Purpose of Knowledge Article:
- A guide on how to install or uninstall CrowdStrike Falcon from Berkeley Lab computers
- The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon chipsets
- The install instructions for Windows also apply to CrowdStrike For Home
Resolution:
| Warning |
|---|
IMPORTANT: - Be sure to select the correct instructions for the operating system you are using
- It is highly recommended to read the instructions before installing CrowdStrike Falcon
If you have Sophos Antivirus: - If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you.
- If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process.
|
Install CrowdStrike Falcon
Expand the instructions for the operating system you are using:
| Expand |
|---|
| title | CrowdStrike Falcon Install Instruction for Mac |
|---|
|
...
|
| install | Crowdstrike Install macOS |
|---|
| tabLocation | left |
|---|
| | Card |
|---|
| label | macOS 15 Sequoia |
|---|
| title | macOS 15 Sequoia |
|---|
| | Note |
|---|
The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets |
| Expand |
|---|
| title | Step 1 - Install CrowdStrike Falcon on macOS 15 Sequoia |
|---|
| | 1 | Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6 | no image | | 4 | Run the CrowdStrike installer you just downloaded | | | 5 | Click Continue for the "Introduction" and "Read Me" section |  Image Added Image Added
|
| Leave the default destination as it is and click Continue Note: if you do not see this screen, continue to the next step. |  Image Added
| | 6 | Click Install |  Image Added
| | 7 | Type in your computer password |  Image Added
| | 8 | Click Install Software | | 9 | Click Allow to the popup saying "'Falcon' would like to filter network content" |  Image Added
| | 10 | A "System Extension Blocked" popup will appear, click Open System Settings
| Warning |
|---|
If the OK button was mistakenly clicked instead of Open System Settings here. A window from CrowdStrike will pop up (see below image) at some point during or after the installation.
Follow this instruction to fix it.  Image Added
|
|  Image Added
| | 11 | For Falcon, slide the toggle to on (it will turn blue) |  Image Added
| | 12 | Type in your computer password |  Image Added
| | 13 | Click OK | | 14 | Click Done |  Image Added
| | 15 | click OK on the popup saying "Installer would like to modify apps on your Mac" | Note |
|---|
You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.  Image Added
|
|  Image Added
| | 16 | Click Close |  Image Added
| | 17 | Click Move to Trash and continue to Step 2 |  Image Added
|
|
| Expand |
|---|
| title | Step 2 - CrowdStrike Falcon Permissions |
|---|
| | Include Page |
|---|
| macOS 13 and newer - CrowdStrike Falcon Full Disk Access |
|---|
| macOS 13 and newer - CrowdStrike Falcon Full Disk Access |
|---|
|
|
|
| Card |
|---|
| label | macOS 13 Ventura and 14 Sonoma |
|---|
| title | macOS 13 Ventura and 14 Sonoma |
|---|
| | Note |
|---|
The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets |
| Expand |
|---|
| title | Step 1 - Install CrowdStrike Falcon on macOS 13 Ventura and 14 Sonoma |
|---|
| | 1 | Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6 | no image | | 4 | Run the CrowdStrike installer you just downloaded | | | 5 | Click Continue for the "Introduction" and "Read Me" section | Image AddedImage Added |
| Leave the default destination as it is and click Continue Note: if you do not see this screen, continue to the next step. | Image Added | | 6 | Click Install | Image Added | | 7 | Type in your computer password | Image Added | | 8 | Click Install Software | | 9 | Click Allow to the popup saying "'Falcon' would like to filter network content" | Image Added | | 10 | A "System Extension Blocked" popup will appear, click Open System Settings | Image Added | | 11 | Select Privacy & Security |  Image Added
| | 12 | Look for "System software from application "Falcon" was blocked from loading" | | 13 | Click Allow | | 14 | Type in your computer password |  Image Added
| | 15 | Click Unlock | | 16 | click OK on the popup saying "Installer would like to modify apps on your Mac" | Note |
|---|
You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green. Image Added |
| Image Added | | 17 | Click Close | Image Added | | 18 | Click Move to Trash and continue to Step 2 | Image Added |
|
| Expand |
|---|
| title | Step 2 - CrowdStrike Falcon Permissions |
|---|
| | Include Page |
|---|
| macOS 13 and newer - CrowdStrike Falcon Full Disk Access |
|---|
| macOS 13 and newer - CrowdStrike Falcon Full Disk Access |
|---|
|
|
|
| Card |
|---|
| | Note |
|---|
