{"id":132005,"date":"2020-11-19T13:58:50","date_gmt":"2020-11-19T18:58:50","guid":{"rendered":"http:\/\/www.bu.edu\/tech\/?page_id=132005"},"modified":"2025-03-07T15:30:57","modified_gmt":"2025-03-07T20:30:57","slug":"endpoint-protection-crowdstrike-removal","status":"publish","type":"page","link":"https:\/\/www.bu.edu\/tech\/services\/cccs\/desktop\/device-security\/endpoint-protection\/endpoint-protection-crowdstrike-removal\/","title":{"rendered":"Endpoint Protection: CrowdStrike Removal"},"content":{"rendered":"<p>If you wish to remove CrowdStrike from your computer<\/p>\n<ul>\n<li>\u00a0If it is a <strong>BU owned<\/strong> reach out to your local IT group or reach out to us at<a href=\"mailto:ithelp@bu.edu\"> ithelp@bu.edu<\/a>.<\/li>\n<li>To remove CrowdStrike Falcon from your <span style=\"text-decoration: underline;\"><strong>personal<\/strong><\/span> machine please follow the appropriate instructions below below.<\/li>\n<\/ul>\n<h2>Windows Removal Instructions<\/h2>\n<h4>Uninstall from Control Panel<\/h4>\n<ol>\n<li>Open the Windows Control Panel.<\/li>\n<li>Click Uninstall a Program.<\/li>\n<li>Choose CrowdStrike Windows Sensor and uninstall it.<\/li>\n<\/ol>\n<h4>Uninstall from the Command Line<\/h4>\n<ol>\n<li>Download <a href=\"https:\/\/msea.bu.edu\/studfacstaff\/Crowdstrike\/CsUninstallTool.exe\">CSUninstallTool<\/a><\/li>\n<li>Run CSUninstallTool from the command line with this command:<br \/>\n<code>CsUninstallTool.exe \/quiet<\/code><\/li>\n<\/ol>\n<h2>macOS Removal Instructions<\/h2>\n<p>Uninstalling the macOS Crowdstrike sensor requires use of the terminal. Do not attempt to manually delete the Falcon app in the Applications folder.<\/p>\n<p>Follow the following steps to remove the sensor from a personally owned device:<\/p>\n<ol>\n<li>Open System Settings, then navigate to Privacy &amp; Security &gt; App Management<\/li>\n<li>Click the + button, then provide your password or Touch ID.<\/li>\n<li>Navigate to \/Applications\/Utilities, select Terminal, and click Open. Once complete, Terminal should appear in the list with a blue toggle pointing right.<br \/>\n<img loading=\"lazy\" src=\"\/tech\/files\/2025\/03\/macos-app_management-terminal.png\" alt=\"Screenshot of macOS App Management privacy pane showing Terminal listed with toggle in the on position\" width=\"368\" height=\"120\" class=\"wp-image-156244 aligncenter\" srcset=\"https:\/\/www.bu.edu\/tech\/files\/2025\/03\/macos-app_management-terminal.png 964w, https:\/\/www.bu.edu\/tech\/files\/2025\/03\/macos-app_management-terminal-636x207.png 636w, https:\/\/www.bu.edu\/tech\/files\/2025\/03\/macos-app_management-terminal-768x250.png 768w\" sizes=\"(max-width: 368px) 100vw, 368px\" \/><\/li>\n<li>Launch the Terminal application by searching for it with Spotlight or by going to <strong>\/Applications\/Utilities\/Terminal.app<\/strong><\/li>\n<li>Paste\/type the following text into the command window:<br \/>\n<code><span>sudo \/Applications\/Falcon.app\/Contents\/Resources\/falconctl uninstall<\/span><\/code><\/li>\n<li>Type your local (administrator) account password<\/li>\n<\/ol>\n<p>Once this command completes, Crowdstrike should be uninstalled from your system. You can then remove or disable Terminal&#8217;s App Management access in System Settings.<\/p>\n<div class=\"bu_collapsible_container \" aria-live=\"polite\" data-customize-animation=\"false\"><h3 class=\"bu_collapsible\" aria-expanded=\"false\"tabindex=\"0\" role=\"button\">Resolving CrowdStrike doesn\u2019t exist error when uninstalling<\/h3><div class=\"bu_collapsible_section\" style=\"display: none;\"><\/p>\n<p>When Falcon is uninstalled without pre-authorizing Terminal for App Management permissions, it can sometimes be left in a partially installed state. On the first attempt, you may see the error:<\/p>\n<blockquote><p>Error: Unable to complete uninstall of Falcon due to lack of App Management privilege.