Topics Map > Safety and Security > Malware Protection
Endpoint Security, CrowdStrike, Is CrowdStrike Installed?
The CrowdStrike agent is intended to be unobtrusive to the user, which can make it hard to tell whether it has been installed. Follow these instructions to determine whether CrowdStrike is installed and running.
Windows
- Right-click on the Start button, normally in the lower-left corner of the screen. Select Apps and Features.
- In the new window that opens, scroll down until you locate "CrowdStrike Windows Sensor" in the list of installed apps.
- If you cannot find an entry for "CrowdStrike Windows Sensor", CrowdStrike is NOT installed.
Command Line
To validate that the sensor is running on a Windows host via the command line, run this command at a command prompt:
sc query CSFalconService
If you see STATE: 4 RUNNING, CrowdStrike is installed and running.
macOS
- Open the Activity Monitor application (/Applications/Utilities/Activity Monitor).
- In the new window that opens, enter "falcon" into the search bar in the top-right corner.
- If you cannot find an entry for "falcond" under the CPU tab, CrowdStrike is NOT installed.
Command Line
To validate that the sensor is running on a macOS host via the command line, run this command in Terminal (/Applications/Utilities/Terminal):
sysctl cs
If you see sysctl: unknown oid 'cs', CrowdStrike is NOT installed.
Linux
To validate that the sensor is running on a Linux host via the command line, run this command:
ps -e | grep falcon-sensor
If you see output similar to below, CrowdStrike is installed and running:
[root@centos6-installtest ~]# sudo ps -e | grep falcon-sensor
905 ? 00:00:02 falcon-sensor