{"id":28409992,"url":"https://github.com/crowdstrike/gcp-cf-remediation","last_synced_at":"2026-02-15T23:03:18.456Z","repository":{"id":249566208,"uuid":"831525451","full_name":"CrowdStrike/gcp-cf-remediation","owner":"CrowdStrike","description":"Remediation script for BSOD in GCP","archived":false,"fork":false,"pushed_at":"2024-07-22T02:31:28.000Z","size":22,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":10,"default_branch":"main","last_synced_at":"2025-06-02T21:10:54.449Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CrowdStrike.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-07-20T20:16:27.000Z","updated_at":"2024-07-25T01:25:06.000Z","dependencies_parsed_at":"2024-07-21T22:17:57.082Z","dependency_job_id":null,"html_url":"https://github.com/CrowdStrike/gcp-cf-remediation","commit_stats":null,"previous_names":["crowdstrike/gcp-cf-remediaton"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/CrowdStrike/gcp-cf-remediation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fgcp-cf-remediation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fgcp-cf-remediation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fgcp-cf-remediation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fgcp-cf-remediation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CrowdStrike","download_url":"https://codeload.github.com/CrowdStrike/gcp-cf-remediation/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Fgcp-cf-remediation/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259559625,"owners_count":22876495,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-02T11:09:35.319Z","updated_at":"2026-02-15T23:03:13.431Z","avatar_url":"https://github.com/CrowdStrike.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# GCP CrowdStrike File Remediation Script\n\nA Python script designed to remediate CrowdStrike files causing a blue screen of death (BSOD) on Windows machines in Google Cloud Platform (GCP).\n\n## Overview\n\nThis script is intended to run on a recovery machine in GCP to remediate files related to CrowdStrike that are causing a blue screen of death (BSOD) on Windows machines. The script performs the following steps on a list of provided instances:\n\n1. Take a snapshot of the boot disk.\n2. Create a disk from that snapshot.\n3. Attach the new disk to the recovery machine as a secondary disk.\n4. Delete the problematic files.\n5. Detach the new disk from the recovery machine.\n6. Shut down the impacted instance.\n7. Detach the original disk from the impacted instance.\n8. Attach the modified disk to the impacted instance.\n9. Optionally power the impacted instance on.\n\nThis process allows the sensor to initialize without loading the problematic files.\n\n## Disclaimers\n\n- This script will not work with customer-managed encryption keys (CMEK).\n- Snapshots and disks are not deleted in this process. They should be cleaned up after recovery has been verified.\n- The name of the attached disk will change during the process, which may impact any external automation that looks at resource names, such as Terraform.\n- Ensure any labels and tags are still applied to the disk after recovery.\n- A recovery instance is needed for each zone that contains impacted instances.\n\n## Prerequisites\n\n### Recovery Machine\n\n\u003e [!WARNING]\n\u003e A recovery machine must be created in the project, region, and zone that impacted instances are in.\n\nThe following are the requirements for the recovery machine:\n\n- Must be a Windows machine.\n  - This was tested with `windows-server-2019-dc-v20240711`, but any current Windows instance should work.\n- This instance must have a **single drive** attached.\n- Must be able to download/install files from the internet.\n- Must be created from a different image than the impacted instances that will be recovered.\n  - Windows will not assign a drive letter to disks with the same signature.\n\n### GCP Credentials\n\n1. Go to the IAM \u0026 Admin page.\n2. Create a service account with the following roles:\n   - ***Compute Admin***\n   - ***Service Account User***\n3. Click on Manage Keys.\n   - Create a new JSON key.\n4. Save this file locally in case you need it again.\n5. Copy it to the recovery machine.\n\n### Python Installation\n\nA modern version of Python must be installed.\n\n\u003e This script was tested with 3.12.4.\n\n#### Example Python Installation\n\nRun the following in PowerShell as administrator:\n\n```PowerShell\n$file = \"https://www.python.org/ftp/python/3.12.4/python-3.12.4-amd64.exe\"\nInvoke-WebRequest -Uri $file -OutFile python-3.12.4-amd64.exe\n./python-3.12.4-amd64.exe /quiet InstallAllUsers=0 InstallLauncherAllUsers=0 PrependPath=1 Include_test=0\n```\n\nClose PowerShell and reopen it as administrator:\n\n```PowerShell\npython -m venv env\n.