Install the CrowdStrike Falcon Agent

You can download and install the CrowdStrike Falcon Agent on Windows and macOS devices from the JumpCloud Admin Portal. CrowdStrike provides cloud security and threat detection software. 

For macOS devices, you’ll also need to apply a policy in JumpCloud that creates a Mobile Device Management (MDM) profile and sets the necessary permissions required by the CrowdStrike Falcon Agent. If you're running macOS on an Intel processor that uses a kernel extension with the CrowdStrike firmware analysis tool, you’ll need to apply a second policy.

Creating a MacOS CrowdStrike Policy

Every Apple silicon and macOS device requires the CrowdStrike Falcon MDM Settings (No kernel extension) Policy described below.  If you have a macOS device on Intel that includes a kernel extension policy to run CrowdStrike’s firmware analysis tool, you’ll also need to apply the CrowdStrike Falcon Firmware Analysis Settings Policy (Intel only).

• CrowdStrike Falcon MDM Settings (No kernel extension) Policy - Use this general policy to configure Apple silicon devices and macOS devices with Intel processors. This policy installs the necessary permissions on Apple silicon devices and macOS devices with Intel processors, including Full Disk Access, Notifications, System Extensions, and Web Content Filter permissions. It also creates an MDM licensing profile.
• CrowdStrike Falcon Firmware Analysis Settings Policy (Intel only) - Use this policy for macOS devices with Intel processors that include a kernel extension to run CrowdStrike’s firmware analysis tool. This policy installs the necessary permissions for the Falcon Firmware Analysis tool. You’ll apply both this policy and the CrowdStrike Falcon MDM Settings policy to all macOS devices with Intel processors that run the firmware analysis tool.

Have your CrowdStrike Customer ID (CCID) checksum handy because both CrowdStrike policies will use it to create the MDM profile.

To create a macOS CrowdStrike Policy:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Policy Management.
3. Select the All tab, then click (+) and select the Mac tab.
4. To create a policy for a silicon macOS device or a macOS device that uses an Intel processor, locate the CrowdStrike Falcon MDM Settings (No kernel extension) policy, then click configure.
   1. (Optional) Under Policy Name, enter a new, unique name for the policy or keep the default. 
   2. Under CCID, enter your CCID. Locate your CCID on the Falcon Sensor download page. Including the CCID in this policy automatically licenses Falcon on your macOS devices so you don’t need to run an activation command.
      
   3. (Optional) Select the Device Groups tab, then select one or more device groups where you'll apply this policy.
   4. (Optional) Select the Devices tab, then select one or more devices where you'll apply this policy.
   5. Click save, then click save again.
5. To create a policy for a macOS device that uses an Intel processor to run CrowdStrike’s firmware analysis tool, locate the CrowdStrike Falcon Firmware Analysis Settings Policy (Intel only), then click configure.
   1. (Optional) On the New Policy panel, enter a new, unique name for the policy or keep the default.
      
   2. (Optional) Select the Device Groups tab, then select one or more device groups where you'll apply this policy.
   3. (Optional) Select the Devices tab, then select one or more devices where you'll apply this policy.
   4. Click save, then click save again.
6. Run the command you created in To install the CrowdStrike Falcon Agent on a macOS device below by selecting the checkbox next to the command on the Commands page and clicking run now. 

7. After the command finishes, select the Results tab on the Commands page. An exit code of 0 indicates that the command ran successfully. If multiple commands are processed at runtime, only the last exit code is reported. For a list of all exit codes, see Understand Command Results. 
8. Verify that your CrowdStrike policy was applied on the macOS device (From the Apple menu, System Settings > Privacy & Security > Profiles):
   

To further verify the policy, run this command:

The CrowdStrike policy does not appear in Apple’s System Settings > Privacy & Security > Full Disk Access location. That location contains policies that the user approves or has approved, rather than Admin-approved policies like the Application Privacy Preferences Policy.

Installing the CrowdStrike Falcon Agent

MacOS

To install the CrowdStrike Falcon Agent on a macOS device:

1. Log in to your CrowdStrike Portal.
2. Create a new CrowdStrike API Client with Sensor Download - Read Scope by performing these steps:
   1. Click the hamburger menu.
      
   2. Select Support and Resources. 
   3. Under Resources and Tools, click API clients and keys.
   4. Click Add new API Client.
   5. Enter the Client Name and Description.
   6. Navigate to Sensor Download and select Read scope. 
      
