Purpose of Knowledge Article:

Guide on how to install or uninstall CrowdStrike Falcon from Berkeley Lab computers.

If you have Sophos Antivirus product on your computer, CrowdStrike Falcon installer will uninstall it for you.

Resolution:

Expand the instruction for the operating system you are using:

Instructions for macOS 12 Monterey and macOS 13 Ventura are essentially the same. The main difference is how they look.

1	Go to https://software.lbl.gov/ and download CrowdStrike Falcon Sensor for macOS	no image
2	Browse to the location where the file LBL_CS_MacOS_12_13 is downloaded, and right-click on it
3	Click Open
4	Click Open to the popup saying "macOS cannot verify the developer of LBL_CS_MacOS_12_13. Are you sure you want to open it?"
5	Click Continue for the "Introduction" and "Read Me" section
6	Leave the default destination as it is and click Continue
7	Click Install
8	Type in your computer password
9	Click Install Software
10	Click Allow to the popup saying "com.crowdstrike.falcon.app" would like to filter network content"
11	A "System Extension Blocked" popup will appear, click Open Security Preferences
12	Select Security & Privacy
13	Click the Lock icon on the bottom left
14	Type in your computer password
15	Click Unlock
16	Look for "System software from application "Falcon.app" was blocked from loading", and click Allow
17	If you are using macOS 13 Ventura, you will see an additional popup saying "Installer would like to modify apps on your mac", click OK
18	Installation is done. Click Close
19	You may select Keep or Move to Trash depending on if you want to keep the CrowdStrike Falcon installer file or delete it
20	If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?	no image

Under development

Instructions for Windows 10 and Windows 11 are essentially the same. The main difference is how they look.

1	Go to https://software.lbl.gov/ and download CrowdStrike Falcon Sensor for Windows	no image
2	Browse to the location where the file LBL_CS_WinInstaller is downloaded, and right-click on it
3	Select Extract All
4	In the "Files will be extracted to this folder" field Type in or copy and paste C:\Options
5	Make sure the box for "Show extracted files when complete" is checked
6	Click Extract
7	Once extraction is done, a new window for C:\Options will pop up Locate the file runasadmin, and right-click on it
8	Select Run as administrator
9	You may see the popup "Windows Protected your PC" Click More info If not, skip to Step 11
10	Click Run anyway
11	The pop up "Do you want to allow this app to make changes to your device?" will appear Click Yes
12	A command prompt window will appear stating "This may take several minutes. This window will close when the full process is complete" This process will take between 4 to 10 minutes
13	Once the command prompt window disappears. You are done. If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running?	no image

Expand the instruction for the operating system you are using:

1	Launch the Terminal app from the Utilities folder
2	Run sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall
3	Type in your computer password and hit Enter key on your keyboard
4	You will see a confirmation saying "Falcon is uninstalled"

1	Click on the Start Menu icon
2	Type in Control Panel
3	Click Control Panel
4	Click Programs and Features
5	Select CrowdStrike Windows Sensor in the list
6	Click Uninstall
7	The Do you want to allow this app to make changes to your device will pop up Click Yes
8	Click Uninstall
9	The uninstallation process will take a moment. When it is done, click Close