Factorial IT can install the CrowdStrike Falcon sensor on macOS, Windows and Ubuntu devices. This guide covers the deployment and how to confirm that each sensor is actually activated in your CrowdStrike tenant.

Feature/Functionality

Overview

CrowdStrike Falcon is not deployed automatically. You download the installers from the CrowdStrike console, upload them, and add a script with your CustomerID (CID) to each package. Skip the CID and the sensor still installs, but it never activates in your CrowdStrike tenant.

How to use

1. Download the installers and copy your CID

1. Open the CrowdStrike admin console and go to Host setup and management > Deploy > Sensor downloads.
2. Download the installers you need: .pkg for macOS, .exe for Windows and .deb for Ubuntu (pick the one that matches your devices' CPU architecture).
3. In the How to install panel, copy your CID. You will need it in step 4.

2. Upload the configuration profile (macOS only)

Go to MDM > Controls, open your macOS control and upload the mobileconfig below as a Custom file.

Do this before you upload the installer. macOS will not run the Falcon system extension until it is approved, and this profile approves it in advance. The profile also sets Full Disk Access, notifications, the managed login item and the network filter. If the sensor lands on a device before the profile, its system extension sits waiting for approval until the profile arrives.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>AllowedSystemExtensions</key>
			<dict>
				<key>X9E956P446</key>
				<array>
					<string>com.crowdstrike.falcon.Agent</string>
				</array>
			</dict>
			<key>NonRemovableFromUISystemExtensions</key>
			<dict>
				<key>X9E956P446</key>
				<array>
					<string>com.crowdstrike.falcon.Agent</string>
				</array>
			</dict>
			<key>PayloadDescription</key>
			<string>Allows the CrowdStrike Falcon system extension without user approval.</string>
			<key>PayloadDisplayName</key>
			<string>System Extensions - Crowdstrike</string>
			<key>PayloadIdentifier</key>
			<string>com.fleet.systemextensions</string>
			<key>PayloadOrganization</key>
			<string>CrowdStrike Inc.</string>
			<key>PayloadType</key>
			<string>com.apple.system-extension-policy</string>
			<key>PayloadUUID</key>
			<string>6527669C-0C1F-4B84-998F-33902DBFEB86</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
		<dict>
			<key>PayloadDescription</key>
			<string>Grants Full Disk Access to the CrowdStrike Falcon processes.</string>
			<key>PayloadDisplayName</key>
			<string>Full Disk Access - Crowdstrike</string>
			<key>PayloadIdentifier</key>
			<string>com.fleet.privacy</string>
			<key>PayloadOrganization</key>
			<string>CrowdStrike Inc.</string>
			<key>PayloadType</key>
			<string>com.apple.TCC.configuration-profile-policy</string>
			<key>PayloadUUID</key>
			<string>C7B25543-8A46-4782-B5F1-FABF2CC07934</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Services</key>
			<dict>
				<key>SystemPolicyAllFiles</key>
				<array>
					<dict>
						<key>Allowed</key>
						<true/>
						<key>CodeRequirement</key>
						<string>identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446</string>
						<key>Identifier</key>
						<string>com.crowdstrike.falcon.Agent</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
						<key>StaticCode</key>
						<false/>
					</dict>
					<dict>
						<key>Allowed</key>
						<true/>
						<key>CodeRequirement</key>
						<string>identifier "com.crowdstrike.falcon.App" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446</string>
						<key>Identifier</key>
						<string>com.crowdstrike.falcon.App</string>
						<key>IdentifierType</key>
						<string>bundleID</string>
						<key>StaticCode</key>
						<false/>
					</dict>
				</array>
			</dict>
		</dict>
		<dict>
			<key>FilterDataProviderBundleIdentifier</key>
			<string>com.crowdstrike.falcon.Agent</string>
			<key>FilterDataProviderDesignatedRequirement</key>
			<string>identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "X9E956P446"</string>
			<key>FilterGrade</key>
			<string>inspector</string>
			<key>FilterPackets</key>
			<false/>
			<key>FilterSockets</key>
			<true/>
			<key>FilterType</key>
			<string>Plugin</string>
			<key>Organization</key>
