Crowdstrike - Falcon sensor for Windows

📄 Requirements

For configuring and operating the Falcon sensors, the host computer and MFA device must be able to reach Crowdstrike cloud. In case there are any connection issues, check out Crowdstrike - Cloud Connection Troubleshooting.

⚙️ Installation for Windows

Manual installation

If you have a small number of installs to do, manual installation might be your best option.

1. Download the Falcon sensor installer appropriate for your system.
   You have these types of sensor installers to choose from:

   Important: Starting with Falcon sensor for Windows version 7.19, only the unified installer is available. Any previously released, cloud-specific installers will remain available as long as the associated sensors are supported. We recommend using the unified installer whenever possible.

   • Unified installer. A single installer that works for these CrowdStrike clouds: US-1, US-2, and EU-1. This installer does not work for US-GOV-1 or US-GOV-2. The downloaded file has this name: FalconSensor_Windows.exe
   • Cloud-specific installer. The installer works for only one of the CrowdStrike clouds: US-1, US-2, EU-1, US-GOV-1, or US-GOV-2. The downloaded file has a name that varies by the cloud: WindowsSensor.exe or WindowsSensor.<cloud>.exe
     
     
2. Get your Customer ID Checksum (CID)

3. Copy the sensor installer to the endpoint and double-click the installer.
   
   

4. Accept the license agreement and enter your CID.
   
   

5. If your OS prompts to allow the installation, click Yes.
   
   

Automatic installation

To automate silent installations on many devices, including installations using a deployment tool such as Windows System Center Configuration Manager (SCCM), complete these steps.

1. Download the Falcon sensor installer appropriate for your system.

   You have these types of sensor installers to choose from:

   Important: Starting with Falcon sensor for Windows version 7.19, only the unified installer is available. Any previously released, cloud-specific installers will remain available as long as the associated sensors are supported. We recommend using the unified installer whenever possible.

   • Unified installer. A single installer that works for these CrowdStrike clouds: US-1, US-2, and EU-1. This installer does not work for US-GOV-1 or US-GOV-2. The downloaded file has this name: FalconSensor_Windows.exe
   • Cloud-specific installer. The installer works for only one of the CrowdStrike clouds: US-1, US-2, EU-1, US-GOV-1, or US-GOV-2. The downloaded file has a name that varies by the cloud: WindowsSensor.exe or WindowsSensor.<cloud>.exe
     
     

2. Get your Customer ID Checksum (CID)
   
   

3. Run or configure your deployment tool to use this command, replacing <installer_filename> with the name of the install file you downloaded, and <CCID> with the CCID from step 2 :

   <installer_filename> /install /quiet /norestart CID=<CID>
   
   

🛠️ Post-installation steps

Verifying sensor installation

Host

To validate that the Falcon sensor for Windows is running on a host, run this command at a command prompt:

sc.exe query csagent

This output will appear if the sensor is running:

SERVICE_NAME: csagent 
TYPE : 2 FILE_SYSTEM_DRIVER 
STATE : 4 RUNNING (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN) 
WIN32_EXIT_CODE : 0 (0x0) 
SERVICE_EXIT_CODE : 0 (0x0) 
CHECKPOINT : 0x0 
WAIT_HINT : 0x0

⛔ Uninstalling the Falcon sensor for Windows

Uninstalling using the Control Panel

1. Open the Windows Control Panel running it as administrator.
2. Click Uninstall a Program.
3. Choose CrowdStrike Windows Sensor and uninstall it, providing the maintenance token through the installer if necessary.

Uninstalling using the command line

1. Download Falcon Windows Sensor, Uninstall Tool from Tool Downloads

2. Open a command prompt with administrative privileges and run this command:

   CsUninstallTool.exe /quiet

Uninstall protection cases

In some situations a token is required to uninstall the sensor. In such cases, get the token with UPX and run the following command to uninstall:

CsUninstallTool.exe MAINTENANCE_TOKEN=<token> /quiet

Validating the uninstallation

When the sensor has been uninstalled:

• The sensor does not appear in your programs list
• The directory C:\\Windows\\System32\\drivers\\CrowdStrike is not present
• The registry key HKLM\\System\\Crowdstrike does not appear in the registry