Troubleshoot Falcon on macOS (Students)

Students Mac crowdstrike falcon

Overview

If you are have issues installing, configuring, or uninstalling CrowdStrike Falcon on your Mac, please review the information below.

Details

Downloading:

If you are unable to successfully download Falcon on your Mac, review the below suggestions:

Connect to the urwin wireless network before navigating to software.richmond.edu. While you will be restricted from accessing other websites until Falcon and ClearPass OnGuard are successfully installed, you should connect to the urwin network in order to download the required software.
Authenticate with your NetID and password on the Software Downloads page. Only active students will see the Falcon installer available to download. Faculty, staff, and alumni will not have the software available.
Ensure you download the correct product for your OS. As a Mac user, download the Falcon installer for macOS.

Installing:

If you have successfully downloaded the Falcon installer but are having issues installing the software, check the steps below:

Confirm your version of macOS is compatible with Falcon and upgrade your Mac if needed. Currently, Falcon is supported on macOS 11 Big Sur or newer.
Ensure you are an admin on your Mac, or have access to authenticate as an admin. Standard users will not be able to install Falcon and depending on the version of macOS, permission to approve system extensions.
Follow all the steps of the installer, specifically allowing the system extension. If the Falcon system extension is not allowed, the installer will fail. In the event that the installation fails, re-run the installer and follow the steps below:
- macOS 11 Big Sur and macOS 12 Monterey: Launch System Preferences, then click Security & Privacy and click Allow for CrowdStrike Falcon. If the Allow option is grayed out, look for the padlock in the bottom left corner of the pane and unlock with your password. Once unlocked, you can click Allow.
- macOS 13 Ventura and macOS 14 Sonoma: Launch System Settings, then click Privacy & Security and scroll to the bottom. Click Allow for CrowdStrike Falcon and enter your password when prompted.
The option to Allow the system extension may no longer be visible after a period of time due to security settings with macOS. If the option is no longer there, restart your Mac and check again or re-run the installer.
If you have allowed all permissions and ClearPass will still not detect Falcon when it runs a health scan, restart your computer.

Uninstalling:

You may need to uninstall Falcon in order to troubleshoot an issue, if you are purchasing a new Mac, or are graduating or leaving the University. In those cases, we strongly encourage you to uninstall Falcon. If the uninstaller from the software download center does not remove the app, simply drag the Falcon app from your Applications folder and restart your Mac. You may need to accept the prompt to turn off the system extension. If you are still unable to uninstall the Falcon app, contact the Help Desk at (804) 287-6400.

Miscellaneous:

If your Mac is quarantined by ClearPass after upgrading to a new version of macOS, verify the system extension for Falcon has been allowed. The prompt to allow the system extension for Falcon is found at the bottom of the General tab in System Preferences > Security & Privacy in macOS Big Sur and Monterey and at the bottom of the Privacy & Security section of System Settings in macOS Ventura and Sonoma. The option to allow the system extension may not be visible for a short period of time after an upgrade due to security settings with macOS. If the option is not there, restart your Mac.
ClearPass will only run a health scan on your computer when connected to the urwin network but Falcon will continue to update and run. If you are off campus for an extended period of time, ClearPass will need to run a longer scan the first time you connect back to the urwin network. There's no need to reinstall any software, just allow the scan to complete.

Updating...