Purpose of Knowledge Article:
- A guide on how to install or uninstall CrowdStrike Falcon from Berkeley Lab computers
- The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets
- If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you.
- If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process.
Resolution:
Install CrowdStrike Falcon
Expand the instruction for the operating system you are using:
- Instructions for macOS 12 Monterey and macOS 13 Ventura are essentially the same. The main difference is how they look
- The CrowdStrike Falcon macOS installer is a universal binary and will work on Intel and Apple Silicon (M1, and M2) chipsets
- If you have Sophos Antivirus on the computer, the CrowdStrike Falcon installer will uninstall it for you
- If you have Sophos Antivirus on the computer, a restart will be required to finish the Sophos uninstallation process
| 1 | Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for macOS 12 and 13 | no image |
| 2 | Browse to the location where the file LBL_CS_MacOS_12_13 is downloaded, and right-click on it |
|
| 3 | Click Open | |
| 4 | Click Open to the popup saying "macOS cannot verify the developer of LBL_CS_MacOS_12_13. Are you sure you want to open it?" |
|
| 5 | Click Continue for the "Introduction" and "Read Me" section |
|
| 6 | Leave the default destination as it is and click Continue Note: if you do not see this screen, continue to the next step. |
|
| 7 | Click Install |
|
| 8 | Type in your computer password |
|
| 9 | Click Install Software | |
| 10 | Click Allow to the popup saying "com.crowdstrike.falcon.app" would like to filter network content" |
|
| 11 | A "System Extension Blocked" popup will appear, click Open Security Preferences |
|
| 12 | Select Security & Privacy |
|
| 13 | Click the Lock icon on the bottom left |
|
| 14 | Type in your computer password | |
| 15 | Click Unlock | |
| 16 | Look for "System software from application "Falcon.app" was blocked from loading", and click Allow |
|
| 17 | If you are using macOS 13 Ventura, you will see an additional popup saying "Installer would like to modify apps on your mac", click OK |
|
| 18 | Installation is done. Click Close |
|
| 19 | You may select Keep or Move to Trash depending on if you want to keep the CrowdStrike Falcon installer file or delete it Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling. |
|
| 20 | If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running? | no image |
| 1 | Go to software.lbl.gov and download CrowdStrike Falcon Sensor for macOS 11 | no image |
| 2 | Browse to the location where the file LBL_CS_MacOS11_vX.X is downloaded, and double-click on it |
|
| 3 | It will extract a folder called LBL_CS_MacOS11_vX.X, open it. Leave this folder open, you will return to it. |
|
| 4 | Right-click on the GovLagger... file |
|
| 5 | Select Open With | |
| 6 | Select Installer | |
| 7 | Click Continue for the "Introduction" and "Read Me" section |
|
| 8 | Click Install |
|
| 9 | Type in your computer password |
|
| 10 | Click Install Software | |
| 11 | Click Close |
|
| 12 | Return to the LBL_CS_MacOS11_vX.X folder from step 3 and right-click on the file configuration.command |
|
| 13 | Select Open With | |
| 14 | Select Terminal | |
| 15 | Click Open to the popup saying "macOS cannot verify the developer of "configuration.command". Are you sure you want to open it?" |
|
| 16 | In the terminal window that pops up, type in your computer password and hit enter Note: no character will appear when you type the password here. |
|
| 17 | Click Allow to the popup saying "Falcon would like to filter network content" |
|
| 18 | A "System Extension Blocked" popup will appear, click Open Security Preferences |
|
| 19 | Select Security & Privacy |
|
| 20 | Click the Lock icon on the bottom left |
|
| 21 | Type in your computer password | |
| 22 | Click Unlock | |
| 23 | Look for "System software from application "Falcon" was blocked from loading", and click Allow |
|
| 24 | This process may take between 3-8 minutes. Once done you will see it say [Process Completed] You are done Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling. |
|
| 25 | If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running? | no image |
Instructions for Windows 10 and Windows 11 are essentially the same. The main difference is how they look.
| 1 | Go to https://software.lbl.gov/swSoftwareDetails.php?applicationID=259 and download CrowdStrike Falcon Sensor for Windows | no image |
| 2 | Browse to the location where the file LBL_CS_Win_Installer_vX.X is downloaded, and double-click on it |
|
| 3 | You may see the popup "Windows Protected your PC" Click More info If not, skip to Step 5 |
|
| 4 | Click Run anyway |
|
| 5 | The pop-up "Do you want to allow this app to make changes to your device?" will appear Click Yes |
|
| 6 | A command prompt window will appear stating "This may take several minutes. This window will close when the full process is complete" This process will take between 4 to 10 minutes During this process, you may see the following notification in the bottom right corner. You can ignore it.
If you have Sophos, you will need to restart the computer for Sophos to finish uninstalling. |
|
| 7 | Once the command prompt window disappears. You are done. If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running? | no image |
Uninstall CrowdStrike Falcon
Expand the instruction for the operating system you are using:
| 1 | Launch the Terminal app from the Utilities folder |
|
| 2 | Run sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall |
|
| 3 | Type in your computer password and hit Enter key on your keyboard | |
| 4 | You will see a confirmation saying "Falcon is uninstalled" |
|
| 1 | Click on the Start Menu icon |
|
| 2 | Type in Control Panel | |
| 3 | Click Control Panel | |
| 4 | Click Programs and Features |
|
| 5 | Select CrowdStrike Windows Sensor in the list |
|
| 6 | Click Uninstall | |
| 7 | The Do you want to allow this app to make changes to your device will pop up Click Yes |
|
| 8 | Click Uninstall |
|
| 9 | The uninstallation process will take a moment. When it is done, click Close |
|
