CrowdStrike Falcon Sensor Audit
Active Directory SoftwareFind computers with the CrowdStrike Falcon Sensor installed on it
A faulty security update from cybersecurity provider CrowdStrike has caused widespread Blue Screen of Death (BSOD) issues, affecting banks, airlines, supermarkets, broadcasters, and other organizations worldwide. This update has forced affected PCs and servers into a recovery boot loop, preventing proper startup. Notable impacted entities include Sky News, Lufthansa, Delta Airlines, and Prague Airport. CrowdStrike has provided a workaround involving the deletion of a specific file in Safe Mode or the Windows Recovery Environment to resolve the issue.
This audit provides you with an overview of all your Windows devices that have a Sensor installed on it and as a result might have gotten the update which is causing the BSOD.
Devices in this audit which are not reporting back anymore and should, are likely stuck
in the recovery boot loop. You can learn more about this issue in our CrowdStrike Falcon blog post.
Run the CrowdStrike Falcon Sensor Audit Now!
CrowdStrike Falcon Sensor On-prem Audit
Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tsysAssetTypes.AssetTypename As AssetType,
tblAssets.Username,
tblAssets.Userdomain,
tsysAssetTypes.AssetTypeIcon10 As icon,
tblAssets.IPAddress,
tblSoftwareUni.softwareName As Software,
tblSoftware.softwareVersion As Version,
tblSoftwareUni.SoftwarePublisher As Publisher,
tblBitLockerRecoveryKey.RecoveryKey,
tblBitLockerRecoveryKey.LastChanged As [Recovery Key Last Scanned],
tblAssets.Lastseen,
tblAssets.Lasttried
From tblAssets
left Join tblADComputers On tblAssets.AssetID = tblADComputers.AssetID
left Join tblBitLockerRecoveryKey On tblBitLockerRecoveryKey.AdObjectId =
tblADComputers.ADObjectID
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tblState On tblState.State = tblAssetCustom.State
Inner Join tblSoftware On tblAssets.AssetID = tblSoftware.AssetID
Inner Join tblSoftwareUni On tblSoftwareUni.SoftID = tblSoftware.softID
Where (tblSoftwareUni.softwareName Like '%Falcon%' OR tblSoftwareUni.softwareName Like '%Sensor%') and tblSoftwareUni.SoftwarePublisher like '%CrowdStrike%' And tblState.Statename =
'Active'