Viewable by the world
Group Access to IT Frequently Asked Questions (FAQ)
Can VIEW the space: itfaq-editors ,  anonymous ,  itfaq-MFA-EDITORS ,  itfaq-itss ,  all-lbnl-users ,  mpsg-staff ,  itfaq-editors-lite ,  mpsg-mpsg-helpdesk ,  google-collab-documentation-management , 
Can EDIT the space: itfaq-editors-lite ,  itfaq-editors ,  mpsg-staff ,  google-collab-documentation-management ,  mpsg-mpsg-helpdesk , 
Can ADMINISTER the space:
Individual Access to IT Frequently Asked Questions (FAQ)
Can VIEW the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 
Can EDIT the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 
Can ADMINISTER the space: [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] ,  [email protected] , 

Versions Compared

Old Version 57

changes.mady.by.user Tap L

Saved on

compared with

New Version Current

changes.mady.by.user Tap L

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • A guide on how to install or uninstall CrowdStrike Falcon from Berkeley Lab computers
  • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsetschipsets
  • The install instructions for Windows also apply to CrowdStrike For Home

Resolution:

note
Warning

IMPORTANT:

  • Be sure to select the correct instructions for the operating system you are using
  • It is highly recommended to read the instructions before installing CrowdStrike Falcon

If you have Sophos Antivirus:

  • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you.
  • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process.

Resolution:

Install CrowdStrike Falcon

Expand the instruction instructions for the operating system you are using:

Expand
titleCrowdStrike Falcon Install Instruction for Mac
Deck of Cards
idCrowdstrike Install macOS
tabLocationleft
Card
labelmacOS 15 Sequoia
titlemacOS 15 Sequoia 12 Monterey & macOS 13 Ventura
Note
Instructions for macOS 12 Monterey and macOS 13 Ventura are essentially the same.

The

main difference is how they lookThe

CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

If you have Sophos Antivirus:

  • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you
  • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process

Expand
titleStep 1 - Install CrowdStrike Falcon on macOS 15 Sequoia
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6no image
4

Run the CrowdStrike installer you just downloaded

no image

5Click Continue for the "Introduction" and "Read Me" section

Image AddedImage Added


Leave the default destination as it is and click Continue

Note: if you do not see this screen, continue to the next step.

Image Added

6Click Install

Image Added

7Type in your computer password

Image Added

8Click Install Software
9Click Allow to the popup saying "'Falcon' would like to filter network content"

Image Added

10

A "System Extension Blocked" popup will appear, click Open System Settings


Warning

If the OK button was mistakenly clicked instead of Open System Settings here. A window from CrowdStrike will pop up (see below image) at some point during or after the installation.
Follow this instruction to fix it.

Image Added

Image Added

11For Falcon, slide the toggle to on (it will turn blue)

Image Added

12Type in your computer password

Image Added

13Click OK
14Click Done

Image Added

15

click OK on the popup saying "Installer would like to modify apps on your Mac"

Note

You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

Image Added

Image Added

16Click Close 

Image Added

17

Click Move to Trash and continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 13 and newer - CrowdStrike Falcon Full Disk Access
macOS 13 and newer - CrowdStrike Falcon Full Disk Access

Card
labelmacOS 13 Ventura and 14 Sonoma
titlemacOS 13 Ventura and 14 Sonoma
Note

The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

Expand
titleStep 1 - Install CrowdStrike Falcon on macOS 13 Ventura and 14 Sonoma
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download Crowdstrike Falcon 1.6no image
4

Run the CrowdStrike installer you just downloaded

no image

5Click Continue for the "Introduction" and "Read Me" section

Image AddedImage Added


Leave the default destination as it is and click Continue

Note: if you do not see this screen, continue to the next step.

Image Added

6Click Install

Image Added

7Type in your computer password

Image Added

8Click Install Software
9Click Allow to the popup saying "'Falcon' would like to filter network content"

Image Added

10A "System Extension Blocked" popup will appear, click Open System Settings

Image Added

11Select Privacy & Security

Image Added

12Look for "System software from application "Falcon" was blocked from loading"
13Click Allow
14Type in your computer password

Image Added

15Click Unlock
16

click OK on the popup saying "Installer would like to modify apps on your Mac"

Note

You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

Image Added

Image Added

17Click Close 

Image Added

18

Click Move to Trash and continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 13 and newer - CrowdStrike Falcon Full Disk Access
macOS 13 and newer - CrowdStrike Falcon Full Disk Access

Card
labelmacOS 12 Monterey
Note

The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

<iframe src="https://drive.google.com/file/d/1XXQvT4ZTmgNY6knfcspVWyrCBzpjggbQ/preview" width="640" height="480" allow="autoplay"></iframe>
Expand
titleStep 1 - Install CrowdStrike Falcon on macOS 12 Monterey
HTML
1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for macOS 12 and
13
newerno image
2
Browse to the location where the file LBL_CS_MacOS_12_13 is downloaded, and right-click on it

Image Removed

3Click  Open
4

Click Open to the popup saying "macOS cannot verify the developer of LBL_CS_MacOS_12_13. Are you sure you want to open it?"

