Viewable by the world
Group Access to IT Frequently Asked Questions (FAQ)
Can VIEW the space: itfaq-editors ,  anonymous ,  itfaq-MFA-EDITORS ,  itfaq-itss ,  all-lbnl-users ,  mpsg-staff ,  itfaq-editors-lite ,  mpsg-mpsg-helpdesk ,  google-collab-documentation-management , 
Can EDIT the space: itfaq-editors-lite ,  itfaq-editors ,  mpsg-staff ,  google-collab-documentation-management ,  mpsg-mpsg-helpdesk , 
Can ADMINISTER the space:
Individual Access to IT Frequently Asked Questions (FAQ)
Can VIEW the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 
Can EDIT the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 
Can ADMINISTER the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 

Versions Compared

Old Version 53

changes.mady.by.user Tap L

Saved on

compared with

New Version Current

changes.mady.by.user Tap L

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • A guide on how to install or uninstall CrowdStrike Falcon from Berkeley Lab computers
  • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsetschipsets
  • The install instructions for Windows also apply to CrowdStrike For Home

Resolution:

note
Warning

IMPORTANT:

  • Be sure to select the correct instructions for the operating system you are using
  • It is highly recommended to read the instructions before installing CrowdStrike Falcon

If you have Sophos Antivirus:

  • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you.
  • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process.

...

Install CrowdStrike Falcon

Expand the instruction instructions for the operating system you are using:

Expand
titleCrowdStrike Falcon Install Instruction for Mac
Image Removed
Deck of Cards
idCrowdstrike Install macOS
tabLocationleft
Card
labelmacOS 12 Monterey & macOS 13 Ventura15 Sequoia
titlemacOS 15 Sequoia
Note
Note
  • Instructions for macOS 12 Monterey and macOS 13 Ventura are essentially the same. The main difference is how they look

    • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

  • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you
  • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process

    • Expand
    titleStep 1 - Install CrowdStrike Falcon on macOS 15 Sequoia
    1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6no image
    4

    Run the CrowdStrike installer you just downloaded

    no image

    5Click Continue for the "Introduction" and "Read Me" section

    Image AddedImage Added


    Leave the default destination as it is and click Continue

    Note: if you do not see this screen, continue to the next step.

    Image Added

    6Click Install

    Image Added

    7Type in your computer password

    Image Added

    8Click Install Software
    9Click Allow to the popup saying "'Falcon' would like to filter network content"

    Image Added

    10

    A "System Extension Blocked" popup will appear, click Open System Settings


    Warning

    If the OK button was mistakenly clicked instead of Open System Settings here. A window from CrowdStrike will pop up (see below image) at some point during or after the installation.
    Follow this instruction to fix it.

    Image Added

    Image Added

    11For Falcon, slide the toggle to on (it will turn blue)

    Image Added

    12Type in your computer password

    Image Added

    13Click OK
    14Click Done

    Image Added

    15

    click OK on the popup saying "Installer would like to modify apps on your Mac"

    Note

    You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

    Image Added

    Image Added

    16Click Close 

    Image Added

    17

    Click Move to Trash and continue to Step 2

    Image Added

    Expand
    titleStep 2 - CrowdStrike Falcon Permissions

    Include Page
    macOS 13 and newer - CrowdStrike Falcon Full Disk Access
    macOS 13 and newer - CrowdStrike Falcon Full Disk Access

    Card
    labelmacOS 13 Ventura and 14 Sonoma
    titlemacOS 13 Ventura and 14 Sonoma
    Note

    The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

    Expand
    titleStep 1 - Install CrowdStrike Falcon on macOS 13 Ventura and 14 Sonoma
    1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6no image
    4

    Run the CrowdStrike installer you just downloaded

    no image

    5Click Continue for the "Introduction" and "Read Me" section

    Image AddedImage Added


    Leave the default destination as it is and click Continue

    Note: if you do not see this screen, continue to the next step.

    Image Added

    6Click Install

    Image Added

    7Type in your computer password

    Image Added

    8Click Install Software
    9Click Allow to the popup saying "'Falcon' would like to filter network content"

    Image Added

    10A "System Extension Blocked" popup will appear, click Open System Settings

    Image Added

    11Select Privacy & Security

    Image Added

    12Look for "System software from application "Falcon" was blocked from loading"
    13Click Allow
    14Type in your computer password

    Image Added

    15Click Unlock
    16

    click OK on the popup saying "Installer would like to modify apps on your Mac"

