Uninstall-FalconSensor failing on argument.

[Sl1m007]

Has anyone got this working as I am not sure what Id is asking, device id or hostname?

Thanks in advance.

[bk-cs]

Falcon uses device_id (a.k.a. aid) as the unique identifier for a device. Uninstall-FalconSensor expects a device_id value. You can find them with Get-FalconHost.

[Sl1m007]

Hi @bk-cs, I appreciate you coming back to me. I am using variables to find the device ID. Do you have examples and can I do this on the host?

Thank you again for your assistance.

[bk-cs]

Uninstall-FalconSensor is used to remotely uninstall Falcon through Real-time Response. It's not used to remove it from the host that you're running PowerShell on. The device_id you're finding is for the remote computer. You can find it using hostname or any other available filter.

[Sl1m007]

Hi @bk-cs, found the solution where RTR had to have read and write in order to work.