4 ms·
Because CrowdStrike is an EDR solution it likely has tamper-proofing features (scheduled tasks, watchdog services, etc.) that re-enables it. These features are
by tatersolid 2y ago
Because CrowdStrike is an EDR solution it likely has tamper-proofing features (scheduled tasks, watchdog services, etc.) that re-enables it. These features are designed to prevent malware or manual attackers from disabling it.
- Wheaties466 2y agoit does. several crowdstrike alerts popped when i was remediating systems of the broken driver.
- rkagerer 2y agoThese features drive me nuts because they prevent me, the computer owner/admin, from disabling. One person thought up techniques like "let's make a scheduled task that sledgehammers out the knobs these 'dumb' users keep turning' and then everyone else decided to copycat that awful practice.
- Thorrez 2y agoIf you're the admin, I would assume you have the ability to disable Crowdstrike. There must be some way to uninstall it, right?
- xena 2y agoNot if you want to keep the magic green compliance checkbox!
- Thorrez 2y agoAre you saying that the compliance rule requires the software to be uninstallable? Once it's installed it's impossible to uninstall? No one can uninstall it? I have a hard time believing it's impossible to remove the software. In the extreme case, you could reimage the machine and reinstall Windows without Crowdstrike. Or are you saying that it is possible to uninstall, but once you do that, you're not in compliance, so while it's technically possible to uninstall, you'll be breaking the rules if you do so?
- g15jv2dp 2y agoIt's obviously the second option.
- throwaway55110 2y agoIt's not obvious - the owner of the computer sets the rules.
- Demonoculus 2y ago[flagged]
- Thorrez 2y agoThe person I originally replied to, rkagerer, said there was some technical measure preventing rkagerer from uninstalling it even though rkagerer has admin on the computer.
- rkagerer 2y agoI was referring to the difficulty overriding the various techniques certain modern software like this use to trigger automatic updates at times outside admin control. Disabling a scheduled task is easy, but unfortunately vendors are piling on additional less obvious hooks. Eg. Dropbox recreates its scheduled task every time you (run? update?) it, and I've seen others that utilize the various autostart registry locations (there are lots of them) and non-obvious executables to perform similar "repair" operations. You wind up in "Deny Access" whackamole and even that isn't always effective. Uninstalling isn't an option if there's a business need for the software. The fundamental issue is their developers / product managers have decided they know better than you. For the many users out there who are clueless to IT this may be accurate, but it's frustrating to me and probably others who upvoted the original comment.
- Thorrez 2y agoIs what you're saying relevant in the Crowdstrike case? If you don't want Crowdstrike and you're an admin, I assume there are instructions that allow you to uninstall it. I assume the tamper-resistant features of Crowdstrike won't prevent you from uninstalling it.
- throwaway55110 2y agoIf you're the owner, just turn it off and uninstall.
- gunapologist99 2y agoDoesn't malware do that as well? But what other malware has been as successful? Crowdstrike can rest easy knowing it's taken down many of the most critical systems in the world. Oh, no, actually, if Crowdstrike WAS malware, the authors would be in prison.. not running a $90B company.