Uninstall CrowdStrike
Purpose
This content is designed to automate the detection and uninstallation of CrowdStrike from Windows servers and workstations managed through NinjaOne. It uses automation scripts, compound conditions, and custom fields to identify devices with CrowdStrike installed and initiate the uninstallation process.
If CrowdStrike tamper protection is enabled, the required maintenance token and password must be provided to complete the uninstallation. If tamper protection is disabled, CrowdStrike can be uninstalled without requiring these credentials, where applicable.
Associated Content
Compound Conditions
| Content | Type | Function |
|---|---|---|
| Uninstall CrowdStrike - Servers | Compound Condition | Targets Windows servers that meet the configured criteria for CrowdStrike uninstallation. |
| Uninstall-CrowdStrike - Workstations | Compound Condition | Targets Windows workstations that meet the configured criteria for CrowdStrike uninstallation. |
Automation
| Content | Type | Function |
|---|---|---|
| CrowdStrike Detection | Automation | Detects whether CrowdStrike is installed on the target device. |
| Uninstall CrowdStrike | Automation | Executes the CrowdStrike uninstallation process on eligible devices. |
File Transfer
| Content | Type | Function |
|---|---|---|
| File Transfer - Crowdstrike | File Transfer | Uploads the CrowdStrike uninstaller executable and transfers it to the specified location on the target device. |
Custom Fields
| Content | Type | Function |
|---|---|---|
| cPVAL CS Maintenance token | Custom Field | Stores the CrowdStrike maintenance token required for authorized uninstallation when applicable. |
| cPVAL CS Password | Custom Field | Stores the password required by the uninstallation process, when applicable. |
| cPVAL Uninstall CrowdStrike | Custom Field | Controls the CrowdStrike uninstallation deployment configuration. |
Implementation
Step 1: Create the Following Custom Fields
Create and configure the following custom fields:
Step 2: Import Automation Scripts
Import the following automation scripts:
Step 3: Configure File Transfer
Configure the following file transfer content:
Step 4: Configure the Compound Conditions
Create and configure the following compound conditions to target the appropriate device types:
FAQ
Q: What is the purpose of this solution?
A: It automates the detection and uninstallation of CrowdStrike from eligible Windows servers and workstations managed through NinjaOne.
Q: Does the solution support both servers and workstations?
A: Yes. Separate compound conditions are provided for Windows servers and workstations.
Q: What happens if CrowdStrike is not installed on a device?
A: The detection automation checks whether CrowdStrike is installed and determines whether the uninstallation workflow needs to proceed.
Q: Are credentials required to uninstall CrowdStrike?
A: If tamper protection is enabled, the required maintenance token and password must be provided. If tamper protection is disabled, uninstallation can proceed without these credentials, where applicable.
Q: What is the purpose of the file transfer configuration?
A: It transfers the CrowdStrike uninstaller executable to the specified location on the target device for use by the uninstallation automation.
Q: Can the uninstallation process be run on demand?
A: Yes. The uninstallation automation can be run on demand through NinjaOne. Follow the steps below to perform the uninstallation:
- Run the File Transfer script first to transfer the CrowdStrike uninstaller executable to the specified location on the target machine.
- Once the file transfer is complete, run the Uninstall CrowdStrike script to uninstall CrowdStrike from the target machine.
Important: The File Transfer script must be executed successfully before running the uninstallation script. If the uninstaller executable is not available at the specified location, the uninstallation script will not be able to remove CrowdStrike.
Changelog
2026-10-14
- Initial version of the document.