[ QUESTION ] `Uninstall-FalconSensor` - How long does it take?

CrowdStrike / psfalcon

PowerShell for CrowdStrike's OAuth2 APIs

The Unlicense

350 stars 66 forks source link

[ QUESTION ] `Uninstall-FalconSensor` - How long does it take? #353

Closed nick-harper closed 11 months ago

nick-harper commented 11 months ago

I have pushed out a command to Uninstall the Falcon Sensor to a few machines but they still look to have this installed in Add / Remove Programs and they also show in the Falcon Dashboard.

How long should it take for them to be completely removed from the system?

bk-cs commented 11 months ago

The uninstall process should take a few minutes.

Did Uninstall-FalconSensor indicate that the uninstall started?
Did you check to see if there were any running PowerShell or cmd processes?
Did the devices have any recent changes in their uninstall protection settings in the assigned Sensor Update policy?

nick-harper commented 11 months ago

Actually, I didn't get any sort of confirmation to say it had started. The User / Secret has the correct privileges though.

I did set them to a new Sensor Update group to unlock them (just to be sure).

bk-cs commented 11 months ago

There should be an output when you run the command saying that the process has started. If that was blank, the command likely failed. Is it possible that the system has more than one copy of Falcon listed in "Add & Remove Programs", or is running 64-bit? There are two known issues for this that will be fixed in the next release:

https://github.com/CrowdStrike/psfalcon/issues/315 https://github.com/CrowdStrike/psfalcon/issues/317