Image Removed

Run the CrowdStrike installer you just downloaded

no image

5Click Continue for the "Introduction" and "Read Me" section

Image ModifiedImage Modified

6

Leave the default destination as it is and click Continue

Note: if you do not see this screen, continue to the next step.

Image Modified

7Click Install

Image Modified

8Type in your computer password

Image Modified

9Click Install Software
10Click Allow to the popup saying "com.crowdstrike.falcon.app" would like to filter network content"

Image Modified

11A "System Extension Blocked" popup will appear, click Open Security Preferences

Image Modified

12Select Security & Privacy

Image Modified

13Click the Lock icon on the bottom left

Image Modified

14Type in your computer password
15Click Unlock
16

Look for "System software from application "Falcon.app" was blocked from loading", and click Allow

Image Removed

17If you are using macOS 13 Ventura, you will see an additional popup saying "Installer would like to modify apps on your mac", click OK

Image Removed

Note

You may see this screen pop up, do not worry or panic. Continue to follow the instructions here and everything will turn green.

Image Added

Image Added

17
18You may select Keep or 
Installation is done. Click Close 

Image Modified

19
18

Click

Move to Trash 

depending on if you want to keep the CrowdStrike Falcon installer file or delete it

Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

and continue to Step 2

Image Added

Expand
titleStep 2 - CrowdStrike Falcon Permissions

Include Page
macOS 11 and 12 - CrowdStrike Falcon Full Disk Access
macOS 11 and 12 - CrowdStrike Falcon Full Disk Access

Image Removed

20If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?no image

Card
labelmacOS 11 Big Sur
Note
  • The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets

If you have Sophos Antivirus:

  • If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you
    • If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process
    • Please be aware that CrowdStrike Falcon support for macOS 11 (Big Sur) will be discontinued on December 31, 2023
      • You will need to upgrade to a supported version of macOS and if you need help with the upgrade, email [email protected]
    Expand
    titleStep 1 - Install CrowdStrike Falcon on macOS 11 Big Sur
    1Go to software.lbl.gov and download CrowdStrike Falcon Sensor for macOS 11no image
    2Browse to the location where the file LBL_CS_MacOS11_vX.X is downloaded, and double-click on it

    Image Modified

    3

    It will extract a folder called LBL_CS_MacOS11_vX.X, open it.

    Leave this folder open, you will return to it.

    Image Modified

    4Right-click on the GovLagger... file

    Image Modified

    5Select Open With
    6Select Installer
    7Click Continue for the "Introduction" and "Read Me" section

    Image ModifiedImage Modified

    8Click Install

    Image Modified

    9Type in your computer password

    Image Modified

    10Click Install Software
    11Click Close

    Image Modified

    12Return to the LBL_CS_MacOS11_vX.X folder from step 3 and right-click on the file configuration.command

    Image Modified

    13Select Open With
    14Select Terminal
    15Click Open to the popup saying "macOS cannot verify the developer of "configuration.command". Are you sure you want to open it?"

    Image Modified

    16

    In the terminal window that pops up, type in your computer password and hit enter

    Note: no character will appear when you type the password here.

    Image Modified

    17Click Allow to the popup saying "Falcon would like to filter network content"

    Image Modified

    18A "System Extension Blocked" popup will appear, click Open Security Preferences

    Image Modified

    19Select Security & Privacy

    Image Modified

    20Click the Lock icon on the bottom left

    Image Modified

    21Type in your computer password
    22Click Unlock
    23Look for "System software from application "Falcon" was blocked from loading", and click Allow

    Image Modified

    24

    This process may take between 3-8 minutes. Once done you will see it say [Process Completed]

    You are done

    Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

    Continue to Step 2

    Image Added

    Expand
    titleStep 2 - CrowdStrike Falcon Permissions

    Include Page
    macOS 11 and 12 - CrowdStrike Falcon Full Disk Access
    macOS 11 and 12 - CrowdStrike Falcon Full Disk Access

    no image
    Card
    labelInstall CrowdStrike Falcon via BigFix

    Please visit:

    Image Removed

    		25If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?
    Expand
    titleCrowdStrike Falcon Install Instruction for Windows
    Deck of Cards
    idCSF Windows
    tabLocationleft
    Card
    labelManually Install CrowdStrike Falcon
    Note

    Instructions for Windows 10 and Windows 11 are essentially the same. The main difference is how they look.

