I need to uninstall Crowdstrike Falcon Sensor from some of our Macs. Crowdstrike's instructions to uninstall via Terminal are as follows:
sudo /Library/CS/falconctl uninstall --maintenance-token
I'm a script noob and can't seem to Google-fu my way to finding how to:
1. Prefill a separate local admin user & password
2. Add syntax that would allow the script to enter the Falcon Maintenance Token after it's prompted
Is this even possible?
Thanks so much!
If you are running the script via Jamf, sudo is not needed as scripts are run as root. I would also suggest maybe talking with your CS Admin to see if they are willing to disable the InstallGuard on the specific machines you are looking to remove CS from. Then you can have a simple script of the below and be done with it.
Going to bump this post and see if anyone has figured out how to do this with a maintance token installed or if you get the response from Jamf upon install
Script result: Error: This machine is already licensed
We see the computer in the Falcon console but Jamf keeps saying the above message. Hoping a quick uninstall might be possible via a script but haven't figured out how to deploy it properly yet.
Anyone make any progress on this? I have some of the ground work in a script but am trying to leverage the Crowdstrike API to get the maintenance token for uninstall since it is unique to each machine. I have limited experience with accessing APIs using Curl and how to authenticate when there is a authentication token that is also required.