    Note

    You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

    Image Added

    Image Added

    17Click Close 

    Image Added

    18

    Click Move to Trash and continue to Step 2

    Image Added

    Expand
    titleStep 2 - CrowdStrike Falcon Permissions

    Include Page
    macOS 13 and newer - CrowdStrike Falcon Full Disk Access
    macOS 13 and newer - CrowdStrike Falcon Full Disk Access

    Card
    labelmacOS 12 Monterey
    Note

    The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

    <iframe src="https://drive.google.com/file/d/1XXQvT4ZTmgNY6knfcspVWyrCBzpjggbQ/preview" width="640" height="480" allow="autoplay"></iframe>
    Expand
    titleStep 1 - Install CrowdStrike Falcon on macOS 12 Monterey
    HTML
    1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for macOS 12 and
    13
    newerno image
    2
    		Browse to the location where the file LBL_CS_MacOS_12_13 is downloaded, and right-click on it

    Image Removed

    3Click  Open
    Run the CrowdStrike installer you just downloaded

    no image

    		4

    Click Open to the popup saying "macOS cannot verify the developer of LBL_CS_MacOS_12_13. Are you sure you want to open it?"

    5Click Continue for the "Introduction" and "Read Me" section

    Image ModifiedImage Modified

    6

    Leave the default destination as it is and click Continue

    Note: if you do not see this screen, continue to the next step.

    Image Modified

    7Click Install

    Image Modified

    8Type in your computer password

    Image Modified

    9Click Install Software
    10Click Allow to the popup saying "com.crowdstrike.falcon.app" would like to filter network content"

    Image Modified

    11A "System Extension Blocked" popup will appear, click Open Security Preferences

    Image Modified

    12Select Security & Privacy

    Image Modified

    13Click the Lock icon on the bottom left

    Image Modified

    14Type in your computer password
    15Click Unlock
    16

    Look for "System software from application "Falcon.app" was blocked from loading", and click Allow

    Image Removed

    17If you are using macOS 13 Ventura, you will see an additional popup saying "Installer would like to modify apps on your mac", click OK

    Image Removed

    Note

    You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

    Image Added

    Image Added

    17
    18You may select Keep or 
    Installation is done. Click Close 

    Image Modified

    19
    18

    Click

    Move to Trash 

    depending on if you want to keep the CrowdStrike Falcon installer file or delete it

    Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

    and continue to Step 2

    Image Added

    Expand
    titleStep 2 - CrowdStrike Falcon Permissions

    Include Page
    macOS 11 and 12 - CrowdStrike Falcon Full Disk Access
    macOS 11 and 12 - CrowdStrike Falcon Full Disk Access

    Image Removed

    20If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?no image

    Card
    labelmacOS 11 Big Sur
    Note
    • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets
    • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you
      • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process
    • Please be aware that CrowdStrike Falcon support for macOS 11 (Big Sur) will be discontinued on December 31, 2023
      • You will need to upgrade to a supported version of macOS and if you need help with the upgrade, email [email protected]
    Expand
    titleStep 1 - Install CrowdStrike Falcon on macOS 11 Big Sur
    1Go to software.lbl.gov and download CrowdStrike Falcon Sensor for macOS 11no image
    2Browse to the location where the file LBL_CS_MacOS11_vX.X is downloaded, and double-click on it

    Image Modified

    3

    It will extract a folder called LBL_CS_MacOS11_vX.X, open it.

    Leave this folder open, you will return to it.

    Image Modified

    4Right-click on the GovLagger... file

    Image Modified

    5Select Open With
    6Select Installer
    7Click Continue for the "Introduction" and "Read Me" section

    Image ModifiedImage Modified

    8Click Install

    Image Modified

    9Type in your computer password

    Image Modified

    10Click Install Software
    11Click Close

    Image Modified

    12Return to the LBL_CS_MacOS11_vX.X folder from step 3 and right-click on the file configuration.command

    Image Modified

    13Select Open With
    14Select Terminal
    15Click Open to the popup saying "macOS cannot verify the developer of "configuration.command". Are you sure you want to open it?"

    Image Modified

    16

    In the terminal window that pops up, type in your computer password and hit enter

    Note: no character will appear when you type the password here.

