Step 1: Boot into Safe Mode#

CrowdStrike’s anti-tamper feature prevents standard users and administrators from stopping its services under normal Windows operation. To bypass this, you must enter Safe Mode, where third-party drivers do not load.

1. Open the Start menu, hold the Shift key, and click Restart.
2. Navigate the blue menus: Troubleshoot > Advanced options > Startup Settings > Restart.
3. Press 4 or F4 to Enable Safe Mode.

Step 2: Neutralize the Services in the Registry#

Once in Safe Mode, you need to disable the core services from starting up.

1. Press Win + R, type regedit, and hit Enter to open the Registry Editor.
2. Navigate to the following keys and change the Start Value Data to 4 (which means Disabled):

Step 3: Delete the Core Application Folder#

With the services disabled in the registry, you can now remove the primary files.

• Open File Explorer, navigate to C:\Program Files, and delete the CrowdStrike folder entirely.

Step 4: Handle the Reinstallation Prompt#

NOTE

At this stage in the process, Windows might detect a missing component and attempt to call out to the organization’s deployment server. You will likely see a system notification pop up stating that CrowdStrike needs to install, asking you to “Pick a time” or “Snooze”.

If you see this notification, simply click Snooze for now. We will clear the pending installation queue in the upcoming steps.

Step 5: Remove the Orphaned Context Menu#

Before leaving the Registry Editor, you need to delete the “CrowdStrikeODS scan” option that appears when you right-click files.

1. In the Registry Editor, click the Computer icon at the very top of the left pane.
2. Press Ctrl + F and search exactly for CrowdStrikeODS.
3. When it finds a folder/key on the left pane with that name, right-click and Delete it.
4. Press F3 to find the next entry and delete it. Repeat until the search finishes.

Step 6: Run the Microsoft Uninstall Troubleshooter#

To permanently wipe the remaining drivers, software components, and pending installation triggers, you must use Microsoft’s official cleanup utility.

1. Download the tool directly from Microsoft: https://aka.ms/Program_Install_and_Uninstall
2. Run the downloaded file and select Uninstalling.
3. Follow the on-screen steps. Whenever you see a component, driver, or application that starts with CrowdStrike, select it and let the tool forcefully delete it.

Step 7: Final Restart and Verification#

You are now ready to boot back into normal Windows.

1. Restart the PC normally.
2. Open the Control Panel and navigate to Programs and Features to check if it is uninstalled.
3. If a ghost entry still appears: Simply click “Uninstall” on it in the Control Panel. Because the backend files and registry keys are completely gone, clicking it will cause Windows to realize it no longer exists, and the entry will instantly disappear.

Verification Scripts

If you want total peace of mind, you can run these PowerShell commands to confirm the software is completely removed from your system’s active memory. If they return empty, the software is gone.

1
# Check for active background services
2
Get-Service -Name CSAgent, CSFalconService -ErrorAction SilentlyContinue
3

4
# Check for running executable processes
5
Get-Process -Name CSAgent, CSFalconService -ErrorAction SilentlyContinue

If you need a quick visual refresher on accessing the Advanced Startup options to trigger Safe Mode (Step 1), reference the guide below: