(Credit: Andrey Rudakov/Bloomberg via Getty Images)
Microsoft is working on a new recovery mode for Windows that promises to prevent a repeat of the Crowdstrike outage that temporarily bricked millions of PCs back in July.
At the company’s Ignite event, Microsoft introduced an upcoming feature called Quick Machine Recovery for corporate IT administrators who oversee fleets of Windows PCs at their companies.
In July, a flawed software update from security provider CrowdStrike crashed at least 8.5 million Windows machines and caused many of them to display the "blue screen of death." As a result, numerous IT administrators had to manually fix the computers and servers before CrowdStrike launched an automatic fix.
The disastrous update prompted Microsoft to develop a new recovery option that’s apparently designed to work even if the machine is showing a blue screen of death. "This feature will enable IT Administrators to execute targeted fixes from Windows Update on PCs, even when machines are unable to boot, without needing physical access to the PC,” the company says.
Although details are thin, Microsoft adds: "This remote recovery will unblock your employees from broad issues much faster than what has been possible in the past. Quick Machine Recovery will be available to the Windows Insider Program community in early 2025.”
Microsoft is also nudging cybersecurity vendors away from building products that need access to the Windows kernel or what is effectively the brains of the OS. Many antivirus vendors use kernel access to monitor changes to the deepest parts of the OS. But that access is also why Crowdstrike’s faulty update accidentally bricked millions of computers this summer.
In September, Microsoft indicated it was working on a new security layer in Windows meant for antivirus monitoring without kernel-level access. At Ignite, the company said a preview of the new security layer will be available for antivirus vendors to try in July 2025.
"This means security products, like antivirus solutions, can run in user mode just as apps do,” Microsoft says. “This change will help security developers provide a high level of security, easier recovery, and there will be less impact to Windows in the event of a crash or mistake."