			<string>CrowdStrike Inc.</string>
			<key>PayloadDescription</key>
			<string>Enables the CrowdStrike Falcon network filter.</string>
			<key>PayloadDisplayName</key>
			<string>Web Content Filter</string>
			<key>PayloadIdentifier</key>
			<string>com.fleet.webfilter</string>
			<key>PayloadType</key>
			<string>com.apple.webcontent-filter</string>
			<key>PayloadUUID</key>
			<string>E63C7607-408B-485F-BF2F-0900AAE6797F</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>PluginBundleID</key>
			<string>com.crowdstrike.falcon.App</string>
			<key>UserDefinedName</key>
			<string>CrowdStrike</string>
		</dict>
		<dict>
			<key>PayloadDescription</key>
			<string>Manages the CrowdStrike Falcon login item.</string>
			<key>PayloadDisplayName</key>
			<string>Service Management</string>
			<key>PayloadIdentifier</key>
			<string>com.fleet.servicemanagement</string>
			<key>PayloadOrganization</key>
			<string>CrowdStrike Inc.</string>
			<key>PayloadType</key>
			<string>com.apple.servicemanagement</string>
			<key>PayloadUUID</key>
			<string>A7C1E2B4-5D3F-4E8A-9B6C-1F2E3D4C5B6A</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Rules</key>
			<array>
				<dict>
					<key>Comment</key>
					<string>Falcon UserAgent</string>
					<key>RuleType</key>
					<string>BundleIdentifier</string>
					<key>RuleValue</key>
					<string>com.crowdstrike.falcon.UserAgent</string>
				</dict>
				<dict>
					<key>Comment</key>
					<string>All CrowdStrike login items</string>
					<key>RuleType</key>
					<string>TeamIdentifier</string>
					<key>RuleValue</key>
					<string>X9E956P446</string>
				</dict>
			</array>
		</dict>
		<dict>
			<key>NotificationSettings</key>
			<array>
				<dict>
					<key>AlertType</key>
					<integer>1</integer>
					<key>BundleIdentifier</key>
					<string>com.crowdstrike.falcon.UserAgent</string>
					<key>CriticalAlertEnabled</key>
					<false/>
					<key>NotificationsEnabled</key>
					<true/>
					<key>ShowInLockScreen</key>
					<false/>
					<key>ShowInNotificationCenter</key>
					<true/>
				</dict>
			</array>
			<key>PayloadDescription</key>
			<string>Configures notifications for the CrowdStrike Falcon UserAgent.</string>
			<key>PayloadDisplayName</key>
			<string>Notifications</string>
			<key>PayloadIdentifier</key>
			<string>com.fleet.notifications</string>
			<key>PayloadType</key>
			<string>com.apple.notificationsettings</string>
			<key>PayloadUUID</key>
			<string>F5E94A3F-6E76-4A28-AF32-068455731244</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
		</dict>
	</array>
	<key>PayloadDescription</key>
	<string>CrowdStrike Falcon - Full configuration (System Extensions, Full Disk Access, Web Filter, Service Management, Notifications)</string>
	<key>PayloadDisplayName</key>
	<string>CrowdStrike Falcon Configuration</string>
	<key>PayloadIdentifier</key>
	<string>com.factorialit.crowdstrike</string>
	<key>PayloadOrganization</key>
	<string>Factorial IT</string>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>D269B6A4-2E8D-4EC1-B818-ADAE81B8CF0B</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

3. Upload the installers as custom software

For each installer:

1. Go to MDM > Software, click Add, then Upload custom package, and upload the file.
2. Switch on Install automatically. Factorial IT then creates the policy that installs Falcon on targeted devices that do not have it yet.
3. For an .exe or a .deb, replace what is in Install detection query with the query for that platform (below). Factorial IT fills this field in advance with a guess based on the file name.
4. Under Targeting, choose Target all devices or Target by device group. No target is the default, and with it Install automatically installs the sensor nowhere.
5. Add the activation scripts (step 4), then click Add.

Install detection query by platform:

macOS: nothing to change. For a .pkg, Factorial IT generates the query.

Windows:

• SELECT 1 FROM programs WHERE name LIKE 'CrowdStrike Windows Sensor%';

Ubuntu:

• SELECT 1 FROM deb_packages WHERE name = 'falcon-sensor' AND status = 'install ok installed';

Every .deb is built for a single CPU architecture. Target it only at devices with that architecture, for example through a device group using the CPU architecture filter.

