Viewable by the world
Group Access to IT Frequently Asked Questions (FAQ)
Can VIEW the space: itfaq-editors ,  anonymous ,  itfaq-MFA-EDITORS ,  itfaq-itss ,  all-lbnl-users ,  mpsg-staff ,  itfaq-editors-lite ,  mpsg-mpsg-helpdesk ,  google-collab-documentation-management , 
Can EDIT the space: itfaq-editors-lite ,  itfaq-editors ,  mpsg-staff ,  google-collab-documentation-management ,  mpsg-mpsg-helpdesk , 
Can ADMINISTER the space:
Individual Access to IT Frequently Asked Questions (FAQ)
Can VIEW the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 
Can EDIT the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 
Can ADMINISTER the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 

Versions Compared

Old Version 20

changes.mady.by.user Tap L

Saved on

compared with

New Version Current

changes.mady.by.user Tap L

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Purpose of Knowledge Article:

...

  • A guide on how to install or uninstall CrowdStrike Falcon from Berkeley Lab computers

...

Resolution:

  • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon chipsets
  • The install instructions for Windows also apply to CrowdStrike For Home

Resolution:

Warning

IMPORTANT:

  • Be sure to select the correct instructions for the operating system you are using
  • It is highly recommended to read the instructions before installing CrowdStrike Falcon

If you have Sophos Antivirus:

  • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you.
  • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process.

Install CrowdStrike Falcon

Expand the instruction instructions for the operating system you are using:

Expand
titleCrowdStrike Falcon Install Instruction for Mac
Deck of Cards
idCrowdstrike Install macOS
tabLocationleft
Card
labelmacOS 15 Sequoia
titlemacOS 15 Sequoia
Note

The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

Expand
titleStep 1 - Install CrowdStrike Falcon on macOS 15 Sequoia
Under development
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download
CrowdStrike Falcon Sensor for macOS		no image
2Browse to the location where the file LBL_CS_MacOS_12_13 is downloaded to, and right-click on it

Image Removed

3Click  Open
4

Click Open to the popup saying "macOS cannot verify the developer of LBL_CS_MacOS_12_13. Are you sure you want to open it?"

Crowdstrike Falcon 1.6no image
4

Run the CrowdStrike installer you just downloaded

no image

5Click Continue for the "Introduction" and "Read Me" section

Image AddedImage Added


Leave the default destination as it is and click Continue

Note: if you do not see this screen, continue to the next step.

Image Added

6Click Install

Image Added

7Type in your computer password

Image Added

8Click Install Software
9Click Allow to the popup saying "'Falcon' would like to filter network content"

Image Added

10

A "System Extension Blocked" popup will appear, click Open System Settings


Warning

If the OK button was mistakenly clicked instead of Open System Settings here. A window from CrowdStrike will pop up (see below image) at some point during or after the installation.
Follow this instruction to fix it.

Image Added

Image Added

11For Falcon, slide the toggle to on (it will turn blue)

Image Added

12Type in your computer password

Image Added

13Click OK
14Click Done

Image Added

15

click OK on the popup saying "Installer would like to modify apps on your Mac"

Note

You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

Image Added

Image Added

16Click Close 

Image Added

17

Click Move to Trash and continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 13 and newer - CrowdStrike Falcon Full Disk Access
macOS 13 and newer - CrowdStrike Falcon Full Disk Access

Card
labelmacOS 13 Ventura and 14 Sonoma
titlemacOS 13 Ventura and 14 Sonoma
Note

The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

Expand
titleStep 1 - Install CrowdStrike Falcon on macOS 13 Ventura and 14 Sonoma
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6no image
4

Run the CrowdStrike installer you just downloaded

no image

5Click Continue for the "Introduction" and "Read Me" section

Image AddedImage Added


Leave the default destination as it is and click Continue

Note: if you do not see this screen, continue to the next step.

