> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/delete-registry-key/crowdstrike-delete-registry-key.md).

# CrowdStrike: Delete Registry Key

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## How It Works <a href="#h_01jkb8gh526rqq71p4s7wzxbck" id="h_01jkb8gh526rqq71p4s7wzxbck"></a>

If our SOC identifies a registry key that must be deleted, Workbench completes the action automatically unless the registry path, value, or hostname is specifically designated as a "Never delete" asset (these assets must be added as context and then configured in Workbench; see [Step 2](#h_01jkb8gh524bj3qh97jj4er6tm)).

## Scope and Limitations <a href="#h_01jkb8gh52mgaky46trzv9gtt6" id="h_01jkb8gh52mgaky46trzv9gtt6"></a>

When choosing to enable this auto remediation, remember the following:

* Expel can only create a backup of your registry before deletion if you give us permission to run custom scripts in your response policy (optional), as described in this guide.
* This auto remediation will only work on Windows-based operating systems, and cannot be configured for Mac or Linux.

## Prerequisites <a href="#h_01jkb8gh52nfvx31fp19w7z2z6" id="h_01jkb8gh52nfvx31fp19w7z2z6"></a>

1. You must have already enabled read and write permissions for the Real Time Response OAuth2 API client. See Step 1 of [CrowdStrike Falcon Insight XDR Setup for Workbench](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-falcon-insight-xdr-setup-for-workbench.md#h_01hpm2g4z34q379y0r4afz6mtt) for instructions and/or to verify your permissions.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.

## Step 1: Edit the Response Policy in CrowdStrike <a href="#h_01jkb8gh52zbhcyxvk75eg4r67" id="h_01jkb8gh52zbhcyxvk75eg4r67"></a>

**If you have already enabled other auto remediations for CrowdStrike Falcon, some of the response policy settings may already be in place. Make sure to verify the sensor settings in your response policy as described below.**

For this auto remediation to work, you must enable both Real Time Response and the `get` command on the appropriate response policies in the Sensor Settings. The `get` command allows Expel to extract your files from a remote host. You may also choose to enable custom scripts (optional) to allow us to create a backup of the registry before deletion.

Before you begin, remember that you must have already [enabled read and write permissions](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-falcon-insight-xdr-setup-for-workbench.md#h_01hpm2g4z34q379y0r4afz6mtt) for Real Time Response for the OAuth2 API client in CrowdStrike.&#x20;

1. [Log in to CrowdStrike Falcon](https://falcon.crowdstrike.com/login/?unilogin=1).
2. In the top left menu, navigate to **Host setup and management** **> Response and containment > Response policies**.
3. Make sure you are in the **Windows** platform (this auto remediation does not work for Mac or Linux).
4. Select the response policy that contains the hosts you want to enable for this auto remediation.
5. In the policy's Sensor Settings:
   * Select the **Real Time Response** checkbox to enable it.
   * Select the custom scripts checkbox (optional) to enable running custom scripts. *This permission is required if you want us to create a backup of the registry before deletion; if you do not wish to use this feature, skip this setting.*
   * Select the **get** checkbox to enable the `get` command.
   * Select **Save**.
6. Repeat these steps for any additional response policies that contain hosts that need this auto remediation enabled.

## Step 2: Update Your Context <a href="#h_01jkb8gh524bj3qh97jj4er6tm" id="h_01jkb8gh524bj3qh97jj4er6tm"></a>

**If you do not want to specify any registry paths, values, or hosts for a "do not delete" list, and instead wish for Expel to automatically delete all identified registries, skip to** [**Step 3**](#h_01jkb8gh528z16qdz8p9zk280g)**.**

Working with your Customer Success Manager, add any registry paths, values, or hosts that should be on the "do not delete" list as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment. You will then be able to select them as "Never delete" assets when you enable the auto remediation in Workbench.

{% hint style="info" %}
If our SOC identifies a registry that must be deleted, any registries with associated paths, values, or hosts that were added as "Never delete" assets are assigned to you as actions rather than being deleted automatically.
{% endhint %}

## Step 3: Return to the Main Setup Guide <a href="#h_01jkb8gh528z16qdz8p9zk280g" id="h_01jkb8gh528z16qdz8p9zk280g"></a>

Your CrowdStrike device is now ready for the Delete Registry Key auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/delete-registry-key/crowdstrike-delete-registry-key.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.