CrowdStrike Sensor Deployment | Coreslab Corporate IT

Implementation Instructions

  1. Download the appropriate installation script (ZIP File) for your location.
  2. Extract the ZIP to a temp folder like C:\Temp.
  3. Open a CMD (Dos Prompt) with Administrator Privileges.
  4. Execute the command and follow the progress.
  5. The script will automatically:
    • Remove existing Sophos endpoint protection
    • Install CrowdStrike sensor
    • Configure with your location-specific settings
  6. The process takes 5-10 minutes to complete - do not interrupt
  7. Some systems may require a reboot after installation.
  8. Check Add/Remove Programs to ensure Sophos is Removed and Crowdstrike is installed

  9. Note: You may see the error "Crowdstrike is not recognized as an internal or external command" - this can be safely ignored and won't affect deployment

USA - Albuquerque, NM

Download Installer

USA - Atlanta, GA

Download Installer

USA - Austin, TX

Download Installer

USA - Conway, AR

Download Installer

Canada - Dundas, ON

Download Installer

Canada - International, ON

Download Installer

USA - Indianapolis, IN

Download Installer

USA - Kansas City, KS

Download Installer

USA - Los Angeles, CA

Download Installer

USA - Marshall, MO

Download Installer

USA - Miami, FL

Download Installer

USA - Oklahoma, OK

Download Installer

USA - Omaha, NE

Download Installer

USA - Orlando, FL

Download Installer

USA - Phoenix, AZ

Download Installer

CANADA - Solar Erectors, ON

Download Installer

USA - Tampa, FL

Download Installer

USA - Thomaston, CT

Download Installer

USA - Tulsa, OK

Download Installer

Other Downloads

These files can be used to implement the solution through any RMM (Remote Monitoring & Management Tool) such as SCCM, Group Policy, Ninja, etc.

Crowdstrike Sensor Installer

Download CSInstall.zip

Sophos Uninstaller (Latest)

Download SophosUninstall.zip

Sophos Zap (LAST Resort Option)

Download SophosZap.zip

Location Tags Reference

â—†
Albuquerque Atlanta Austin Conway Dundas International Indianapolis KansasCity LosAngeles Marshall Miami Oklahoma Omaha Orlando Phoenix Solar Tampa Thomaston Tulsa

Implementation Steps:

  1. First run Sophos Uninstaller if needed
  2. Install CrowdStrike sensor
  3. Apply location tag (as Administrator):
    "C:\Program Files\CrowdStrike\CSSensorSettings.exe" set --grouping-tags "YourLocationTag"
    (Replace with one of the location tags above)
  4. Reboot the system
  5. Verify in Falcon console

Note: Sophos Zap should only be used if standard uninstall fails.

Troubleshooting Guide

Sophos Endpoint Agent remains installed after script completion

If Sophos isn't fully removed by the script:

  • Open Control Panel > Programs > Programs and Features
  • Locate "Sophos Endpoint Agent" in the list
  • Right-click and select Uninstall
  • If standard uninstall fails, download and run the Sophos Clean Tool
  • Reboot the system after removal

CrowdStrike installation fails with error code

  • Error 5 (Access Denied): Ensure you're running as Administrator
  • Error 1603: Check for pending reboots or conflicting security software
  • Error 3010: System needs reboot to complete installation
  • Check C:\Windows\Temp\CSInstaller.log for detailed error information

Script runs but nothing seems to happen

  • Check Task Manager for CSInstall.exe process
  • Look for CsAgentSvc in Services (services.msc)
  • Verify installation by checking for C:\Program Files\CrowdStrike directory

Sophos Endpoint Agent remains installed after script completion

  • Open Control Panel > Programs > Programs and Features
  • Locate "Sophos Endpoint Agent" in the list
  • Right-click and select Uninstall
  • If standard uninstall fails, download and run the Sophos Clean Tool
  • Reboot the system after removal

CrowdStrike installation fails with error code

  • Error 5 (Access Denied): Ensure you're running as Administrator
  • Error 1603: Check for pending reboots or conflicting security software
  • Error 3010: System needs reboot to complete installation
  • Check C:\Windows\Temp\CSInstaller.log for detailed error information

Script runs but nothing seems to happen

  • Check Task Manager for CSInstall.exe process
  • Look for CsAgentSvc in Services (services.msc)
  • Verify installation by checking for C:\Program Files\CrowdStrike directory

System becomes unresponsive during installation

  • This is normal during Sophos removal - wait at least 20 minutes
  • If completely frozen, perform hard reboot and run script again
  • Check disk space (minimum 500MB free required)

CrowdStrike service fails to start after installation

  • Open Services (services.msc) and locate CsAgentSvc
  • Attempt to start the service manually
  • Check Event Viewer for related errors

Script downloads but won't run

  • Right-click the file and select "Run as administrator"
  • If blocked by Windows, right-click > Properties > check "Unblock"
  • Ensure file extension is .zip (not .zip.txt)

Wrong location tag applied

  • Manually correct using: "C:\Program Files\CrowdStrike\CSSensorSettings.exe" set --grouping-tags "CorrectLocation"
  • Reboot after changing tags

Network connectivity issues during download

  • Verify internet connectivity
  • Check proxy settings if behind corporate firewall
  • Try downloading from an alternative network

Script works but system still vulnerable

  • Verify CsAgentSvc is running in Services
  • Check for the CrowdStrike icon in system tray
  • Run "C:\Program Files\CrowdStrike\CSAgentCLI.exe" -h

Other security software conflicts

  • Temporarily disable other AV/security software during installation
  • Check for McAfee, Symantec, or Windows Defender interference