Windows PS suggestion: falcon_windows_install.ps1

[JCSharpIII]

CrowdStrike Falcon Install Script Enhancement

Issue:
Installer Lookup Failure When Policy References Retired Sensor Build

Problem Description
When running the official CSFalcon_Install.ps1 installer automation script, installations began failing during the installer download phase with the following error:

Unhandled error occurred. Error: Unable to fetch installer details from the CrowdStrike Falcon API.

The script successfully retrieved the assigned version from the Sensor Update Policy, for example:

Retrieving sensor policy details for 'platform_default'
Retrieved sensor policy details: Policy ID: 4fdc2exxxxxxxxxxxxxxxxxxxxxxxxxx, Build: 20006, Version: 7.28.20006

…but then failed during:
Retrieving installer details for sensor version: '7.28.20006'

Root Cause

The failure occurs when the sensor version referenced by the policy (e.g., 7.28.20006) has been retired or pulled from the CrowdStrike installer catalog. The /policy/combined/sensor-update/v2 endpoint still returns that version string, but the /sensors/combined/installers/v1 call finds no matching build, returning an empty set. The original script assumes the installer always exists and throws an exception.

Fix:

Added Fallback Logic to Retrieve Latest GA Installer When Requested Version Is Unavailable

Original Code Section

# Get installer details based on policy version
$message = "Retrieving installer details for sensor version: '$($version)'"
Write-FalconLog 'GetInstaller' $message
$encodedFilter = [System.Web.HttpUtility]::UrlEncode("platform:'windows'+version:'$($version)'")
$url = "${BaseUrl}/sensors/combined/installers/v1?filter=${encodedFilter}"
$installer_scope = @{'Sensor Download' = @('Read')}
$installerDetails = Get-ResourceContent -WebRequestParams $WebRequestParams -url $url -logKey 'GetInstaller' -scope $installer_scope -errorMessage "Unable to fetch installer details from the CrowdStrike Falcon API."

Replaced with Enhanced Logic

# --- Get installer details with fallback logic ---
$message = "Retrieving installer details for sensor version: '$($version)'"
Write-FalconLog 'GetInstaller' $message
$encodedFilter = [System.Web.HttpUtility]::UrlEncode("platform:'windows'+version:'$($version)'")
$url = "${BaseUrl}/sensors/combined/installers/v1?filter=${encodedFilter}"
$installer_scope = @{ 'Sensor Download' = @('Read') }
try {
    $installerDetails = Get-ResourceContent -WebRequestParams $WebRequestParams -url $url -logKey 'GetInstaller' -scope $installer_scope -errorMessage "Unable to fetch installer details from the CrowdStrike Falcon API."
}
catch {
    $installerDetails = $null
}
# If version not found, fall back to latest GA
if (-not $installerDetails -or -not $installerDetails.sha256) {
    Write-FalconLog 'GetInstaller' "Requested version '$version' not found or retired. Falling back to latest GA version available."
    try {
        $fallbackUrl = "${BaseUrl}/sensors/combined/installers/v1?filter=" + [System.Web.HttpUtility]::UrlEncode("platform:'windows'")
        $fallbackList = Get-ResourceContent -WebRequestParams $WebRequestParams -url $fallbackUrl -logKey 'GetInstaller' -scope $installer_scope -errorMessage "Unable to fetch installer list from the CrowdStrike Falcon API."
        
        if ($fallbackList -and $fallbackList.version) {
            $latest = $fallbackList | Sort-Object { [version]($_.version -replace '[^\d\.]','') } -Descending | Select-Object -First 1
            $installerDetails = $latest
            $version = $latest.version
            Write-FalconLog 'GetInstaller' "Using latest available GA version: $version (sha256: $($latest.sha256))"
        }
        else {
            throw "No installers found for Windows platform. Aborting."
        }
    }
    catch {
        $message = "Unable to retrieve fallback installer list. Error: $($_.Exception.Message)"
        Write-FalconLog 'GetInstaller' $message
        throw $message
    }
}
# Validate final installer
if ($installerDetails.sha256 -and $installerDetails.name) {
    $cloudHash = $installerDetails.sha256
    $cloudFile = $installerDetails.name
    Write-FalconLog 'GetInstaller' "Selected installer: ($cloudFile) version $version with sha256: '$cloudHash'"
}
else {
    $message = "Failed to retrieve installer details even after fallback."
    Write-FalconLog 'GetInstaller' $message
    throw $message
}

Outcome

• The script now automatically recovers if a version in the policy is retired.
• It queries the available installers and installs the latest GA version instead of failing.
• Log output clearly indicates when a fallback was used and suggests updating the policy to track 'Latest GA'.
• No additional API permissions are required.

Example log excerpt:

Requested version '7.28.20006' not found or retired. Falling back to latest GA version available.
Using latest available GA version: 7.29.19504 (sha256: F2E...C9A)
Selected installer: WindowsSensor.exe version 7.29.19504

Recommendation for Maintainers

Suggestion: Include this fallback logic in the base CSFalcon_Install.ps1 script to:

• Prevent deployment failures when CrowdStrike retires builds from the catalog.
• Improve reliability in large-scale Intune or SCCM deployments.