    The install instructions for Windows also apply to CrowdStrike For Home.


    HTML
    <iframe src="https://drive.google.com/file/d/189nVO4g-Au8jY4sDcfUMDg-GCdFkqseN/preview" width="
    640
    1280" height="
    480
    720" allow="autoplay"></iframe>
    1Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for Windowsno image
    2Browse to the location where the file LBL_CS_Win_Installer_vX.X is downloaded, and double-click on it

    Image Modified

    3

    You may see the popup"Windows Protected your PC"

    Click More info

    If not, skip to Step 5

    Image Modified

    4Click Run anyway

    Image Modified

    5

    The pop-up "Do you want to allow this app to make changes to your device?" will appear

    Click Yes

    Image Modified

    6

    A command prompt window will appear stating "This may take several minutes. This window will close when the full process is complete"

    This process will take between 4 to 10 minutes

    If you have Sophos, you will need to restart the computer for Sophos to finish uninstalling.

    Note

    During this process, you may see the following

    notification

    notifications in the bottom right corner. You can ignore it.

    Image Removed

    If

    Image Added

    Image Added

    This happens because during the transient state, Sophos Antivirus is being removed and CrowdStrike Falcon is being installed

    you have Sophos, you will need to restart the computer for Sophos to finish uninstalling

    .

    Image Modified

    7

    Once the command prompt window disappears. You are done.

    If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?

    		no image
    Card
    labelInstall CrowdStrike Falcon via BigFix

    Please visit:


    Uninstall CrowdStrike FalconExpand the instruction for the operating system you are using:

    Note

    Before you proceed to uninstall CrowdStrike Falcon, please complete the CrowdStrike Falcon Maintenance Token Request form. Once you received the maintenance token, you can follow the instructions below to uninstall CrowdStrike Falcon.

    Expand
    titleCrowdStrike Falcon Uninstall Instruction for Mac
    Deck of Cards
    idmacOS CSF uninstall
    tabLocationleft
    Card
    labelmacOS 13 Ventura and 14 Sonoma
    Expand
    titlePart 1
    1

    Be sure to quit the Terminal app before beginning


    Under the Apple icon in the top left corner, click System Settings

    Image Added

    2On the left column, select Privacy & Security

    Image Added

    3On the right column, select App Management
    4Click the + icon

    Image Added

    5Select Utilities 

    Image Added

    6Select Terminal
    7Click Open
    8Type in your computer password

    Image Added

    9Click Unlock
    10

    The Terminal app should now appear under App management

    Continue to Part 2


    Info
    titleinfo

    If you left the Terminal app running, you will this popup:

    Image Added

    You can click Later and manually quit the Terminal app or click Quit & Reopen so the system does it for you now.

    This needs to be done before continuing to Part 2.

    Image Added

    Expand
    titlePart 2

    Excerpt Include
    Install/Uninstall CrowdStrike Falcon
    Install/Uninstall CrowdStrike Falcon
    nopaneltrue

    Card
    labelmacOS 11 BiG Sur and macOS 12 Monterey
    Excerpt
    1Launch the Terminal app from the Utilities folder

    Image Modified

    2

    Run sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t

    Image Removed

    Image Added

    3Type in your computer password and hit Enter key on your keyboardImage Added
    4

    Copy and paste in the maintenance token you received

    Note: nothing will show up as you input the maintenance token, so be sure to only paste it once and hit enter

    Image Added

    5

    You will see a confirmation saying "Falcon is uninstalled"

    Image Removed

    Note: you must restart the computer to complete the uninstallation process

    Image Added

    Expand
    titleCrowdStrike Falcon Uninstall Instruction for Windows
    1Click on the Start Menu icon


    2Type in Control Panel
    3Click Control Panel
    4Click Programs and Features

    5Select CrowdStrike Windows Sensor in the list

    6Click Uninstall
    7

    The Do you want to allow this app to make changes to your device will pop up

    Click Yes

    8Paste or type in the maintenance token

    Image Added

    9Click Uninstall

    Image Removed

    910The uninstallation process will take a moment. When it is done, click Close

    ...