Deploy CrowdStrike Falcon via Intune | Win32 Guide
CrowdStrike Falcon is one of the most deployed EDR agents in managed Windows environments. The sensor installs silently using your Customer ID (CID) to automatically register with your Falcon console. The key things to get right are the CID in the install command, the provisioning token if your environment uses one, and handling the reboot requirement.
Prerequisites
- A CrowdStrike Falcon subscription (Prevent, Insight, or above)
- Your Customer ID (CID) from the Falcon console
- A Provisioning Token if your environment has sensor anti-tampering enabled
- Access to the Falcon console at falcon.crowdstrike.com
Download the sensor installer
Log in to your Falcon console and work through to:
Host Setup and Management → Deploy → Sensor Downloads
Download the latest Windows Sensor EXE. The filename will be CrowdStrike_WindowsSensor_
Wrap with the Content Prep Tool
IntuneWinAppUtil.exe -c "C:\AppSource\CrowdStrike" -s "CrowdStrike_WindowsSensor.exe" -o "C:\IntunePackages"
Add the app in Intune
- Upload the .intunewin file
- Name: CrowdStrike Falcon Sensor
- Publisher: CrowdStrike, Inc.
Install and uninstall commands
Detection rule
Simpler alternative - check for the service:
# Detect CrowdStrike Falcon Sensor
$svc = Get-Service -Name "CSFalconService" -ErrorAction SilentlyContinue
if ($svc) { Write-Output "Detected"; exit 0 } else { exit 1 }Known gotchas
Reboot required
CrowdStrike Falcon installs a kernel driver and almost always requires a reboot. Plan your deployment window accordingly. Set the Intune restart behaviour to handle return code 3010 as a soft reboot.
Uninstall requires maintenance token
If your Falcon policy has sensor anti-tampering enabled, the standard uninstall command will fail. You need a maintenance token from the Falcon console (under Host Management for the specific device) to uninstall. This is intentional and a security feature - make note of this before deploying.
Frequently Asked Questions
Use: CrowdStrike_WindowsSensor.exe /install /quiet /norestart CID=your-customer-id. The CID (Customer ID) links the sensor to your Falcon console automatically on install.
Log in to your Falcon console at falcon.crowdstrike.com, go to Host Setup and Management > Deploy > Sensor Downloads. Your CID is shown at the top of the page.
Use a file detection rule: check for CSFalconService.exe in C:\Windows\System32\drivers. Alternatively check the Windows service: Get-Service CSFalconService.
Yes, CrowdStrike Falcon typically requires a reboot to complete installation and start the kernel driver. Set device restart behaviour to determine based on return codes, or schedule a reboot via a separate Intune configuration.