CrowdStrike Falcon Sensor Audit

Find computers with the CrowdStrike Falcon Sensor installed on it

A faulty security update from cybersecurity provider CrowdStrike has caused widespread Blue Screen of Death (BSOD) issues, affecting banks, airlines, supermarkets, broadcasters, and other organizations worldwide. This update has forced affected PCs and servers into a recovery boot loop, preventing proper startup. Notable impacted entities include Sky News, Lufthansa, Delta Airlines, and Prague Airport. CrowdStrike has provided a workaround involving the deletion of a specific file in Safe Mode or the Windows Recovery Environment to resolve the issue.

This audit provides you with an overview of all your Windows devices that have a Sensor installed on it and as a result might have gotten the update which is causing the BSOD.

Devices in this audit which are not reporting back anymore and should, are likely stuck

in the recovery boot loop. You can learn more about this issue in our CrowdStrike Falcon blog post.

Run the CrowdStrike Falcon Sensor Audit Now!

CrowdStrike Falcon Sensor On-prem Audit

Select Top 1000000 tblAssets.AssetID,
  tblAssets.AssetName,
  tblAssets.Domain,
  tsysAssetTypes.AssetTypename As AssetType,
  tblAssets.Username,
  tblAssets.Userdomain,
  tsysAssetTypes.AssetTypeIcon10 As icon,
  tblAssets.IPAddress,
  tblSoftwareUni.softwareName As Software,
  tblSoftware.softwareVersion As Version,
  tblSoftwareUni.SoftwarePublisher As Publisher,
  tblBitLockerRecoveryKey.RecoveryKey,
  tblBitLockerRecoveryKey.LastChanged As [Recovery Key Last Scanned],
  tblAssets.Lastseen,
  tblAssets.Lasttried
From tblAssets
  left Join tblADComputers On tblAssets.AssetID = tblADComputers.AssetID
  left Join tblBitLockerRecoveryKey On tblBitLockerRecoveryKey.AdObjectId =
    tblADComputers.ADObjectID
  Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
  Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
  Inner Join tblState On tblState.State = tblAssetCustom.State
  Inner Join tblSoftware On tblAssets.AssetID = tblSoftware.AssetID
  Inner Join tblSoftwareUni On tblSoftwareUni.SoftID = tblSoftware.softID
Where (tblSoftwareUni.softwareName Like '%Falcon%' OR tblSoftwareUni.softwareName Like '%Sensor%') and tblSoftwareUni.SoftwarePublisher like '%CrowdStrike%' And tblState.Statename =
  'Active'

Show

Hide