Fraser <christopher.fraser@crowdstrike.com>
  • Loading branch information
swefraser and Chris Fraser authored Jul 22, 2024
1 parent 8a37d57 commit ba2f31e
Showing 1 changed file with 10 additions and 0 deletions.
10 changes: 10 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,16 @@

Build your own bootable image files to automate the recovery of Windows hosts affected by the recent [Falcon Content Update](https://www.crowdstrike.com/falcon-content-update-remediation-and-guidance-hub/).

There are two bootable image types available. Use the ISO image that best suits your needs.

- **CSPERecovery** - This image uses Windows PE to remove the impacted Channel File 291 with minimal user interaction.
- If the volume has BitLocker Encryption, the bootable image will prompt for the BitLocker Recovery Key before performing the automated remediation.


- **CSSafeBoot** - This image uses Windows PE to reboot the host into Safe Mode with Networking to allow manual removal of Channel File 291 using Windows Explorer or Command Prompt
- If the volume has BitLocker Encryption, the Recovery Key is not required
- Useful for systems having difficulty entering Safe Mode

## Create Bootable Images

The following procedure will produce two bootable ISO images using the latest Microsoft ADK and Windows PE add-ons and drivers, along with common storage and input drivers for enterprise storage controllers including VirtIO, Intel RAID, VMware accelerated virtual storage, etc. These ISO images will also include the Falcon Windows Sensor host recovery scripts.
Expand Down

0 comments on commit ba2f31e

Please sign in to comment.