CrowdStrike Removal Issues During Migration to Microsoft Defender for Endpoint

Nana Poku 365 Reputation points
2026-11-06T01:16:35.92+00:00

We are currently migrating from CrowdStrike Falcon to Microsoft Defender for Endpoint (MDE) across our End User Devices (EUDs), servers and Azure Virtual Desktop (AVD) environments.

We have completed the majority of the migration for our EUDs. Our migration process involves adding devices to an offboarding group within the CrowdStrike console, assigning them to the relevant device group in Intune, and deploying the required Intune policies, scripts and remediation packages to complete the migration, including the removal of CrowdStrike.

However, we have recently identified an issue affecting a significant number of EUDs. When checking the device inventory in the Microsoft Defender portal, many devices still report CrowdStrike Windows Sensor as installed.

Interestingly, when we run the following PowerShell command on the affected devices:

Get-Service -Name CSFalconService | Select-Object Name, DisplayName, Status

The command returns no results, indicating that the CrowdStrike Falcon service is no longer present. We have also checked the devices locally and confirmed that there are no obvious CrowdStrike-related files in Program Files or running services. However, CrowdStrike still appears as an installed application in Control Panel.

We subsequently generated a report of the CrowdStrike components detected across our devices and identified several package types, including:

● CrowdStrike Device Control

● CrowdStrike Firmware Analysis

● CrowdStrike Sensor Platform

● CrowdStrike Windows Sensor

To automate the removal process, we configured an Intune Win32 application to uninstall CrowdStrike from user devices.

During pilot testing, we observed the following behaviour:

● Devices reporting CrowdStrike Windows Sensor consistently fail the Intune Win32 application uninstallation process.

● Devices reporting the other CrowdStrike package types are successfully uninstalled.

Our questions are:

  1. Why does CrowdStrike Windows Sensor continue to appear in the Defender portal inventory and Control Panel when the associated service and installation files appear to be missing?
  2. Could this be caused by incomplete uninstallation, orphaned registry entries, stale software inventory data, or residual CrowdStrike installation components?
  3. Why does the Intune Win32 application fail to uninstall devices reporting CrowdStrike Windows Sensor, while the other CrowdStrike components are removed successfully?
  4. What is the recommended approach to identify and completely remove these residual CrowdStrike components?
  5. Is there a supported CrowdStrike cleanup or removal utility that we should use to address these devices before considering the migration complete?

We would appreciate any guidance on the root cause of this behaviour and recommendations for a reliable remediation approach to ensure all CrowdStrike components are completely removed from our EUDs and that the devices are correctly reflected as migrated to Microsoft Defender for Endpoint.

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mohammed Hamed 160 Reputation points
    2026-11-06T06:27:25.3966667+00:00

    @Nana Poku The missing CSFalconService only confirms that the service is no longer registered. It does not prove that the CrowdStrike Sensor was fully removed.

    Because CrowdStrike Windows Sensor still appears in Control Panel, the most likely cause is an incomplete uninstall leaving behind an uninstall registry entry, Windows Installer registration, cached package, or driver. Defender software inventory can also retain previously detected software for a period after removal.

    This also explains the Intune failure. Intune detects the Windows Sensor entry and runs its uninstall command, but the command fails because the installation is already partially removed, corrupted, missing its original installer, or requires a CrowdStrike maintenance token. The other CrowdStrike packages likely still have valid uninstall components, so they uninstall successfully.

    Recommended approach:

    • Check both 32-bit and 64-bit uninstall registry locations for CrowdStrike entries.
    • Check for remaining CrowdStrike services, drivers, files and MSI product codes.
    • Review the Intune Management Extension logs and the uninstall exit code.
    • Use CrowdStrike’s supported CSUninstallTool.exe, available from the Falcon console under Support and resources → Tool downloads.
    • If uninstall protection is enabled, use the required maintenance token.
    • Restart the device and validate that no services, drivers, files or uninstall entries remain.
    • Avoid deleting registry entries manually unless instructed by CrowdStrike Support, as this can hide the detection without fully removing the product.

    If the endpoint is locally clean but Defender still reports CrowdStrike, check the Evidence last found timestamp and allow time for the software inventory to refresh. please if my solution help you make as solution accepted

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.