This article covers the uninstall process for CrowdStrike Falcon Sensor.
Affected Products:
- CrowdStrike Falcon Sensor
Affected Operating Systems:
Instructions to uninstall CrowdStrike Falcon Sensor differ depending on whether Windows, Mac, or Linux is in use. Click the appropriate operating system for the uninstall process.
Windows
CrowdStrike Falcon Sensor can be removed on Windows through the:
- User interface (UI)
- Command-line interface (CLI)
Click the appropriate method for more information.
UI
- Right-click the Windows Start menu and then select Apps and Features.
Note: The Apps and Features tool is called Add or Remove Programs on Windows 7.
- Select CrowdStrike Windows Sensor and then click Uninstall.
Note: The version in the example may differ from your environment.
- Click Uninstall.
- If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.
- If using a maintenance token, go to Step 6. Otherwise go to Step 7.
- Populate the maintenance token and then click Uninstall.
- Click Uninstall.
- On uninstall, click Close.
- Right-click the Windows Start menu and then select Apps and Features.
Note: The Apps and Features tool is called Add or Remove Programs on Windows 7.
- Select CrowdStrike Windows Sensor and then click Uninstall.
Note: The version in the example may differ from your environment.
- Click Uninstall.
- If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.
- For password-protected installations, go to Step 6. For regular installations, go to Step 7.
- Enter your Falcon installation password, click Uninstall, and then go to Step 8.
- Click Uninstall.
- On uninstall, click Close.
- Right-click the Windows Start menu and then select Apps and Features.
Note: The Apps and Features tool is called Add or Remove Programs on Windows 7.
- Select CrowdStrike Windows Sensor and then click Uninstall.
Note: The version in the example may differ from your environment.
- Click Uninstall.
- If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.
- Click Uninstall.
- If CrowdStrike Falcon Sensor is password-protected, click OK and go to the CLI uninstall section. Otherwise, go to Step 7.
- On uninstall, click Close.
CLI
Note:
- Switches are not case-sensitive.
- If User Access Control (UAC) is enabled, administrator rights should be used to perform uninstall.
Switch |
Required |
Purpose |
/passive |
No |
The installer shows a minimal UI with no prompts. |
/quiet |
No |
Suppresses UI and prompts. |
/log |
No |
Changes the default installation log directory from %Temp% to a new location. The new location must be contained in quotation marks (""). |
Note: Parameters are case-sensitive.
Switch |
Value |
Required |
Purpose |
MAINTENANCE_TOKEN |
See Examples |
No |
Prevents uninstall without a maintenance password. |
CLI Installation Examples:
Example #1
CsUninstallTool.exe MAINTENANCE_TOKEN=a0c76aa097218dc446082 /quiet
Example #1 contains:
- Installer = CsUninstallTool.exe
- Silent install = Yes
- End-user installation prompts = No
- Maintenance token = Yes
- Installation log directory =
%TEMP%
- Default value since not defined.
Note: The example maintenance token will differ in your environment.
Example #2
CsUninstallTool.exe /passive /log "C:\Logs"
Example #2 contains:
- Installer = CsUninstallTool.exe
- Silent install = No
- Default value since not defined.
- End-user installation prompts = No
- Password Protected = No
- Default value since not defined.
- Installation log directory =
C:\Logs
Note:
- Switches are not case-sensitive.
- If User Access Control (UAC) is enabled, administrator rights should be used to perform uninstall.
Switch |
Required |
Purpose |
/passive |
No |
The installer shows a minimal UI with no prompts. |
/quiet |
No |
Suppresses UI and prompts. |
/log |
No |
Changes the default installation log directory from %Temp% to a new location. The new location must be contained in quotation marks (""). |
Note: Parameters are case-sensitive.
Switch |
Value |
Required |
Purpose |
PW= |
See Examples |
No |
Prevents uninstall without a password. Password must be contained in quotation marks (""). Parameter must go directly after the file. |
CLI Installation Examples:
Example #1
CsUninstallTool.exe PW="Ex@mpl3" /quiet
Example #1 contains:
- Installer = CsUninstallTool.exe
- Silent install = Yes
- End-user installation prompts = No
- Password Protected = Yes
- Installation log directory =
%TEMP%
- Default value since not defined.
Example #2
CsUninstallTool.exe /passive /log "C:\Logs"
Example #2 contains:
- Installer = CsUninstallTool.exe
- Silent install = No
- Default value since not defined.
- End-user installation prompts = No
- Password Protected = No
- Default value since not defined.
- Installation log directory =
C:\Logs
Mac
Click the appropriate client version for specific uninstall steps. For more information, reference How to Identify the CrowdStrike Falcon Sensor Version.
v5.10.9003 and Later
CrowdStrike Falcon Sensor can be removed either in Normal or Protected (maintenance token) mode. Protected mode prevents the unauthorized unload, uninstall, repair, or manual upgrade of the sensor. Click the appropriate mode for more information.
- In the Apple menu, click Go and then select Utilities.
- In the Utilities folder, double-click Terminal.
- In Terminal, type
sudo /Library/CS/falconctl uninstall
and then press Enter.
- Populate the password for sudo and then press Enter.
Warning: CrowdStrike Falcon Sensors that are deployed with a maintenance token fail on uninstall. Go to the Protected section for uninstall steps.
- Once uninstallation is complete, exit Terminal.
- In the Apple menu, click Go and then select Utilities.
- In the Utilities folder, double-click Terminal.
- In Terminal, type
sudo /Library/CS/falconctl uninstall ––maintenance-token
and then press Enter.
Note: Two "-"must be used before maintenance-token.
- Populate the password for sudo and then press Enter.
- Populate a Maintenance Token and then press Enter.
- Once uninstallation is complete, exit Terminal.
v4.28.8907 and Earlier
CrowdStrike Falcon Sensor can be removed either in Normal or Protected (maintenance token) mode. Protected mode prevents the unauthorized unload, uninstall, repair, or manual upgrade of the sensor. Click the appropriate mode for more information.
- In the Apple menu, click Go and then select Utilities.
- In the Utilities folder, double-click Terminal.
- In Terminal, type
sudo /Library/CS/falconctl uninstall
and then press Enter.
- Populate the password for sudo and then press Enter.
Warning: Password-protected installs of CrowdStrike Falcon Sensor fail to uninstall. Go to the Protected section for uninstall steps.
- Once uninstallation is complete, exit Terminal.
- In the Apple menu, click Go and then select Utilities.
- In the Utilities folder, double-click Terminal.
- In Terminal, type
sudo /Library/CS/falconctl uninstall –password
and then press Enter.
- Populate the password for sudo and then press Enter.
- Populate a Password and then press Enter.
- Once uninstallation is complete, exit Terminal.
Linux
Based on your Linux distribution, run the appropriate command to uninstall the CrowdStrike Falcon Sensor from your host.
Note: Uninstalling the CrowdStrike Falcon Sensor requires sudo
privileges.
Red Hat Enterprise Linux, CentOS, Amazon Linux
From Terminal, type sudo yum remove falcon-sensor
and then press Enter.
SUSE Linux Enterprise Server (SLES)
From Terminal, type sudo zypper remove falcon-sensor
and then press Enter.
Ubuntu
From Terminal, type sudo apt-get purge falcon-sensor
and then press Enter.