To install Falcon as soon as a device is provisioned, switch on Install during Zero Touch setup on each package. Combine it with the activation checks further down: during zero-touch deployment, the post-install script may run before the employee's account exists.

4. Add the activation scripts

Open Advanced settings in each package (it is already open when you add an .exe) and add the scripts for that platform. On macOS and Ubuntu, leave Install script alone: it is empty when you add the package, so the default install script is used. Replace the placeholder with your CID.

macOS

Paste this into Post-install script. It activates the sensor with your CID straight after installation, and does nothing on a device where the sensor is already activated.

#!/bin/bash
CUSTOMER_ID="YOUR-CUSTOMER-ID-HERE"
FALCONCTL="/Applications/Falcon.app/Contents/Resources/falconctl"

if [ -z "$CUSTOMER_ID" ] || [ "$CUSTOMER_ID" = "YOUR-CUSTOMER-ID-HERE" ]; then
  echo "No customer ID set"
  exit 1
fi

if [ ! -x "$FALCONCTL" ]; then
  echo "falconctl not found at $FALCONCTL"
  exit 1
fi

if "$FALCONCTL" stats agent_info 2>/dev/null | grep -q "agentID:.*[0-9a-fA-F]"; then
  echo "Already activated"
  exit 0
fi

if "$FALCONCTL" license "$CUSTOMER_ID"; then
  echo "Activation completed"
  exit 0
fi

echo "Activation failed"
exit 1

When the post-install script fails, the installation is marked as failed and the agent tries to remove the software. If a macOS install fails, check the CID first.

If your CrowdStrike tenant needs a provisioning token, follow the macOS sensor deployment guide in your Falcon console to hand it to falconctl.

Windows

Swap the install and uninstall scripts for the ones below. In the install script, replace CustomerID with your CID.

Install script:

$exeFilePath = "${env:INSTALLER_PATH}"

try {
  $processOptions = @{
    FilePath     = "$exeFilePath"
    ArgumentList = "/install /quiet /norestart CID=CustomerID"
    PassThru     = $true
    Wait         = $true
  }
  $process = Start-Process @processOptions
  $exitCode = $process.ExitCode
  Write-Host "Install exit code: $exitCode"
  Exit $exitCode
} catch {
  Write-Host "Error: $_"
  Exit 1
}

If your CrowdStrike tenant needs a provisioning token, put it after the CID in ArgumentList: CID=CustomerID ProvToken=YourToken.

Uninstall script:

try {
  $regPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"
  )
  $app = $regPaths |
    ForEach-Object { Get-ChildItem $_ -ErrorAction SilentlyContinue } |
    Get-ItemProperty |
    Where-Object { $_.DisplayName -like "CrowdStrike Windows Sensor*" } |
    Select-Object -First 1

  if (-not $app) {
    Write-Host "CrowdStrike Falcon not found, nothing to uninstall"
    Exit 0
  }

  $processOptions = @{
    FilePath     = $app.UninstallString
    ArgumentList = "/quiet /norestart"
    PassThru     = $true
    Wait         = $true
  }
  $process = Start-Process @processOptions
  $exitCode = $process.ExitCode
  Write-Host "Uninstall exit code: $exitCode"
  Exit $exitCode
} catch {
  Write-Host "Error: $_"
  Exit 1
}

Ubuntu

Paste this into Post-install script. It mirrors CrowdStrike's own Linux install script: it sets your CID and then starts the falcon-sensor service. On a device where the sensor is already running, it does nothing.

#!/bin/bash
CUSTOMER_ID="YOUR-CUSTOMER-ID-HERE"
PROVISIONING_TOKEN=""   # only if your Falcon console requires one
FALCONCTL="/opt/CrowdStrike/falconctl"

if [ -z "$CUSTOMER_ID" ] || [ "$CUSTOMER_ID" = "YOUR-CUSTOMER-ID-HERE" ]; then
  echo "No customer ID set"
  exit 1
fi

if [ ! -x "$FALCONCTL" ]; then
  echo "falconctl not found at $FALCONCTL"
  exit 1
fi

if pgrep -u root falcon-sensor >/dev/null 2>&1; then
  echo "Sensor already running"
  exit 0
fi

