Configure CrowdStrike

Overview

Everything on the CrowdStrike side happens before Britive is touched. You need an API client for Britive to authenticate with, and the elevation scripts stored in Falcon where RTR can execute them.

Do the role check first. It is the step that most often stops a setup halfway through.

Before You Begin

Falcon administrator access.
Falcon Insight or Falcon Enterprise licensing, with RTR support.
The elevation scripts from britive/access-broker-examples, or your own equivalents.

Grant yourself the RTR Admin role before you start. Uploading a custom RTR script requires the RTR Admin role on your own Falcon user account. It is separate from the API client scopes below — giving the API client RTR Admin does not give it to you. Administrators regularly complete the whole integration and then find they cannot upload the scripts to finish it.

Steps

Give your Falcon user the RTR Admin role

In Falcon, open Host setup and management → User management, find your own user, and confirm it holds Real Time Response Admin. Add it if not.

Without it, the script upload in step 4 is unavailable.

Create the API client

Go to Support and resources → API clients and keys, then Create API client. Give it a name that identifies it as Britive’s, so it is obvious later what breaks if it is revoked.

Grant these scopes:

Scope	Access	Why
Hosts	Read	Discover the devices to elevate on
Real Time Response	Write	Execute the elevation and revocation scripts
Real Time Response Admin	Write	Optional — lets the scan collect your script list
Response Policies	Read	Read the response policies applied to hosts
User Management	Read	Resolve accounts for mapping

Grant nothing beyond these. The client can execute scripts on every endpoint in scope, which makes it a high-value credential.

Real Time Response Admin is only used for discovery. The scan needs it to read back the list of scripts in your Falcon tenant. Executing a script needs Real Time Response: Write alone.

Leave it out and elevation still works — you simply will not see your scripts on the integration’s Permissions tab, and will have to enter their names with Type Manually when building profiles. That is a reasonable trade if your security team would rather not grant it.

Record the connection values

Falcon shows the client secret once. Copy all three values now and store them in your secret manager:

Client ID
Client secret
API URL (also called the base URL — it varies by cloud region)

You will paste these into Britive in the next guide.

Upload the elevation scripts

Go to Host setup and management → Response scripts and files and upload one script per action, per platform you support.

Platform	Grant	Revoke	Upload as
Windows 10 / 11	`elevate.ps1`	`de-elevate.ps1`	PowerShell
macOS	`elevate.sh`	`de-elevate.sh`	Bash

The upload name is the name Britive calls. Whatever you name a script here must match the Grant or Revoke permission configured on the Britive EPM profile exactly. Pick a convention now and keep it — for example britive-elevate-windows and britive-deelevate-windows.

Test a script from RTR directly

Prove the script works before Britive is in the picture. Open an RTR session against a test workstation and run the grant script by the name you uploaded it under:

runscript -CloudFile="britive-elevate-windows" -CommandLine="-Username jdoe"

Then revoke it again:

runscript -CloudFile="britive-deelevate-windows" -CommandLine="-Username jdoe"

What the Scripts Do

Both platforms follow the same shape: resolve the account, change the group, verify the change took, then notify the user. The verification step matters — a group change that silently fails would otherwise look like a successful elevation.

The account is resolved to a SID first, then added by SID so the membership check is not fooled by a renamed or duplicated account name. Re-running on an already-elevated account is a no-op rather than an error:

$isMember = Get-LocalGroupMember -Group "Administrators" -ErrorAction Stop |
    Where-Object { $_.SID.Value -eq $accountSid }

if ($isMember) {
    Write-Output "User '$qualified' is already a local Administrator."
}
else {
    Add-LocalGroupMember -Group "Administrators" -Member $qualified -ErrorAction Stop
    Write-Output "SUCCESS: Added '$qualified' to local Administrators."
}

The script then locates the user’s desktop from the SID and writes the elevation launcher there. That step fails if the user has never signed in on the machine, because no user profile exists to write to.

Group membership is handled with dseditgroup, checked before and after so the outcome is explicit:

ALREADY_ADMIN=$(dseditgroup -o checkmember -m "$TARGET_USER" admin 2>&1 || true)

if echo "$ALREADY_ADMIN" | grep -q "yes"; then
    echo "User '$TARGET_USER' is already in the admin group."
else
    if dseditgroup -o edit -a "$TARGET_USER" -t user admin 2>/dev/null; then
        echo "SUCCESS: Added '$TARGET_USER' to the admin group."
    else
        echo "ERROR: Failed to add '$TARGET_USER' to the admin group."
        echo "This script must run as root (RTR runs as root by default)."
        exit 1
    fi
fi

Nothing is written to the desktop, and the user does not need to have signed in before.

Every script takes a single -Username parameter and exits 1 with an ERROR: line if it is missing — RTR is non-interactive and cannot prompt for it.

Verify

Confirm the script ran

RTR returns the script’s output. A successful grant ends with a SUCCESS: line followed by a VERIFIED: line. Anything starting ERROR: means the script exited non-zero and no elevation happened.

Confirm the membership on the endpoint

On Windows:

net localgroup Administrators

On macOS:

dseditgroup -o checkmember -m jdoe admin

Confirm revocation

Run the revoke script and check the same command again. The account should be gone. On Windows the desktop launcher files should have been deleted too.

Troubleshoot

Symptom	Likely cause	Fix
No option to upload a script	Your Falcon user lacks the RTR Admin role	Add Real Time Response Admin to your own user, not just the API client
`ERROR: No -Username supplied`	The script was invoked without `-CommandLine`	Pass `-CommandLine="-Username <account>"`
`ERROR: Could not resolve account`	The account does not exist locally or in the machine’s domain	Check the account name and whether it should be qualified as `DOMAIN\user`
`ERROR: Could not locate the desktop folder`	The user has never signed in to that Windows machine	Have the user sign in once so a profile is created
`ERROR: Failed to add ... to the admin group` (macOS)	Script did not run as root	RTR runs as root by default — check whether a custom execution context was set
Script runs but the user sees nothing	No active GUI session was detected	The privilege change still applied; only the notification was skipped
RTR unavailable entirely	Licence tier does not include RTR	RTR needs Falcon Insight or Falcon Enterprise

Next Steps

Integrate with Britive

Add the integration and run the first scan against your Falcon tenant.

How It Works

The elevation flow, component roles, and platform differences.

Last updated on September 3, 2026

Integrate with Britive