Crowd Strike Script to Switch Accounts

We recently moved from Symantec Endpoint Protection to Crowd Strike, the move went well and so far we are very happy with Crowd Strike.

the issue arrises when our company decided to purchase another and they were already using Crowd Strike, no big deal I thought I will just contact them and have them move them to our account. Well that does not work Crowd Strike currently does not have a way to do that. They advised that i remove and reinstall all.

Well if you know IT people I was not about to sit there and visit every computer (remotely) and click uninstall enter the Bulk Maintenance key and wait then run my installer and enter my CID, yeah that was not going to happen. So I started working on automation to make my life easier because that is what we do.

Below you will find a script that can be set to run in any fashion you want, Manual, GPO, Logon, however, you see fit for your deployment, even through an RMM it should work. Currently, in the file the PUSHD command maps a drive to the UNC path that you specify. If you would like to use the current working directory Useful for a USB drive or local folders and not a UNC then replace the \\pathtoUNCshare with \\%~dp0

@echo off
CLS          
PUSHD \\pathtoUNCshare
Echo Checking if any crowd strike falcon is installed
setlocal
set Key=HKLM\SYSTEM\CurrentControlSet\Services\CSAgent\Sim
set Type=REG_BINARY
set Value=CU

set Data=
for /f "tokens=1-3" %%a in ('reg query %Key% 2^>NUL ^| find /i "%Value%"') do (
  set TestValue=%%a
  set TestType=%%b
  set TestData=%%c
  call :process
)
if /i "%Data%"=="Your Company CID" goto Data_1
if /i "%Data%"=="Other Company CID" goto Data_2
if /i "%Data%"=="" goto Data_Missing
goto Data_Undefined

:process
	if /i not "%TestValue%"=="%Value%" goto :eof
	if /i not "%TestType%"=="%Type%" goto :eof
	set Data=%TestData%
	goto :eof

:Data_1
	echo CID is %Data% 
	ECHO This is Company 1 Crowd Strike 
	ECHO Nothing further is needed
	ECHO Script is terminating
	goto eof

:Data_XON
	echo CID is %Data% 
	ECHO This is Other_Company Crowd Stirke 
	ECHO proceeding with uninstall
	goto uninstall

:Data_Missing
	echo CID was not found proceeding with Install
	goto install

:Data_Undefined
	echo unknown Crowd Strike CID %Data%

:Uninstall
	ECHO Uninstall Other_Company Crowdstrike Falcon
	CsUninstallTool.exe /quiet
	reg query HKLM\System\Crowdstrike
	if %ERRORLEVEL% EQU 1 GOTO :install Else ECHO Other_Company Crowd Strike Still installed Re-run the script or Uninstall Manually
	GOTO eof
	
:install
	ECHO Installing Your_Company CrowdStike Falcon
	WindowsSensor.exe /install /quiet /norestart CID=Your_Company_CID rem GROUPING_TAGS="Place Tags here"
	reg query HKLM\System\Crowdstrike
	if %ERRORLEVEL% EQU 0 ECHO Your_Company Crowd Strike Installed Properly ELSE Your_Company Crowd Strike failed to install Re-run the script or install Manually
	GOTO eof
	
:eof
POPD
Pause

More Explanation is coming I wanted to get this up quickly as it was requested by Crowd Strike.