Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

Article Number: 000126135

How to Uninstall CrowdStrike Falcon Sensor

Summary: CrowdStrike Falcon Sensor can be uninstalled using these instructions for Windows, Mac, and Linux.

This article may have been automatically translated. If you have any feedback regarding its quality, please let us know using the form at the bottom of this page.

Article Content

Instructions

This article covers the uninstall process for CrowdStrike Falcon Sensor.

Affected Products:

  • CrowdStrike Falcon Sensor

Affected Operating Systems:

  • Windows
  • Mac
  • Linux

Instructions to uninstall CrowdStrike Falcon Sensor differ depending on whether Windows, Mac, or Linux is in use. Click the appropriate operating system for the uninstall process.

Windows

CrowdStrike Falcon Sensor can be removed on Windows through the:

  • User interface (UI)
  • Command-line interface (CLI)

Click the appropriate method for more information.

UI

  1. Right-click the Windows Start menu and then select Apps and Features.

Apps and Features

Note: The Apps and Features tool is called Add or Remove Programs on Windows 7.
  1. Select CrowdStrike Windows Sensor and then click Uninstall.

Uninstall button

Note: The version in the example may differ from your environment.
  1. Click Uninstall.

Uninstall

  1. If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.

User Account Control prompt

  1. If using a maintenance token, go to Step 6. Otherwise go to Step 7.
  2. Populate the maintenance token and then click Uninstall.

Maintenance token field and Uninstall

Note: For more information, reference How to Manage the CrowdStrike Falcon Sensor Maintenance Token.
  1. Click Uninstall.

Selecting Uninstall

  1. On uninstall, click Close.

Close

  1. Right-click the Windows Start menu and then select Apps and Features.

Apps and Features

Note: The Apps and Features tool is called Add or Remove Programs on Windows 7.
  1. Select CrowdStrike Windows Sensor and then click Uninstall.

Uninstall button

Note: The version in the example may differ from your environment.
  1. Click Uninstall.

Uninstall

  1. If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.

User Account Control prompt

  1. For password-protected installations, go to Step 6. For regular installations, go to Step 7.
  2. Enter your Falcon installation password, click Uninstall, and then go to Step 8.

Maintenance token field and Uninstall option

Warning: Forgotten passwords can only be reset by opening a ticket with Dell support. For more information, reference Dell Data Security International Support Phone Numbers.
  1. Click Uninstall.

Selecting uninstall

  1. On uninstall, click Close.

Close

  1. Right-click the Windows Start menu and then select Apps and Features.

Apps and Features

Note: The Apps and Features tool is called Add or Remove Programs on Windows 7.
  1. Select CrowdStrike Windows Sensor and then click Uninstall.

Uninstall button

Note: The version in the example may differ from your environment.
  1. Click Uninstall.

Uninstall

  1. If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.

User Account Control prompt

  1. Click Uninstall.

Selecting Uninstall

  1. If CrowdStrike Falcon Sensor is password-protected, click OK and go to the CLI uninstall section. Otherwise, go to Step 7.

Password requirement notification

  1. On uninstall, click Close.

Close

CLI

Note:
  • Switches are not case-sensitive.
  • If User Access Control (UAC) is enabled, administrator rights should be used to perform uninstall.
 
Switch Required Purpose
/passive No The installer shows a minimal UI with no prompts.
/quiet No Suppresses UI and prompts.
/log No Changes the default installation log directory from %Temp% to a new location. The new location must be contained in quotation marks ("").
 
 
Note: Parameters are case-sensitive.
 
Switch Value Required Purpose
MAINTENANCE_TOKEN See Examples No Prevents uninstall without a maintenance password.
 
 
Note:

CLI Installation Examples:

Example #1

CsUninstallTool.exe MAINTENANCE_TOKEN=a0c76aa097218dc446082 /quiet

Example #1 contains:

  • Installer = CsUninstallTool.exe
  • Silent install = Yes
  • End-user installation prompts = No
  • Maintenance token = Yes
  • Installation log directory = %TEMP%
    • Default value since not defined.
Note: The example maintenance token will differ in your environment.

Example #2

CsUninstallTool.exe /passive /log "C:\Logs"

Example #2 contains:

  • Installer = CsUninstallTool.exe
  • Silent install = No
    • Default value since not defined.
  • End-user installation prompts = No
  • Password Protected = No
    • Default value since not defined.
  • Installation log directory = C:\Logs
Note:
  • Switches are not case-sensitive.
  • If User Access Control (UAC) is enabled, administrator rights should be used to perform uninstall.
 
Switch Required Purpose
/passive No The installer shows a minimal UI with no prompts.
/quiet No Suppresses UI and prompts.
/log No Changes the default installation log directory from %Temp% to a new location. The new location must be contained in quotation marks ("").
 
 
Note: Parameters are case-sensitive.
 