ARGS="--cid=$CUSTOMER_ID"
if [ -n "$PROVISIONING_TOKEN" ]; then
  ARGS="$ARGS --provisioning-token=$PROVISIONING_TOKEN"
fi

# shellcheck disable=SC2086
if ! "$FALCONCTL" -s -f $ARGS; then
  echo "Activation failed"
  exit 1
fi

if command -v systemctl >/dev/null 2>&1; then
  systemctl restart falcon-sensor || { echo "Sensor start failed"; exit 1; }
else
  service falcon-sensor restart || { echo "Sensor start failed"; exit 1; }
fi

echo "Activation completed"
exit 0

Set PROVISIONING_TOKEN only if your CrowdStrike tenant needs one; otherwise leave it empty.

Once activated, the sensor may take a few minutes to show up in your CrowdStrike console.

If the script ends with an error, the installation is marked as failed and the agent runs the uninstall script, which removes the sensor. If an Ubuntu install fails, check the CID first.

If you are editing a package you added earlier, click Save.

Check that the sensor is activated

A sensor can be installed without being activated. Without a valid CID it reports nothing to your CrowdStrike tenant, yet the install detection query still passes. The checks below cover macOS and Ubuntu.

Create these policies in Fleet (Policies > Add Policy) to spot the devices that need fixing:

CrowdStrike activated fails when the sensor has no agent ID or no CID:

• SELECT 1 FROM crowdstrike_falcon
  WHERE agent_id IS NOT NULL AND agent_id != ''
    AND cid IS NOT NULL AND cid != '';

CrowdStrike sensor loaded fails when the sensor has its CID but is not running. On macOS this usually means the system extension has not been approved:

• SELECT 1 FROM crowdstrike_falcon WHERE sensor_loaded = 'true';

CrowdStrike full protection fails when the sensor is in reduced functionality mode, with weaker protection. This typically happens after an OS or kernel upgrade that the installed sensor version does not support yet:

• SELECT 1 FROM crowdstrike_falcon WHERE reduced_functionality_mode = 'false';

CrowdStrike system extension active (macOS only) fails when the Falcon system extension is not activated and enabled, for example while it is still waiting for approval:

• SELECT 1 FROM system_extensions
  WHERE identifier = 'com.crowdstrike.falcon.Agent'
    AND team = 'X9E956P446'
    AND state = 'activated_enabled';

The crowdstrike_falcon table needs fleetd 1.50 or later. It is available on macOS and Linux, not on Windows.

To retry activation automatically, attach the post-install script for the matching platform to the CrowdStrike activated policy as a script automation (see Fleet's guide: https://fleetdm.com/guides/policy-automation-run-script). Use a separate policy per platform. Fleet runs the script when a device starts failing the policy and tries again up to three times while the script returns an error. Both scripts leave an already activated or running sensor untouched, so the retries are safe.

Troubleshooting and FAQ

Troubleshooting

• A macOS or Ubuntu install is marked as failed. The post-install script returned an error, so the agent removed the sensor. Check the CID first.
• The sensor is installed but does not appear in CrowdStrike. It was probably installed without a valid CID. The CrowdStrike activated policy flags these devices. Right after activation, allow a few minutes for registration.
• The sensor has its CID but is not running on a Mac. The system extension is usually waiting for approval. Check that the configuration profile is installed. The CrowdStrike system extension active policy shows the affected devices.
• The sensor runs in reduced functionality mode. This usually follows an OS or kernel upgrade that your sensor version does not support yet. Check that your sensor version supports the new OS or kernel.
• Nothing installs even with Install automatically switched on. Check Targeting: with No target selected, no device gets the sensor.

FAQ

1. Where do I find my CID?
   In the CrowdStrike console, in the How to install panel under Host setup and management > Deploy > Sensor downloads.
    
2. My tenant requires a provisioning token. Where does it go?
   On Windows, after the CID in ArgumentList. On Ubuntu, in PROVISIONING_TOKEN. On macOS, follow the sensor deployment guide in your Falcon console.
    
3. Do the activation checks work on Windows?
   No. The crowdstrike_falcon table exists only on macOS and Linux.
    
4. Is it safe to re-run the activation scripts?
   Yes. They make no changes on a device that is already activated or running.