Purpose of Knowledge Article:
This is a guide to check if CrowdStrike is running correctly on your system.
Resolution:
Step |
Description |
Image |
1 |
Expand the system tray (If necessary) by clicking the small arrow icon next to the clock and/or weather display |
|
2 |
Find the CrowdStrike Falcon icon ( |
|
| 3 |
If you left-click the CrowdStrike icon in the system tray, it will bring up a status menu with more detail - if the Falcon Sensor Details show running, then the app and services are working properly. |
|
Step |
Description |
Image |
1 |
Use the search bar to search for 'cmd' and launch Command Prompt as an administrator |
|
2 |
Run the command sc query csagent |
|
| 3 | Ensure the result shows “STATE” is “RUNNING” |
|
Step |
Description |
Image |
1 |
Use the search bar to search for 'power' and run a Windows PowerShell terminal as administrator |
|
2 |
In the PowerShell terminal type the following command: Get-Service -Name csagent |
|
| 3 | You should see the status of the CrowdStrike Falcon agent |
|
powershell.exe -command "[System.BitConverter]::ToString( ((Get-ItemProperty 'HKLM:\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default' -Name AG).AG)).ToLower() -replace '-',''"
| 1 | Click the Go on the menu bar |
|
| 2 | Select Utilities | |
| 3 | Open Terminal |
|
| 4 | Type in systemextensionsctl list and hit enter Note: If asked for the password, type in your computer password |
|
| 5 | The result should look like this |
Click the Go on the menu bar |
|
| Select Utilities | |
| Open Terminal |
|
Type in sudo /Applications/Falcon.app/Contents/Resources/falconctl stats | head -n 6 and hit enter Note: If asked for the password, type in your computer password |
|
You should see this result |
|
Advanced: If you need to get the Agent ID from the client:
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats agent_info
