Uninstall FalconSensor - CrowdStrike/psfalcon GitHub Wiki

Uninstall-FalconSensor

SYNOPSIS

Use Real-time Response to uninstall the Falcon sensor from a host

DESCRIPTION

This command uses information from the registry and/or relevant Falcon command line utilities of the target host to uninstall the Falcon sensor. If the sensor is damaged or malfunctioning, Real-time Response may not work properly and/or the uninstallation may not succeed.

Requires 'Hosts: Read', 'Sensor update policies: Write', 'Real time response: Read', and 'Real Time Response (Admin): Write'.

PARAMETERS

Name Type Description Min Max Allowed Pipeline PipelineByName
QueueOffline Boolean Add command request to the offline queue
Include String[] Include additional properties agent_version
cid
external_ip
first_seen
hostname
last_seen
local_ip
mac_address
os_build
os_version
platform_name
product_type
product_type_desc
serial_number
system_manufacturer
system_product_name
tags
Id String Host identifier X X

SYNTAX

Uninstall-FalconSensor [[-QueueOffline] <Boolean>] [[-Include] <String[]>] [-Id] <String> [-WhatIf] [-Confirm] [<CommonParameters>]

USAGE

2023-04-25: PSFalcon v2.2.5

⚠️ **GitHub.com Fallback** ⚠️