Free tools Windows power users keep installed
One-click scans. No signup required.
On July 19, 2024, Elon Musk posted on X: “We just deleted Crowdstrike from all our systems, so no rollouts at all.” The remark named CrowdStrike—not Windows—and Musk did not identify which companies or systems he meant. The global disruption was triggered by a faulty CrowdStrike update for its Falcon security software, affecting some Windows devices; it was not caused by a Windows update.
What Musk said—and what he did not specify
Musk’s post appeared as organizations around the world were dealing with Windows computers that would not start normally. His exact wording was: “We just deleted Crowdstrike from all our systems, so no rollouts at all.” The Guardian reported the post; Bloomberg also covered his claim.
As an Amazon Associate I earn from qualifying purchases.
The post does not say which company or business unit “we” referred to, what systems were included, or whether the action meant stopping future deployments or uninstalling software already in place. Reporting did not independently substantiate that CrowdStrike had been removed from every system at every Musk-owned company. It is therefore a public claim, not proof of a company-wide removal.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What caused the Windows crashes
CrowdStrike’s Falcon software runs on customer devices to detect security threats. The incident involved a Rapid Response Content configuration update—security content delivered to the Falcon sensor—not a routine Microsoft Windows update or a new Falcon sensor version.
#1 Best Overall
The July 19 timeline
- At 04:09 UTC, CrowdStrike released the faulty content update.
- The affected scope included Windows hosts running Falcon sensor version 7.11 or later that were online during the relevant window and received the update.
- At 05:27 UTC, CrowdStrike reverted the problematic content. That stopped further delivery of the faulty update; it did not instantly restore every affected computer.
CrowdStrike’s technical account and preliminary incident review explain that an error in the content caused an out-of-bounds memory read in the sensor’s content interpreter. On affected Windows machines, the resulting unhandled exception led to a blue screen and could prevent normal startup.
Why the content caused a system failure
CrowdStrike’s later root-cause analysis said the sensor expected 20 input fields, but the update supplied 21. The mismatch led to the out-of-bounds read and crash. CrowdStrike and a third-party review concluded that this specific bug was not exploitable for privilege escalation or remote code execution. That finding concerns exploitability; it does not diminish the serious availability failure the update caused.
Rank #2
- PREMIUM-QUALITY RECORD BOOK FOR DEALERS & COLLECTORS: Clever Fox Firearms Record Book is designed to help professional firearm dealers keep detailed and legally compliant acquisition and disposition information.
- 129 PAGES WITH 1,342 NUMBERED ENTRIES TOTAL: There are 129 pages in this firearm log book with 1,342 numbered entries total. Each pre-printed entry allows you to record the firearm’s description, as well as receipt and disposition info.
- LARGE FORMAT & PLENTY OF SPACE FOR EVERY DETAIL: This firearm record book comes in large format and measures 10 by 7 inches, so you have lots of space to make detailed records and add all the information you need.
- STORAGE POCKET, DURABLE HARDCOVER & THICK NO-BLEED PAPER: This gun record book features a pocket for loose papers, a pen loop, an elastic band, and a bookmark. The hardcover is made of durable vegan leather. The pages are thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE: We will exchange or refund your book of firearms if you aren’t satisfied with your personal firearms record book for any reason. Reach out to us via message to refund your personal gun log book.
The specific incident affected Windows hosts. CrowdStrike said Mac and Linux hosts were not affected by this update. CrowdStrike announced publication of its root-cause analysis on August 6, 2024 and later reported that roughly 99% of Windows sensors were online by July 29, 2024.
Why this was a CrowdStrike failure affecting Windows—not a Windows update failure
Windows was the operating-system environment on the affected machines, but the trigger was defective CrowdStrike security content. Microsoft said the incident was not a Microsoft incident in its customer-impact statement. Calling it a “Windows outage” describes where the disruption was experienced; it does not identify Microsoft as the source of the faulty update.
Rank #3
Nor did every Windows computer or server fail. A device had to meet the relevant conditions, including running the affected Falcon sensor and receiving the content. Affected machines could include different kinds of Windows endpoints, not just conventional servers.
How broad was the disruption?
Microsoft estimated that approximately 8.5 million Windows devices were affected—less than 1% of all Windows devices. The small share still translated into widespread disruption because the affected systems included devices used by organizations across sectors such as airlines, healthcare, retail, financial services and public infrastructure.
The number is Microsoft’s estimate of affected devices, not a count of all Windows machines that stopped working. A global reach can result from a comparatively small percentage when a shared software update reaches business-critical systems across many organizations.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat Musk’s post can and cannot establish
The post establishes that Musk publicly said his organizations had deleted CrowdStrike to prevent further rollouts. It does not independently establish:
- Which companies, teams or deployment groups were included.
- Whether software was uninstalled, or whether only new rollouts were stopped.
- Whether the change covered employee computers, servers, manufacturing equipment or other systems.
- Whether removal was temporary, whether a replacement was installed, or when the action occurred relative to CrowdStrike’s reversion.
Without a company-specific confirmation, the post should not be treated as evidence that Tesla, SpaceX, X or another named organization completely removed the product. Musk’s remark is commentary about his stated response, not technical evidence about the cause of the crash.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Was it a cyberattack?
No. CrowdStrike described the event as a software-update problem, not a cyberattack; Microsoft likewise did not attribute it to a Microsoft security incident. The outage nevertheless created an opportunity for criminals to exploit confusion. CrowdStrike warned that people were impersonating its support operation and offering fake recovery tools or scripts. Follow the guidance of your organization’s IT team or the vendor’s verified channels, and do not download unsolicited “fixes” from unofficial domains.
What IT teams can take from the incident
The failure showed how a security update intended to protect systems can itself become an operational risk when a defect reaches production devices. Removing endpoint protection may reduce exposure to one vendor’s update risk, but doing so without an equivalent safeguard can create a security gap. Switching providers is also a managed migration, not an instant repair.
Reduce the blast radius of updates
- Deploy updates through staged rings or canary groups before broad rollout, with critical systems isolated from the first wave.
- Validate dynamic security content and define rollback criteria alongside tests for the sensor software itself.
- Maintain an inventory showing which devices run each security agent and which update policies apply to them.
Prepare for recovery without normal startup
- Keep recovery media, offline administrative access and tested procedures for Windows Recovery Environment or Safe Mode.
- Verify that administrators can reach affected devices when ordinary remote-management tools are unavailable.
- Plan redundant communication channels for vendor incidents, since email or a single collaboration platform may also be disrupted.
Evaluate vendors on operational controls
When reviewing endpoint-security platforms, compare staged-deployment options, rollback mechanisms, policy granularity, offline recovery, support arrangements, integrations and migration costs. A different vendor is not automatically safer because it did not cause this particular incident. Before removing an agent, document what will replace its protection and how telemetry, response procedures and administrator training will change.
CrowdStrike’s incident review described corrective measures including staged deployment, enhanced testing, fuzzing, fault injection, stronger content validation, improved error handling, more granular customer controls and third-party reviews. These are the kinds of safeguards customers can ask vendors about, while also maintaining their own rollout and recovery plans.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
