Virtual environments

Installing the Falcon sensor on a virtual environment requires a specific approach depending on whether your VMs are persistent or non-persistent.

Using the wrong method may result in all cloned VMs sharing the same Agent ID (AID), causing detections from multiple machines to appear as coming from a single host.

This guide covers installation on a VMware vSphere + Citrix Cloud (DaaS) MCS environment. For other hypervisors or provisioning technologies, refer to their respective documentation. For the full Citrix DaaS documentation: https://docs.citrix.com/en-us/citrix-daas

1

Determine your VM type

Before installing, identify which type of VDI environment you are working with:

Type	Description
Non-persistent	VM does not retain changes after reboot. Rebuilt from master image on every login/reboot.
Persistent (Static)	VM retains all changes after reboot. User always connects to the same machine.

2

Prepare the golden image

The golden image (also called master image, base VM, or base image) must be properly configured before installing the Falcon sensor. The sensor must always be the last software installed.

Operating system and network

• Install Windows OS and apply all latest Windows Updates.

• Configure network settings (DNS, Gateway) and open the necessary network traffic. Refer to Network traffic.

• Join the machine to the Active Directory domain.

• Verify the domain trust relationship:

Test-ComputerSecureChannel

Expected result: True

Do not disable the Windows Security Center service. CrowdStrike requires it to be active.

Hypervisor tools

Install the integration tools for your hypervisor (Citrix VM Tools, Hyper-V Integration Services, or VMware Tools) before installing the VDA and the Falcon sensor.

Citrix Virtual Delivery Agent (VDA)

The VDA must be installed on the master image before creating the Machine Catalog.

1. Download the VDA from Citrix Cloud > Downloads > Virtual Delivery Agent for Windows Single-session OS.

2. Run the installer as administrator.

3. On the Environment page, select Create a master MCS image.

4. On the Delivery Controller page, enter the FQDN of your Citrix Cloud Connector (Citrix Cloud > Resource Locations > select your location > Cloud Connectors).

5. Complete the installation and reboot.

Do not run Sysprep on master images when using MCS. MCS handles generalization and unique identity assignment for each cloned VM.

3

Download the Falcon sensor installer

1. Log in to the Falcon Console.

2. Go to Host Setup and Management > Deploy > Sensor Downloads, or from Stoïk Protect: MDR > Settings > Virtual environments > Download the executable.

3. Copy your CCID (Customer ID Checksum) displayed on the same page.

4. Copy the installer onto the golden image.

4

Communicate information to Stoïk

Send the following information to [e-mail]:

• The naming convention of your VDI machines (e.g. SRV-VDA-*, VDA-USER-###).

• The name of the golden image used as the master image.

This information is required to configure the host group and the sensor update policy on Stoïk's side.

5

Install the sensor on the golden image

Non-persistent

Prerequisites

The host machines must meet all three of the following criteria:

• Are non-persistent

• Are domain-joined

• Use an FQDN that does not change

Install

Open cmd as administrator on the golden image and run:

WindowsSensor.exe /install CID=<your_CCID> VDI=1

Verify the service is running

Get-Service CSFalconService

Expected: Status = Running

Leave the VM online (1 hour minimum)

After installation, leave the golden image powered on long enough for:

• The sensor to connect to the CrowdStrike cloud and update to the version defined in the assigned sensor update policy.

• All necessary files to be downloaded.

Shut down and take a snapshot

1. Shut down from within Windows (not from the hypervisor power off button).

2. Wait for the VM to reach Powered Off state in your hypervisor.

3. Take a snapshot of the powered-off VM:

   • Name: CS-VDI-Clean-[date]

   • Do not check Snapshot the virtual machine's memory.

Persistent

With NO_START=1, the sensor is installed without starting and without contacting the CrowdStrike cloud. The unique AID is assigned the first time each cloned VM boots.

After installing with NO_START=1, never reboot the golden image before shutting it down. A reboot triggers cloud communication and generates an AID that will be shared by all clones.

Install

Open cmd as administrator on the golden image and run:

WindowsSensor.exe /install CID=<your_CCID> NO_START=1

Verify the service is stopped (expected behavior)

Get-Service CSFalconService

Expected: Status = Stopped

The service will start automatically on the first boot of each cloned VM, and the cloud will assign a unique AID at that point.

Shut down and take a snapshot

1. Shut down from within Windows (not from the hypervisor power off button).

2. Wait for the VM to reach Powered Off state in your hypervisor.

3. Take a snapshot of the powered-off VM:

   • Name: CS-Template-Clean-[date]

   • Do not check Snapshot the virtual machine's memory.

6

Create the Machine Catalog in Citrix Cloud Web Studio

Once the golden image snapshot is ready, create or update the Machine Catalog in Citrix Cloud Web Studio.

Key settings to configure in the catalog creation wizard:

Page	Non-Persistent	Persistent
Machine Type	Single-session OS	Single-session OS
Machine Management	MCS	MCS
Desktop Experience	Random	Static
Image	Golden image + snapshot CS-VDI-Clean-[date]	Golden image + snapshot CS-Template-Clean-[date]