The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets |
| Expand |
|---|
| title | Step 1 - Install CrowdStrike Falcon on macOS 12 Monterey |
|---|
| | 1 | Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for macOS 12 and newer | no image | | 2 | Run the CrowdStrike installer you just downloaded | | | 5 | Click Continue for the "Introduction" and "Read Me" section | Image AddedImage Added | | 6 | Leave the default destination as it is and click Continue Note: if you do not see this screen, continue to the next step. | Image Added | | 7 | Click Install | Image Added | | 8 | Type in your computer password |  Image Added
| | 9 | Click Install Software | | 10 | Click Allow to the popup saying "com.crowdstrike.falcon.app" would like to filter network content" |  Image Added
| | 11 | A "System Extension Blocked" popup will appear, click Open Security Preferences | Image Added | | 12 | Select Security & Privacy |  Image Added
| | 13 | Click the Lock icon on the bottom left |  Image Added
| | 14 | Type in your computer password | | 15 | Click Unlock | | 16 | Look for "System software from application "Falcon.app" was blocked from loading", and click Allow | Note |
|---|
You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green. Image Added |
|  Image Added
| | 17 | Installation is done. Click Close | Image Added | | 18 | Click Move to Trash and continue to Step 2 | Image Added |
|
| Expand |
|---|
| title | Step 2 - CrowdStrike Falcon Permissions |
|---|
| | Include Page |
|---|
| macOS 11 and 12 - CrowdStrike Falcon Full Disk Access |
|---|
| macOS 11 and 12 - CrowdStrike Falcon Full Disk Access |
|---|
|
|
|
| Card |
|---|
| | Note |
|---|
- The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets
- Please be aware that CrowdStrike Falcon support for macOS 11 (Big Sur) will be discontinued on December 31, 2023
- You will need to upgrade to a supported version of macOS and if you need help with the upgrade, email [email protected]
|
| Expand |
|---|
| title | Step 1 - Install CrowdStrike Falcon on macOS 11 Big Sur |
|---|
| | 1 | Go to software.lbl.gov and download CrowdStrike Falcon Sensor for macOS 11 | no image | | 2 | Browse to the location where the file LBL_CS_MacOS11_vX.X is downloaded, and double-click on it |  Image Added
| | 3 | It will extract a folder called LBL_CS_MacOS11_vX.X, open it. Leave this folder open, you will return to it. |  Image Added
| | 4 | Right-click on the GovLagger... file |  Image Added
| | 5 | Select Open With | | 6 | Select Installer | | 7 | Click Continue for the "Introduction" and "Read Me" section |  Image Added Image Added
| | 8 | Click Install |  Image Added
| | 9 | Type in your computer password |  Image Added
| | 10 | Click Install Software | | 11 | Click Close |  Image Added
| | 12 | Return to the LBL_CS_MacOS11_vX.X folder from step 3 and right-click on the file configuration.command |  Image Added
| | 13 | Select Open With | | 14 | Select Terminal | | 15 | Click Open to the popup saying "macOS cannot verify the developer of "configuration.command". Are you sure you want to open it?" |  Image Added
| | 16 | In the terminal window that pops up, type in your computer password and hit enter Note: no character will appear when you type the password here. |  Image Added
| | 17 | Click Allow to the popup saying "Falcon would like to filter network content" |  Image Added
| | 18 | A "System Extension Blocked" popup will appear, click Open Security Preferences |  Image Added
| | 19 | Select Security & Privacy |  Image Added
| | 20 | Click the Lock icon on the bottom left |  Image Added
| | 21 | Type in your computer password | | 22 | Click Unlock | | 23 | Look for "System software from application "Falcon" was blocked from loading", and click Allow |  Image Added
| | 24 | This process may take between 3-8 minutes. Once done you will see it say [Process Completed] Continue to Step 2 |  Image Added
|
|
| Expand |
|---|
| title | Step 2 - CrowdStrike Falcon Permissions |
|---|
| | Include Page |
|---|
| macOS 11 and 12 - CrowdStrike Falcon Full Disk Access |
|---|
| macOS 11 and 12 - CrowdStrike Falcon Full Disk Access |
|---|
|
|
|
| Card |
|---|
| label | Install CrowdStrike Falcon via BigFix |
|---|
| Please visit: |
|
|
| Expand |
|---|
| title | CrowdStrike Falcon Install Instruction for Windows |
|---|
|
| Deck of Cards |
|---|
| id | CSF Windows |
|---|
| tabLocation | left |
|---|
| | Card |
|---|
| label | Manually Install CrowdStrike Falcon |
|---|
| | Note |
|---|
Instructions for Windows 10 and Windows 11 are essentially the same. The main difference is how they look.
