(1) Keep backup of all .sys files on healthy boot, (2) When bluescreen, log for recovery on next boot, (3) At recovery boot, load each .sys, (3a) If healthy, log it into safe batch, (3b) If bluescreen, mark it as unhealthy on next boot, (4) Continue until you have a list of healthy and unhealthy .sys, (5) Restore unhealthy from backup, (6) Disable automatic updates for unhealthy .sys, (7) Log alert for system administrator
Is there any reason this isn't something that's implemented? I really am just curious and would love your thoughts, as I do find this area very interesting.
Thanks!
In this case, however, the .sys files aren’t drivers, just config files that have a .sys extension, so such a recovery mechanism would have to be part of CrowdStrike, not Windows.