    Image Modified

    17Click Allow to the popup saying "Falcon would like to filter network content"

    Image Modified

    18A "System Extension Blocked" popup will appear, click Open Security Preferences

    Image Modified

    19Select Security & Privacy

    Image Modified

    20Click the Lock icon on the bottom left

    Image Modified

    21Type in your computer password
    22Click Unlock
    23Look for "System software from application "Falcon" was blocked from loading", and click Allow

    Image Modified

    24

    This process may take between 3-8 minutes. Once done you will see it say [Process Completed]

    Continue to Step 2

    Image Added

    Expand
    titleStep 2 - CrowdStrike Falcon Permissions

    Include Page
    macOS 11 and 12 - CrowdStrike Falcon Full Disk Access
    macOS 11 and 12 - CrowdStrike Falcon Full Disk Access

    no image
    Card
    labelInstall CrowdStrike Falcon via BigFix

    Please visit:

    You are done

    Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

    Image Removed

    		25If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?
    Expand
    titleCrowdStrike Falcon Install Instruction for Windows
    Deck of Cards
    idCSF Windows
    tabLocationleft
    Card
    labelManually Install CrowdStrike Falcon
    Note

    Instructions for Windows 10 and Windows 11 are essentially the same. The main difference is how they look.

    The install instructions for Windows also apply to CrowdStrike For Home.


    HTML
    <iframe src="https://drive.google.com/file/d/189nVO4g-Au8jY4sDcfUMDg-GCdFkqseN/preview" width="
    640
    1280" height="
    480
    720" allow="autoplay"></iframe>
    1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for Windowsno image
    2Browse to the location where the file LBL_CS_Win_Installer_vX.X is downloaded, and double-click on it

    Image Modified

    3

    You may see the popup"Windows Protected your PC"

    Click More info

    If not, skip to Step 5

    Image Modified

    4Click Run anyway

    Image Modified

    5

    The pop-up "Do you want to allow this app to make changes to your device?" will appear

    Click Yes

    Image Modified

    6

    A command prompt window will appear stating "This may take several minutes. This window will close when the full process is complete"

    This process will take between 4 to 10 minutes

    If you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

    Note

    During this process, you may see the following

    notification

    notifications in the bottom right corner. You can ignore it.

    Image Removed

    If

    Image Added

    Image Added

    This happens because during the transient state, Sophos Antivirus is being removed and CrowdStrike Falcon is being installed

    you have Sophos, you will need to restart the computer for Sophos to finish uninstalling

    .

    Image Modified

    7

    Once the command prompt window disappears. You are done.

    If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?

    		no image
    Card
    labelInstall CrowdStrike Falcon via BigFix

    Please visit:


    Uninstall CrowdStrike FalconExpand the instruction for the operating system you are using:

    Note

    Before you proceed to uninstall CrowdStrike Falcon, please complete the CrowdStrike Falcon Maintenance Token Request form. Once you received the maintenance token, you can follow the instructions below to uninstall CrowdStrike Falcon.

    Expand
    titleCrowdStrike Falcon Uninstall Instruction for Mac
    Deck of Cards
    idmacOS CSF uninstall
    tabLocationleft
    Card
    labelmacOS 13 Ventura and 14 Sonoma
    Expand
    titlePart 1
    1

    Be sure to quit the Terminal app before beginning


    Under the Apple icon in the top left corner, click System Settings

    Image Added

    2On the left column, select Privacy & Security

    Image Added

    3On the right column, select App Management
    4Click the + icon

    Image Added

    5Select Utilities 

    Image Added

    6Select Terminal
    7Click Open
    8Type in your computer password

    Image Added

    9Click Unlock
    10

    The Terminal app should now appear under App management

    Continue to Part 2


    Info
    titleinfo

    If you left the Terminal app running, you will this popup:

    Image Added

    You can click Later and manually quit the Terminal app or click Quit & Reopen so the system does it for you now.

    This needs to be done before continuing to Part 2.

    Image Added

    Expand
    titlePart 2

    Excerpt Include
    Install/Uninstall CrowdStrike Falcon
    Install/Uninstall CrowdStrike Falcon
    nopaneltrue

    Card
    labelmacOS 11 BiG Sur and macOS 12 Monterey
    Excerpt
    1Launch the Terminal app from the Utilities folder

    Image Modified

    2

    Run sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t

    Image Removed

    Image Added

    3Type in your computer password and hit Enter key on your keyboardImage Added
    4

    Copy and paste in the maintenance token you received

    Note: nothing will show up as you input the maintenance token, so be sure to only paste it once and hit enter

    Image Added

    5

    You will see a confirmation saying "Falcon is uninstalled"

    Image Removed

    Note: you must restart the computer to complete the uninstallation process

    Image Added

    Expand
    titleCrowdStrike Falcon Uninstall Instruction for Windows
    1Click on the Start Menu icon


    2Type in Control Panel
    3Click Control Panel
    4Click Programs and Features

    5Select CrowdStrike Windows Sensor in the list

    6Click Uninstall
    7

    The Do you want to allow this app to make changes to your device will pop up

    Click Yes

    8Paste or type in the maintenance token

    Image Added

    9Click Uninstall

    Image Removed

    910The uninstallation process will take a moment. When it is done, click Close

    ...