Topics Map > Safety and Security > Malware Protection
Endpoint Security, CrowdStrike, Is CrowdStrike Installed?
The CrowdStrike agent is intended to be unobtrusive to the user, which can make it hard to tell whether it has been installed. Follow these instructions to determine whether CrowdStrike is installed and running.
Windows
- Right-click on the Start button, normally in the lower-left corner of the screen. Select Apps and Features.
- In the new window that opens, scroll down until you locate "CrowdStrike Windows Sensor" in the list of installed apps.
- If you cannot find an entry for "CrowdStrike Windows Sensor", CrowdStrike is NOT installed.
Command Line
To validate that the sensor is running on a Windows host via the command line, run this command at a command prompt:
sc query CSFalconService
If you see STATE: 4 RUNNING, CrowdStrike is installed and running.
macOS
- Open the Falcon application (/Applications/Falcon).
- If you cannot find the Falcon application, CrowdStrike is NOT installed.
- The current installed version can be found in the Falcon application window that opens.
Command Line
To validate that the sensor is running on a macOS host via the command line, run this command in Terminal (/Applications/Utilities/Terminal):
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats agent_info
If you see command not found, CrowdStrike is NOT installed.
Linux
To validate that the sensor is running on a Linux host via the command line, run this command:
ps -e | grep falcon-sensor
If you see output similar to below, CrowdStrike is installed and running:
[root@centos6-installtest ~]# sudo ps -e | grep falcon-sensor
905 ? 00:00:02 falcon-sensor