New blogpost is live! AV Products can have a HUGE impact on your VDI. 👉 Read it here: https://oberrauch.bz.it/2025/06/30/demystifying-av-in-a-vdi-environment/

A huge pain, but important piece that I've learned about CS Falcon agent. When reinstalling the Falcon Agent to seal your image, it's best practice to leave the image "on" for 30mins before powering down, that way the Falcon agent can fetch any IOA/IOC exclusions you have configured vs trigger race conditions on next start (LWL ProU I'm looking at you).

Cool, I'll add that!

Hi @Jon Bucud, Very interesting. I've never done it this way. I install with the NO_START = 1 switch and then set the CSFalconService startup to 3 (manual). I then use a startup script or BIS-F personalise script to start the service. Never had an issue. But your solution intrigues me and makes sense. I assume each machine will get a new Agent ID because you are using the VDI switch?

@Jeremy Saunders the NO_START parameter is used for templates. With the VDI parameter it registers with the FQDN

@Balint Oberrauch, Yeah. I've always used both those switches together in my gold images. The VDI switch prevents duplicates. I had been told never to let it start in the gold image. But maybe I've been given incorrect information.

I do that and assign the same exclusion policy as to the clones. Then I have two other policies for the Agent update settings.

I never did it this way until I had a ton of false positives of ProU's VirtFSService was triggering Defensive Evasion (their virtual disk mount). I already had an IOA/IOC exception in, but intermittently, it was still triggering detections. When I opened a ticket, Complete replied with the following: You'll see in their comment that I also used to have the NO_START flag (I'd wager the NO_Start documentation is a bit unclear due to CrowdStrike trying to stay vendor-neutral and not mention specific applications and speak in generalizations).

Hi Jon,

The final install string will need to be modified to remove that NO_START flag. I've linked the documentation for recommended steps to create the VDI image which recommends the following:

Copy code

<installer_filename> /install CID=<CCID> VDI=1

https://falcon.us-2.crowdstrike.com/documentation/page/ecc97e75/falcon-sensor-for-windows-deployment#paf4c833

The VDI flag will prevent the sensor from assigning a unique sensor ID to the host (which would then be incorrectly propagated to other hosts running that baseline), however the template system will need to have the sensor running, ideally at least 30 minutes, to ensure it has time to connect to the cloud and pull down whatever updated config is pending.

Legend. Thanks for that explanation @Jon Bucud 🙂

Our old friend/nemesis, Race Condition :)

@Jon Bucud blogpost has been updated 😉 https://oberrauch.bz.it/2025/06/30/demystifying-av-in-a-vdi-environment/