This article provides steps to enable, locate, and disable the CrowdStrike Falcon Sensor maintenance token.
Affected Products:
- CrowdStrike Falcon Sensor
Affected Versions:
Affected Operating Systems:
In CrowdStrike Falcon Sensor v5.10 and later, a maintenance token is used to protect the software from unauthorized removal or tampering. The maintenance token replaces the previous password protection feature. A CrowdStrike falcon administrator can Enable, Locate, or Disable maintenance tokens in their environment. Click the appropriate action for more information.
Note: New Sensor Update Policies have Uninstall and maintenance protection enabled for individual hosts. These steps are only required for older Sensor Update Policies or enabling Bulk maintenance mode.
- In a Google Chrome or Microsoft Edge browser, go to your Falcon Console login URL.
- Populate the CrowdStrike account holder’s credentials, and then click Log In.
![Falcon Console log in](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_1.jpeg)
- In the left menu pane, select Host setup and management and then select Sensor update policies.
![Going to Host setup and management and then selecting Sensor update policies](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_2.jpeg)
- Select the targeted Sensor Update Policy Name and then click Edit Policy.
![Edit Policy](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_3.jpeg)
Note: The Sensor Update Policy Name may differ in your environment.
- Turn on Uninstall and maintenance protection.
![Enabling Uninstall and maintenance protection](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_4.jpeg)
- If using Bulk maintenance mode, go to Step 7. Otherwise, go to Step 9.
- Under Sensor version, select Sensor version updates off.
![Sensor version updates off](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_5.jpeg)
- Turn on Bulk maintenance mode.
![Enabling Bulk maintenance mode](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_6.jpeg)
- To the right of Sensor update policy settings, click Save.
![Save](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_7.jpeg)
- Confirm the policy change.
Note: Online hosts may take up to five minutes to receive the new policy.
A maintenance token can be configured to:
- Individual hostnames using a unique token
- Bulk groups using a static token
Click Individual or Bulk for location information.
Individual
- In a Google Chrome or Microsoft Edge browser, go to your Falcon Console login URL.
- Populate the CrowdStrike account holder’s credentials, and then click Log In.
![Falcon Console log in](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_8.jpeg)
- In the left menu pane, select Host setup and management and then select Host management.
![Host setup and management and Host management](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_9.jpeg)
Note: The layout in the example may differ slightly from your environment.
- Locate and then click the targeted Hostname.
- In the hostname display, click Reveal maintenance token.
![Reveal maintenance token](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_10.jpeg)
Note: Reveal maintenance token is disabled if bulk maintenance token is enabled.
- Optionally, input a Reason for Token Reveal and then click Reveal Token.
![Reveal Token](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_11.jpeg)
- Record the hostname Maintenance Token and then click Done.
![Recording the hostname maintenance token](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_12.jpeg)
Note: The Maintenance Token will differ in your environment.
Bulk
- In a Google Chrome or Microsoft Edge browser, go to your Falcon Console login URL.
- Populate the CrowdStrike account holder’s credentials, and then click Log In.
![Falcon Console log in](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_13.jpeg)
- In the left menu pane, select Host setup and management and then select Sensor update policies.
![Host setup and management and Sensor update policies](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_14.jpeg)
- Select the targeted Sensor Update Policy Name and then click Edit Policy.
![Edit Policy](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_15.jpeg)
Note:
- The Sensor Update Policy Name can also be located under the specific hostname in Host Management.
- The Sensor Update Policy Name may differ in your environment.
- Under Bulk maintenance mode, click REVEAL TOKEN.
![Reveal Token](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_16.jpeg)
- Optionally, input a Reason for Token Reveal and then click Reveal Token.
![Revealing the token](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_17.jpeg)
- Record the Policy Maintenance Token and then click Done.
![Recording the policy maintenance token](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_18.jpeg)
Warning:
- A Policy Maintenance Token is not re-created on reinstall.
- A Policy Maintenance Token should not be provided directly to the end user.
- The Policy Maintenance Token will differ in your environment.
- In a Google Chrome or Microsoft Edge browser, go to your Falcon Console login URL.
- Populate the CrowdStrike account holder’s credentials, and then click Log In.
![Falcon Console log in](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_19.jpeg)
- In the left menu pane, select Host setup and management and then select Sensor update policies.
![Host setup and management and Sensor update policies](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_20.jpeg)
- Select the targeted Sensor Update Policy Name and then click Edit Policy.
![Edit Policy](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_21.jpeg)
Note: The Sensor Update Policy Name may differ in your environment.
- Turn off Uninstall and maintenance protection.
![Disabling Uninstall and maintenance protection](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_22.jpeg)
- To the right of Sensor update policy settings, click Save.
![Save](https://supportkb.dell.com/img/ka06P000000srX0QAI/ka06P000000srX0QAI_en_US_23.jpeg)
- Confirm the policy change.
Note:
- If Bulk maintenance mode was enabled, it will be disabled after clicking Confirm.
- Online hosts may take up to five minutes to receive the new policy.
To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.