<\/p><\/blockquote>\n<p>Attempting to uninstall again returns an error similar to:<\/p>\n<blockquote><p>Error: Error Domain=NSCocoaErrorDomain Code=4 &#8220;The file \u201cCrowdStrike\u201d doesn\u2019t exist.&#8221;<\/p><\/blockquote>\n<p>Correcting this requires the use of Terminal. If you would like assistance with running these commands, please <a href=\"https:\/\/bu.edu\/tech\/contact\">contact us<\/a>.<\/p>\n<ol>\n<li>Review steps 1-3 above to ensure that Terminal has App Management permissions.<\/li>\n<li>Launch Terminal by searching for it with Spotlight or by going to \/Applications\/Utilities\/Terminal.app<\/li>\n<li>Paste or type the commands as follows, entering your password when prompted:\n<ul>\n<li><code>sudo chflags -R nouchg \/Applications\/Falcon.app<\/code><\/li>\n<li><code>sudo rm -rf \/Applications\/Falcon.app<\/code><\/li>\n<li><code>sudo rm -f \/Library\/LaunchAgents\/com.crowdstrike.falcon.UserAgent.plist<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>Crowdstrike Falcon should now be fully uninstalled.<\/p>\n<p><\/div>\n<\/div>\n\n<h2>Linux Removal Instructions<\/h2>\n<div id=\"__rendered-mobiledoc-entity-236\" class=\"__rendered-mobiledoc-card __rendered-mobiledoc-card-mobiledoc-cards\/nth-level-list\/card\">\n<div local-class=\"nth-level-list\" data-cs-selector=\"nth-level-list-card\">\n<ul data-cs-selector=\"nth-level-list-card-list-item\">\n<li data-cs-selector=\"nth-level-list-card-list-item\">\n<div id=\"ember1061\" class=\"render-mobiledoc ember-view\">\n<div id=\"__rendered-mobiledoc-entity-1062\" class=\"\">\n<p>Ubuntu:<span>\u00a0<\/span><code>sudo apt-get purge falcon-sensor<\/code><\/p>\n<\/div>\n<\/div>\n<\/li>\n<li data-cs-selector=\"nth-level-list-card-list-item\">\n<div id=\"ember1065\" class=\"render-mobiledoc ember-view\">\n<div id=\"__rendered-mobiledoc-entity-1066\" class=\"\">\n<p>RHEL, CentOS, Amazon Linux:<span>\u00a0<\/span><code>sudo yum remove falcon-sensor<\/code><\/p>\n<\/div>\n<\/div>\n<\/li>\n<li data-cs-selector=\"nth-level-list-card-list-item\">\n<div id=\"ember1069\" class=\"render-mobiledoc ember-view\">\n<div id=\"__rendered-mobiledoc-entity-1070\" class=\"\">\n<p>SLES:<span>\u00a0<\/span><code>sudo zypper remove falcon-sensor<\/code><\/p>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<div id=\"__rendered-mobiledoc-entity-237\" class=\"__rendered-mobiledoc-card __rendered-mobiledoc-card-mobiledoc-cards\/linkable-heading\/card\">\n<div class=\"mobiledoc-cards-linkable-heading-card__linkable-heading\" data-cs-selector=\"linkable-heading-card\">\n<p><a data-cs-selector=\"link-name\" name=\"troubleshooting-sensor-installation\"><\/a><\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>If you wish to remove CrowdStrike from your computer \u00a0If it is a BU owned reach out to your local IT group or reach out to us at ithelp@bu.edu. To remove CrowdStrike Falcon from your personal machine please follow the appropriate instructions below below. Windows Removal Instructions Uninstall from Control Panel Open the Windows Control&#8230;<\/p>\n","protected":false},"author":3455,"featured_media":0,"parent":126522,"menu_order":2,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/132005"}],"collection":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/users\/3455"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/comments?post=132005"}],"version-history":[{"count":14,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/132005\/revisions"}],"predecessor-version":[{"id":156249,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/132005\/revisions\/156249"}],"up":[{"embeddable":true,"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/pages\/126522"}],"wp:attachment":[{"href":"https:\/\/www.bu.edu\/tech\/wp-json\/wp\/v2\/media?parent=132005"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}