How to Enable Uninstall Protection for CrowdStrike Falcon Sensor on Linux (Prevent Sensor Uninstall)

Protecting your CrowdStrike Falcon sensors from unauthorized removal is critical for maintaining endpoint security. The 'Prevent Sensor Uninstall' feature in CrowdStrike Falcon requires a maintenance token before anyone can remove the sensor, preventing both accidental and malicious uninstallation attempts.

This guide covers how to enable uninstall protection and sensor tamper prevention for Falcon Sensor on Linux endpoints, including configuration through Sensor Update Policies and Prevention Policies.

Requirements

• CrowdStrike Falcon sensor for Linux version 7.20 or later
• Falcon Administrator access to the Falcon Console
• Endpoints assigned to a Sensor Update Policy

Understanding Uninstall Protection vs. Tamper Prevention

CrowdStrike offers two complementary protection mechanisms:

Recommendation: Enable both features for comprehensive protection.

Step 1: Enable Uninstall Protection in Sensor Update Policies

The 'Prevent Sensor Uninstall' setting is configured in Sensor Update Policies:

1. Log into the CrowdStrike Falcon Console

2. Navigate to falcon.crowdstrike.com or falcon.us-2.crowdstrike.com

3. Sign in with your administrator credentials

4. Navigate to Sensor Update Policies

5. Go to Host Setup and Management > Sensor Update Policies

6. Select the policy assigned to your Linux endpoints (or create a new one)

7. Enable Uninstall Protection

8. Click Edit on the policy

9. Locate the Uninstall and maintenance protection setting

10. Toggle the setting to Enabled

11. Click Save

Once enabled, any attempt to uninstall the Falcon sensor will require a maintenance token.

Step 2: Enable Sensor Tamper Prevention (Linux Prevention Policy)

For additional protection, enable sensor tamper prevention in your Linux prevention policy:

1. Navigate to Prevention Policies

2. Go to Configuration > Prevention Policies

3. Select your Linux prevention policy

4. Enable Sensor Tampering Protection

5. Click Edit on the policy

6. Under Protection Settings, locate Sensor tampering protection

7. Toggle to Enabled

8. Click Save

This prevents users or processes from performing actions that tamper with key sensor components, such as:

• Deleting sensor files in /opt/CrowdStrike/
• Renaming sensor executables
• Stopping the falcon-sensor service without authorization
• Modifying sensor configuration files

Step 3: Retrieving Maintenance Tokens for Authorized Uninstalls

When uninstall protection is enabled, authorized administrators need maintenance tokens to remove sensors:

Single Host Token

1. Go to Host Setup and Management > Host Management
2. Search for the specific host
3. Click on the host to view details
4. Select Reveal maintenance token
5. Copy the token for use during uninstallation

Bulk Token Generation (API)

For large-scale operations, use the CrowdStrike API to generate maintenance tokens programmatically. This is useful for automation scripts and mass maintenance windows.

Uninstalling a Protected Sensor on Linux

When uninstall protection is enabled, use the maintenance token with the uninstall command:

Using falconctl

sudo /opt/CrowdStrike/falconctl -s --maintenance-token=YOUR_TOKEN
sudo /opt/CrowdStrike/falconctl -s --aid=0

Using Package Manager

Ubuntu/Debian

sudo MAINTENANCE_TOKEN=YOUR_TOKEN apt remove falcon-sensor

RHEL/CentOS/Amazon Linux

sudo MAINTENANCE_TOKEN=YOUR_TOKEN yum remove falcon-sensor

SUSE/SLES

sudo MAINTENANCE_TOKEN=YOUR_TOKEN zypper remove falcon-sensor

For detailed uninstallation instructions, see our complete guide on how to uninstall CrowdStrike Falcon Sensor.

Verifying Protection Status

To verify that uninstall protection is active on a Linux endpoint:

sudo /opt/CrowdStrike/falconctl -g --feature

Look for the uninstall protection feature in the output. If protection is enabled, attempts to uninstall without a token will fail with an error message.

Best Practices

• Enable both protections: Use uninstall protection AND tamper prevention together
• Document token retrieval process: Ensure IT staff know how to get tokens for authorized maintenance
• Use API for automation: Generate tokens programmatically for scripted deployments
• Audit uninstall attempts: Monitor Falcon Console for unauthorized removal attempts
• Test in staging first: Verify your maintenance procedures work before rolling out to production

Troubleshooting

Error: "Maintenance token required"

This means uninstall protection is enabled. Retrieve the maintenance token from Falcon Console (Host Management > Select Host > Reveal maintenance token).

Error: "Invalid maintenance token"

Maintenance tokens are single-use and host-specific. Generate a new token for the specific host you're trying to uninstall from.

Protection not taking effect

Policy changes can take up to 15 minutes to propagate. Verify the host is assigned to the correct Sensor Update Policy and has connectivity to the CrowdStrike cloud.

Related Articles

• How to Uninstall CrowdStrike Falcon Sensor
• How to Setup Prevention Policies in CrowdStrike Falcon
• How to Verify the CrowdStrike Falcon Sensor is Running