Image Added

6Click Install

Image Added

7Type in your computer password

Image Added

8Click Install Software
9Click Allow to the popup saying "'Falcon' would like to filter network content"

Image Added

10A "System Extension Blocked" popup will appear, click Open System Settings

Image Added

11Select Privacy & Security

Image Added

12Look for "System software from application "Falcon" was blocked from loading"
13Click Allow
14Type in your computer password

Image Added

15Click Unlock
16

click OK on the popup saying "Installer would like to modify apps on your Mac"

Note

You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

Image Added

Image Added

17Click Close 

Image Added

18

Click Move to Trash and continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 13 and newer - CrowdStrike Falcon Full Disk Access
macOS 13 and newer - CrowdStrike Falcon Full Disk Access

Card
labelmacOS 12 Monterey
Note

The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

Expand
titleStep 1 - Install CrowdStrike Falcon on macOS 12 Monterey
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for macOS 12 and newerno image
2Run the CrowdStrike installer you just downloaded

no image

Image Removed

5Click Continue for the "Introduction" and "Read Me" section

Image ModifiedImage Modified

6

Leave the default destination as it is and click Continue

Note: if you do not see this screen, continue to the next step.

Image Modified

7Click Install

Image Modified

8Type in your computer password

Image Modified

9Click Install Software
10Click Allow to the popup saying "com.crowdstrike.falcon.app" would like to filter network content"

Image Modified

11A "System Extension Blocked" popup will appear
"
, click Open Security Preferences

Image Modified

12Select Security & Privacy

Image Modified

13Click the Lock icon on the bottom left

Image Modified

14Type in your computer password
15Click Unlock
16

Look for "System software from application "Falcon.app" was blocked from loading", and click Allow

Note

You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

Image Added

Image Modified

17Installation is done. Click Close 

Image Modified

18
You may select Keep or 

Click Move to Trash 

depending on if you want to keep the CrowdStrike Falcon installer file or delete it

and continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 11 and 12 - CrowdStrike Falcon Full Disk Access
macOS 11 and 12 - CrowdStrike Falcon Full Disk Access

Card
labelmacOS 11 Big Sur
Note
  • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets
  • Please be aware that CrowdStrike Falcon support for macOS 11 (Big Sur) will be discontinued on December 31, 2023
    • You will need to upgrade to a supported version of macOS and if you need help with the upgrade, email [email protected]
Image Removed
Expand
titleStep 1 - Install CrowdStrike Falcon
Install Instruction for Windows
on macOS 11 Big Sur
1Go to
https://
software.lbl.gov
/
and download CrowdStrike Falcon Sensor for
Windows
macOS 11no image
2Browse to the location where the file LBL_CS
_WinInstaller is downloaded to
_MacOS11_vX.X is downloaded, and
right
double-click on it

Image Added

3

It will extract a folder called LBL_CS_MacOS11_vX.X, open it.

Leave this folder open, you will return to it

Image Removed

3Select Extract All4

In the Files will be extracted to this folder field

Type in or copy and paste C:\Options

Image Removed

5Make sure Show extracted files when complete box is checked6Click Extract7

Once extraction is done, a new window for C:\Options will pop up

Locate the file runasadmin, and right-click on it

Image Removed

8Select Run as administrator

.

Image Added

4Right-click on the GovLagger... file

Image Added

5Select Open With
6Select Installer
7Click Continue for the "Introduction" and "Read Me" section

Image AddedImage Added

8Click Install

Image Added

9Type in your computer password

Image Added

10Click Install Software
11Click Close

Image Added

12Return to the LBL_CS_MacOS11_vX.X folder from step 3 and right-click on the file configuration.command

Image Added

13Select Open With
14Select Terminal
15Click Open to the popup saying "macOS cannot verify the developer of "configuration.command". Are you sure you want to open it?"

Image Added

16

In the terminal window that pops up, type in your computer password and hit enter

Note: no character will appear when you type the password here.