The install instructions for Windows also apply to CrowdStrike For Home. |
| HTML |
|---|
<iframe src="https://drive.google.com/file/d/189nVO4g-Au8jY4sDcfUMDg-GCdFkqseN/preview" width="1280" height="720" allow="autoplay"></iframe> |
| 1 | Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for Windows | no image | | 2 | Browse to the location where the file LBL_CS_Win_Installer_vX.X is downloaded, and double-click on it |  Image Added
| | 3 | You may see the popup"Windows Protected your PC" Click More info If not, skip to Step 5 |  Image Added
| | 4 | Click Run anyway |  Image Added
| | 5 | The pop-up "Do you want to allow this app to make changes to your device?" will appear Click Yes |  Image Added
| | 6 | A command prompt window will appear stating "This may take several minutes. This window will close when the full process is complete" This process will take between 4 to 10 minutes If you have Sophos, you will need to restart the computer for Sophos to finish uninstalling. | Note |
|---|
During this process, you may see the following notifications in the bottom right corner. You can ignore it.  Image Added
 Image Added
This happens because during the transient state, Sophos Antivirus is being removed and CrowdStrike Falcon is being installed. |
|  Image Added
| | 7 | Once the command prompt window disappears. You are done. If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running? | no image |
|
| Card |
|---|
| label | Install CrowdStrike Falcon via BigFix |
|---|
| Please visit: |
|
|
Uninstall CrowdStrike Falcon
| Note |
|---|
Before you proceed to uninstall CrowdStrike Falcon, please complete the CrowdStrike Falcon Maintenance Token Request form. Once you received the maintenance token, you can follow the instructions below to uninstall CrowdStrike Falcon. |
| Expand |
|---|
| title | CrowdStrike Falcon Uninstall Instruction for Mac |
|---|
|
| Deck of Cards |
|---|
| id | macOS CSF uninstall |
|---|
| tabLocation | left |
|---|
| | (Apple) | Card |
|---|
label | Windows | | Expand |
|---|
| | 1 | Be sure to quit the Terminal app before beginning
Under the Apple icon in the top left corner, click System Settings |  Image Added
| | 2 | On the left column, select Privacy & Security |  Image Added
| | 3 | On the right column, select App Management | | 4 | Click the + icon |  Image Added
| | 5 | Select Utilities |  Image Added
| | 6 | Select Terminal | | 7 | Click Open | | 8 | Type in your computer password |  Image Added
| | 9 | Click Unlock | | 10 | The Terminal app should now appear under App management Continue to Part 2
| Info |
|---|
| If you left the Terminal app running, you will this popup:  Image Added
You can click Later and manually quit the Terminal app or click Quit & Reopen so the system does it for you now. This needs to be done before continuing to Part 2. |
|  Image Added
|
|
| Expand |
|---|
| | Excerpt Include |
|---|
| Install/Uninstall CrowdStrike Falcon |
|---|
| Install/Uninstall CrowdStrike Falcon |
|---|
| nopanel | true |
|---|
|
|
|
| Card |
|---|
| label | macOS 11 BiG Sur and macOS 12 Monterey |
|---|
| | Excerpt |
|---|
| 1 | Launch the Terminal app from the Utilities folder |  Image Added
| | 2 | Run sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t |  Image Added
| | 3 | Type in your computer password and hit Enter key on your keyboard |  Image Added | | 4 | Copy and paste in the maintenance token you received Note: nothing will show up as you input the maintenance token, so be sure to only paste it once and hit enter |  Image Added
| | 5 | You will see a confirmation saying "Falcon is uninstalled" Note: you must restart the computer to complete the uninstallation process |  Image Added
|
|
|
|
|
| Expand |
|---|
| title | CrowdStrike Falcon Uninstall Instruction for Windows |
|---|
|
| 1 | Click on the Start Menu icon |  Image Added
| | 2 | Type in Control Panel | | 3 | Click Control Panel | | 4 | Click Programs and Features |  Image Added
| | 5 | Select CrowdStrike Windows Sensor in the list |  Image Added
| | 6 | Click Uninstall | | 7 | The Do you want to allow this app to make changes to your device will pop up Click Yes |  Image Added
| | 8 | Paste or type in the maintenance token |  Image Added
| | 9 | Click Uninstall | | 10 | The uninstallation process will take a moment. When it is done, click Close |  Image Added
|
|
