I feel like there is a lot of misunderstanding on what's going on with Crowdstrike.

As I understand it - a patch was pushed onto the systems that use it with a bad .sys file or something. Once this sys file is removed, everything is fine. It's not an attack (persay).

The problem comes into play when a system needs to update to be fixed but cant. A lot of these employees do not have administrator access to be able to safeboot and remove the .sys file. Thus each computer needs to be reset manually.