Post-CrowdStrike, Microsoft to discourage use of kernel drivers by security tools

Microsoft outlined best practices and new initiatives to improve reliability after the CrowdStrike Falcon driver update caused widespread Windows crashes, urging security vendors to minimize kernel-mode usage and move auxiliary functions like configuration parsing to user mode for better isolation and recoverability. The article explains that the faulty file system filter driver update triggered an out-of-bounds read leading to system crashes, and details Microsoft’s plans for safer rollouts, reduced kernel driver access to security data, enhanced isolation via VBS enclaves, and high-integrity attestation, while noting clarification on how the 8.5M impacted-device estimate was derived from a subset of crash reports.