Image Added

17Click Allow to the popup saying "Falcon would like to filter network content"

Image Added

18A "System Extension Blocked" popup will appear, click Open Security Preferences

Image Added

19Select Security & Privacy

Image Added

20Click the Lock icon on the bottom left

Image Added

21Type in your computer password
22Click Unlock
23Look for "System software from application "Falcon" was blocked from loading", and click Allow

Image Added

24

This process may take between 3-8 minutes. Once done you will see it say [Process Completed]

Continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 11 and 12 - CrowdStrike Falcon Full Disk Access
macOS 11 and 12 - CrowdStrike Falcon Full Disk Access

Card
labelInstall CrowdStrike Falcon via BigFix

Please visit:

You may see Windows Protected your PC popup
Expand
titleCrowdStrike Falcon Install Instruction for Windows
Deck of Cards
idCSF Windows
tabLocationleft
Card
labelManually Install CrowdStrike Falcon
Note

Instructions for Windows 10 and Windows 11 are essentially the same. The main difference is how they look.

The install instructions for Windows also apply to CrowdStrike For Home.


HTML
<iframe src="https://drive.google.com/file/d/189nVO4g-Au8jY4sDcfUMDg-GCdFkqseN/preview" width="1280" height="720" allow="autoplay"></iframe>
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for Windowsno image
2Browse to the location where the file LBL_CS_Win_Installer_vX.X is downloaded, and double-click on it

Image Added

3

You may see the popup"Windows Protected your PC"

9

Click More info

If not, skip to Step

11

5

Image Removed

Image Added

10
4Click Run anyway
Image Removed

Image Added

11
5

The pop-up "Do you want to allow this app to make changes to your device?" will

pop up

appear

Click Yes

Image Modified

12
6

A command prompt window will appear stating "This may take several minutes. This window will close when the full process is complete"

This process will take between 4 to 10 minutes

If you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

Image Removed

13
Note

During this process, you may see the following notifications in the bottom right corner. You can ignore it.

Image Added

Image Added

This happens because during the transient state, Sophos Antivirus is being removed and CrowdStrike Falcon is being installed.

Image Added

7

Once the command prompt window disappears. You are done.

no image14

If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?

no image
Card
labelInstall CrowdStrike Falcon via BigFix

Please visit:


Uninstall CrowdStrike FalconExpand the instruction for the operating system you are using:

Note

Before you proceed to uninstall CrowdStrike Falcon, please complete the CrowdStrike Falcon Maintenance Token Request form. Once you received the maintenance token, you can follow the instructions below to uninstall CrowdStrike Falcon.

Expand
titleCrowdStrike Falcon Uninstall Instruction for Mac
Deck of Cards
Under development
idmacOS CSF uninstall
tabLocationleft
Card
labelmacOS 13 Ventura and 14 Sonoma
Expand
titlePart 1
1

Be sure to quit the Terminal app before beginning


Under the Apple icon in the top left corner, click System Settings

Image Added

2On the left column, select Privacy & Security

Image Added

3On the right column, select App Management
4Click the + icon

Image Added

5Select Utilities 

Image Added

6Select Terminal
7Click Open
8Type in your computer password

Image Added

9Click Unlock
10

The Terminal app should now appear under App management

Continue to Part 2


Info
titleinfo

If you left the Terminal app running, you will this popup:

Image Added

You can click Later and manually quit the Terminal app or click Quit & Reopen so the system does it for you now.

This needs to be done before continuing to Part 2.

Image Added

Expand
titlePart 2

Excerpt Include
Install/Uninstall CrowdStrike Falcon
Install/Uninstall CrowdStrike Falcon
nopaneltrue

Card
labelmacOS 11 BiG Sur and macOS 12 Monterey
Excerpt
1Launch the Terminal app from the Utilities folder

Image Added

2

Run sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t

Image Added

3Type in your computer password and hit Enter key on your keyboardImage Added
4

Copy and paste in the maintenance token you received

Note: nothing will show up as you input the maintenance token, so be sure to only paste it once and hit enter

Image Added

5

You will see a confirmation saying "Falcon is uninstalled"

Note: you must restart the computer to complete the uninstallation process

Image Added

Expand
titleCrowdStrike Falcon Uninstall Instruction for Windows
1Click on the Start Menu icon


2Type in Control Panel
3Click Control Panel
4Click Programs and Features

5Select CrowdStrike Windows Sensor in the list

6Click Uninstall
7

The Do you want to allow this app to make changes to your device will pop up

Click Yes

8Paste or type in the maintenance token

Image Added

9Click Uninstall

Image Removed

910The uninstallation process will take a moment. When it is done, click Close

...