   7. Click Add.
3. Save the Client ID, Secret, and Base URL Information for future use.
4. Log in to the JumpCloud Admin Portal.
5. Go to DEVICE MANAGEMENT > Commands.
6. Select the Commands tab, then click (+) and choose Command from Template. 
7. Select MacOS and locate the the Mac - Install CrowdStrike Falcon Agent template. See Get Started: Commands for more information.
8. Click configure.
9. (Optional) You can edit the default name for this command or type a new name.
10. Click Run As, then choose root.
11. Under Type, click Mac.
12. Edit the script to update the CSBaseAddress, CSClientID, CSClientSecret, and (if applicable) CSInstallToken with the information collected in Step 3. 
    • Only set the CSInstallToken variable if you have Require Token enabled in your CrowdStrike org under Host setup and management > Deploy > Installation tokens.
      

13. If you want to schedule when the command runs or trigger the command, click Event and choose another option. The default is Run Manually.
14. Under Options, increase the timeout if you want. The CrowdStrike default is 600 seconds.
    • The command may throw a 124 error if the command times out. This is more likely to occur on slower networks. 
15. Under TTL Settings, verify that Use Smart Defaults is selected.
16. Assign the Falcon agent to your devices:
    • If you are assigning the Falcon Agent to individual devices, select the Devices tab and select the checkbox next to each device where you want to install the agent.
    • If you are assigning the Falcon Agent to groups of devices, select the Device Groups tab and select the checkbox next to each device group where you want to install the agent.
17. Click save, then click save again.
18. Run the command by selecting the checkbox next to the command on the Commands page and clicking run now. If the command doesn’t run, verify that you have root permissions. 

19. ​​​​​​After the command finishes, select the Results tab on the Command page. An exit code of 0 indicates that the command ran successfully. If multiple commands are processed at runtime, only the last exit code is reported. For a list of all exit codes, see Understand Command Results.

Windows

To install the CrowdStrike Falcon Agent on a Windows device:

1. Log into your CrowdStrike Portal.
2. Create a new CrowdStrike API Client with Sensor Download - Read Scope by performing the following:
   1. Click the hamburger menu.
      
   2. Select Support and Resources. 
   3. Under Resources and Tools, click API clients and keys.
   4. Click Add new API Client.
   5. Enter the Client Name and Description.
   6. Navigate to Sensor Download and select Read scope. 
      
   7. Click Add.
3. Save the Client ID, Secret, and Base URL Information for future use.
4. Log in to the JumpCloud Admin Portal.
5. Go to DEVICE MANAGEMENT > Commands.
6. Select the Commands tab, then click (+) and choose Command from Template. 
7. Select Windows and locate the the Windows - Install CrowdStrike Falcon Agent template. See Get Started: Commands for more information.
8. Click configure.
9. (Optional) You can edit the default name for this command or type a new name.
10. Under Type, click Windows.
11. Edit the script to update the CSBaseAddress, CSClientID, CSClientSecret, and (if applicable) CSInstallToken with the information collected in Step 3. 
    • Only set the CSInstallToken variable if you have Require Token enabled in your CrowdStrike org under Host setup and management > Deploy > Installation tokens.
      

12. Click Launch Event, then choose Run as Repeating to run the command at the top of every hour.
13. Under Options, ensure that the interval is set to 3600 seconds (1 hour).
    • The command may throw a 124 error if the command times out. This is more likely to occur on slower networks. 
14. Assign the Falcon agent to your devices:
    • If you are assigning the Falcon Agent to individual devices, select the Devices tab and select the checkbox next to each device where you want to install the agent.
    • If you are assigning the Falcon Agent to groups of devices, select the Device Groups tab and select the checkbox next to each device group where you want to install the agent.
15. Click save, then click save again. 
16. Run the command by selecting the checkbox next to the command on the Commands page and clicking run now. If the command doesn’t run, verify that you have root permissions.
17. After the command finishes, select the Results tab on the Commands page. An exit code of 0 indicates that the command ran successfully. If multiple commands are processed at runtime, only the last exit code is reported. For a list of exit codes, see Understand Command Results. 
18. Click view to see more information about the results.

Troubleshooting

You can use a JumpCloud command to quickly check the status of a CrowdStrike agent installation.

To troubleshoot a macOS CrowdStrike installation:

1. Go to DEVICE MANAGEMENT > Commands.
2. Select the Commands tab, then click (+) and choose New Command. 
3. Enter a name for this command and choose root for Run As.
4. Select the OS where you are installing the CrowdStrike agent.
5. Type /Applications/Falcon.app/Contents/Resources/falconctl stats in the Command area, then click save.
6. On the Commands page, select the checkbox for the new command you created and click Run Now.
7. Select the Results tab and verify that the Sensor operation value is true. Check this section, which is in the larger body of data that is returned from the falconctl binary: