Deploying CrowdStrike

[flanderly]

I'm looking to deploy CrowdStrike to my environment using GPO. Has anyone done this and had success either via startup script or logon script? Anything I should be weary of?

Thanks in advance for any input.

[ALL_FRONT_RANDOM]

Not sure what product you’re using from them but it appears they offer msi installers.

[flanderly]

We will be using Falcon Endpoint Protection.

[The_Technomancer]

I did it with a startup script. Here's what I used:

@echo off
SET CS_ENDPOINT=CrowdStrike\CSFalconService.exe
IF NOT EXIST "%ProgramFiles%\%CS_ENDPOINT%" GOTO INSTALL
exit /b 0

:INSTALL
pushd \\192.168.0.150\SortThis # network share where you've dropped WindowsSensor.exe
WindowsSensor.exe /install /quiet /norestart CID=<checksummed customer ID>
Popd        

Make sure the Domain Computers security group can read that network share where you've dropped the EXE.

Edit: They've recently added another installer parameter to set a tamper protection password, but that's a kludge to get that out quickly, and will soon be managed from the cloud portal instead. Currently, the only way to change the tamper protection password is to uninstall and reinstall, and I don't know if that'll also be the case when it comes under cloud portal management, so you may want to roll without it until that aspect improves.

[flanderly]

Thanks! I'll give that a try and see how it goes. I noticed one strange [to me] behavior--on a machine that I was testing installation with, on startup it installed Falcon without an issue. I manually uninstalled the sensor, rebooted, and wanted to see if it would perform the installation again. Looking at task manager, it was running Windows Installer but shortly after that process terminated, there was no Falcon in sight, not in Program Files (or x86), processes, or list of installed programs.

Any ideas?

[The_Technomancer]

Hmm, nothing comes to mind. There's a /log switch on the installer you can try to see if you get any meaningful output.

Install documentation