Endpoint Protection: CrowdStrike Removal - Boston University

If you wish to remove CrowdStrike from your computer

•  If it is a BU owned reach out to your local IT group or reach out to us at [email protected].
• To remove CrowdStrike Falcon from your personal machine please follow the appropriate instructions below below.

Windows Removal Instructions

Uninstall from Control Panel

1. Open the Windows Control Panel.
2. Click Uninstall a Program.
3. Choose CrowdStrike Windows Sensor and uninstall it.

Uninstall from the Command Line

1. Download CSUninstallTool
2. Run CSUninstallTool from the command line with this command: CsUninstallTool.exe /quiet

macOS Removal Instructions

Uninstalling the macOS Crowdstrike sensor requires use of the terminal. Do not attempt to manually delete the Falcon app in the Applications folder.

Follow the following steps to remove the sensor from a personally owned device:

1. Open System Settings, then navigate to Privacy & Security > App Management
2. Click the + button, then provide your password or Touch ID.
3. Navigate to /Applications/Utilities, select Terminal, and click Open. Once complete, Terminal should appear in the list with a blue toggle pointing right.
4. Launch the Terminal application by searching for it with Spotlight or by going to /Applications/Utilities/Terminal.app
5. Paste/type the following text into the command window: sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall
6. Type your local (administrator) account password

Once this command completes, Crowdstrike should be uninstalled from your system. You can then remove or disable Terminal's App Management access in System Settings.

Resolving CrowdStrike doesn’t exist error when uninstalling

When Falcon is uninstalled without pre-authorizing Terminal for App Management permissions, it can sometimes be left in a partially installed state. On the first attempt, you may see the error:

Error: Unable to complete uninstall of Falcon due to lack of App Management privilege.

Attempting to uninstall again returns an error similar to:

Error: Error Domain=NSCocoaErrorDomain Code=4 "The file “CrowdStrike” doesn’t exist."

Correcting this requires the use of Terminal. If you would like assistance with running these commands, please contact us.

1. Review steps 1-3 above to ensure that Terminal has App Management permissions.
2. Launch Terminal by searching for it with Spotlight or by going to /Applications/Utilities/Terminal.app
3. Paste or type the commands as follows, entering your password when prompted:
   • sudo chflags -R nouchg /Applications/Falcon.app
   • sudo rm -rf /Applications/Falcon.app
   • sudo rm -f /Library/LaunchAgents/com.crowdstrike.falcon.UserAgent.plist

Crowdstrike Falcon should now be fully uninstalled.

Linux Removal Instructions

• Ubuntu: sudo apt-get purge falcon-sensor

• RHEL, CentOS, Amazon Linux: sudo yum remove falcon-sensor

• SLES: sudo zypper remove falcon-sensor