Switch Value Required Purpose
PW= See Examples No Prevents uninstall without a password. Password must be contained in quotation marks (""). Parameter must go directly after the file.
 
 
Note: For information about obtaining the uninstall tool, reference How to Download the CrowdStrike Falcon Sensor Windows Uninstall Tool.

CLI Installation Examples:

Example #1

CsUninstallTool.exe PW="Ex@mpl3" /quiet

Example #1 contains:

  • Installer = CsUninstallTool.exe
  • Silent install = Yes
  • End-user installation prompts = No
  • Password Protected = Yes
  • Installation log directory = %TEMP%
    • Default value since not defined.
Warning: Forgotten passwords can only be reset by opening a ticket with Dell support. For more information, reference Dell Data Security International Support Phone Numbers.

Example #2

CsUninstallTool.exe /passive /log "C:\Logs"

Example #2 contains:

  • Installer = CsUninstallTool.exe
  • Silent install = No
    • Default value since not defined.
  • End-user installation prompts = No
  • Password Protected = No
    • Default value since not defined.
  • Installation log directory = C:\Logs

Mac

Click the appropriate client version for specific uninstall steps. For more information, reference How to Identify the CrowdStrike Falcon Sensor Version.

v5.10.9003 and Later

CrowdStrike Falcon Sensor can be removed either in Normal or Protected (maintenance token) mode. Protected mode prevents the unauthorized unload, uninstall, repair, or manual upgrade of the sensor. Click the appropriate mode for more information.

  1. In the Apple menu, click Go and then select Utilities.

Utilities

  1. In the Utilities folder, double-click Terminal.

Terminal

  1. In Terminal, type sudo /Library/CS/falconctl uninstall and then press Enter.
  2. Populate the password for sudo and then press Enter.

Terminal with the command populated and entered

Warning: CrowdStrike Falcon Sensors that are deployed with a maintenance token fail on uninstall. Go to the Protected section for uninstall steps.
  1. Once uninstallation is complete, exit Terminal.
  1. In the Apple menu, click Go and then select Utilities.

Utilities

  1. In the Utilities folder, double-click Terminal.

Terminal

  1. In Terminal, type sudo /Library/CS/falconctl uninstall ––maintenance-token and then press Enter.
Note: Two "-"must be used before maintenance-token.
  1. Populate the password for sudo and then press Enter.

Terminal with the command populated and entered

  1. Populate a Maintenance Token and then press Enter.

Terminal with the command populated and entered

Note: For more information, reference How to Manage the CrowdStrike Falcon Sensor Maintenance Token.
  1. Once uninstallation is complete, exit Terminal.

v4.28.8907 and Earlier

CrowdStrike Falcon Sensor can be removed either in Normal or Protected (maintenance token) mode. Protected mode prevents the unauthorized unload, uninstall, repair, or manual upgrade of the sensor. Click the appropriate mode for more information.

  1. In the Apple menu, click Go and then select Utilities.

Utilities

  1. In the Utilities folder, double-click Terminal.

Terminal

  1. In Terminal, type sudo /Library/CS/falconctl uninstall and then press Enter.
  2. Populate the password for sudo and then press Enter.

Terminal with the command populated and entered

Warning: Password-protected installs of CrowdStrike Falcon Sensor fail to uninstall. Go to the Protected section for uninstall steps.
  1. Once uninstallation is complete, exit Terminal.
  1. In the Apple menu, click Go and then select Utilities.

Utilities

  1. In the Utilities folder, double-click Terminal.

Terminal

  1. In Terminal, type sudo /Library/CS/falconctl uninstall –password and then press Enter.
  2. Populate the password for sudo and then press Enter.

Terminal with the command populated and entered

  1. Populate a Password and then press Enter.

Terminal with the command populated and entered

Warning: Forgotten passwords can only be reset by opening a ticket with Dell support. For more information, reference Dell Data Security International Support Phone Numbers.
  1. Once uninstallation is complete, exit Terminal.

Linux

Based on your Linux distribution, run the appropriate command to uninstall the CrowdStrike Falcon Sensor from your host.

Note: Uninstalling the CrowdStrike Falcon Sensor requires sudo privileges.

Red Hat Enterprise Linux, CentOS, Amazon Linux

From Terminal, type sudo yum remove falcon-sensor and then press Enter.

Red Hat Enterprise Linux, CentOS, and Amazon Linux Terminal uninstall command

SUSE Linux Enterprise Server (SLES)

From Terminal, type sudo zypper remove falcon-sensor and then press Enter.

SUSE Linux Enterprise Server (SLES) Terminal uninstall command

Ubuntu

From Terminal, type sudo apt-get purge falcon-sensor and then press Enter.

Ubuntu Terminal uninstall command

Additional Information

Recommended Articles

Here are some recommended articles related to this topic that might be of interest to you.

Article Properties

Affected Product

CrowdStrike

Last Published Date

18 Apr 2024

Version

13

Article Type

How To

Back to Top