CrowdStrike Falcon Sensor Audit
Active Directory SoftwareFind computers with the CrowdStrike Falcon Sensor installed on it
A faulty security update from cybersecurity provider CrowdStrike has caused widespread Blue Screen of Death (BSOD) issues, affecting banks, airlines, supermarkets, broadcasters, and other organizations worldwide. This update has forced affected PCs and servers into a recovery boot loop, preventing proper startup. Notable impacted entities include Sky News, Lufthansa, Delta Airlines, and Prague Airport. CrowdStrike has provided a workaround involving the deletion of a specific file in Safe Mode or the Windows Recovery Environment to resolve the issue.
This audit provides you with an overview of all your Windows devices that have a Sensor installed on it and as a result might have gotten the update which is causing the BSOD.
Devices in this audit which are not reporting back anymore and should, are likely stuck
in the recovery boot loop. You can learn more about this issue in our CrowdStrike Falcon blog post.
Run the CrowdStrike Falcon Sensor Audit Now!
CrowdStrike Falcon Sensor On-prem Audit
Select Top 1000000 tblAssets.AssetID, tblAssets.AssetName, tblAssets.Domain, tsysAssetTypes.AssetTypename As AssetType, tblAssets.Username, tblAssets.Userdomain, tsysAssetTypes.AssetTypeIcon10 As icon, tblAssets.IPAddress, tblSoftwareUni.softwareName As Software, tblSoftware.softwareVersion As Version, tblSoftwareUni.SoftwarePublisher As Publisher, tblBitLockerRecoveryKey.RecoveryKey, tblBitLockerRecoveryKey.LastChanged As [Recovery Key Last Scanned], tblAssets.Lastseen, tblAssets.Lasttried From tblAssets left Join tblADComputers On tblAssets.AssetID = tblADComputers.AssetID left Join tblBitLockerRecoveryKey On tblBitLockerRecoveryKey.AdObjectId = tblADComputers.ADObjectID Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype Inner Join tblState On tblState.State = tblAssetCustom.State Inner Join tblSoftware On tblAssets.AssetID = tblSoftware.AssetID Inner Join tblSoftwareUni On tblSoftwareUni.SoftID = tblSoftware.softID Where (tblSoftwareUni.softwareName Like '%Falcon%' OR tblSoftwareUni.softwareName Like '%Sensor%') and tblSoftwareUni.SoftwarePublisher like '%CrowdStrike%' And tblState.Statename = 'Active'