\\env\\Scripts\\Activate.ps1\npip install -U google-auth google-cloud-compute\n```\n\n## Usage\n\n### Options\n\n```\n  -h, --help            show this help message and exit\n  --credentials CREDENTIALS\n                        The path to the json file holding the GCP credentials.\n  --project PROJECT     The GCP project to operate in\n  --region REGION       The GCP region to operate in.\n  --zone ZONE           The GCP zone to operate in.\n  --instance_names [INSTANCE_NAMES ...]\n                        The names of the instances to recover separated by a space\n  --recovery_instance_name RECOVERY_INSTANCE_NAME\n                        The name of the instance that will act as the recovery machine.\n  --instance_list_csv INSTANCE_LIST_CSV\n                        The path to a csv file with a list of impact instaces\n  --leave_powered_off   Leave the instances in a powered off state. By default, instances will be powered on after the new disk is attached.\n  --drive_letter {D,E,F,G}\n                        The drive letter to search for problematic files on. The default drive will be \"D\".\n```\n\n### Download the script\n\nTo download the script, run the following in PowerShell:\n\n```PowerShell\n$file = \"https://raw.githubusercontent.com/CrowdStrike/gcp-cf-remediation/main/gcp_cf_remediation.py\"\nInvoke-WebRequest -Uri $file -OutFile gcp_cf_remediation.py\n```\n\n### Examples\n\n#### Running the script with a list of impacted instances\n\nImpacted instances can be provided as a list from the command line\n\n```PowerShell\n$GCP_CREDENTIALS = \"Path to your credential file\"\n$PROJECT = \"Your Project\"\n$REGION = \"Your Region\"\n$ZONE = \"Your Zone\"\n$RECOVERY_INSTANCE = \"Your Recovery Instance\"\npython gcp_cf_remediation.py --credentials $GCP_CREDENTIALS --project $PROJECT --region $REGION --zone $ZONE --recovery_instance_name $RECOVERY_INSTANCE --instance_names impacted-instance-1 impacted-instance-2\n```\n\n#### Running the script with a list of impacted instances from a CSV file\n\nAlternatively a CSV file can also be used for the list of instances to run recovery on\n\n\u003e Example CSV file (`SomeFile.csv`):\n\u003e\n\u003e ```csv\n\u003e impacted-instance-1,impacted-instance-2\n\u003e ```\n\n```PowerShell\npython gcp_cf_remediation.py  --credentials $GCP_CREDENTIALS --project $PROJECT --region $REGION --zone $ZONE --recovery_instance_name $RECOVERY_INSTANCE --instance_list_csv \"SomeFile.csv\"\n```\n\n#### Managing state of the instances after recovery\n\nBy default the instances will be powered on after they are recovered, if you do not want them to be powered on, use the `--leave_powered_off` flag\n\n\u003e [!NOTE]\n\u003e This flag will effect **all** instances being passed in.\n\u003e\n\u003e If you want to manage the state differently for different instances, it is recommended to separate the list of instances by state. This way you can run the script with the appropriate flags for each list.\n\n```PowerShell\npython gcp_cf_remediation.py  --credentials $GCP_CREDENTIALS --project $PROJECT --region $REGION --zone $ZONE --recovery_instance_name $RECOVERY_INSTANCE --instance_list_csv \"SomeFile.csv\" --leave_powered_off\n```\n\n#### Running the script to target a different drive letter\n\nBy default the `D` drive will be searched for impacted files.\n\nThis can be changed with the `--drive_letter` argument.\n\n```PowerShell\npython gcp_cf_remediation.py  --credentials $GCP_CREDENTIALS --project $PROJECT --region $REGION --zone $ZONE --recovery_instance_name $RECOVERY_INSTANCE --instance_list_csv \"SomeFile.csv\" --drive_letter \"E\"\n```\n\n### Output\n\nThe `gcp_cf_remediation.py` script will log to stdout and will also append logs to the following log files:\n\n- **output.log**: Contains all messages that get logged to stdout during the remediation attempt.\n- **error.log**: Contains all error events that happened during the remediation attempt.\n- **created_snapshots.log**: Contains a list of snapshots that were created during the remediation attempt.\n  - These can be deleted after remediation has been verified.\n- **original_disks.log**: Contains a list of disks from the impacted instances fixed by the remediation attempt.\n  - These can be deleted after remediation has been verified and it's been confirmed that they are no longer needed.\n\n## Statement of Support\n\nThis project is a community-driven, opens source project designed to remediate CrowdStrike files causing a blue screen of death (BSOD) on Windows machines in Google Cloud Platform (GCP). While not a formal CrowdStrike product, it is maintained by CrowdStrike and supported in partnership with the open source community.\n\nFor additional details, see the [SUPPORT](SUPPORT.md) file.\n\n## License\n\nSee the [LICENSE](LICENSE) file for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Fgcp-cf-remediation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcrowdstrike%2Fgcp-cf-remediation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Fgcp-cf-remediation/lists"}