VMware DEM slow logon with Crowdstrike

[VMHero4Ever]

Hi Team,

we switched few weeks ago from Trend Micro agentless AV / Apex One to Crowdstrike Falcon Sensor.
Since this change we notice longer logon times to our Windows 10 machines. 

I already talked with Crowdstrike about this but there a no recommendation what should we exclude.
We also tried to disable some protections module and excluded some processes but doesn't really help.

Does everyone of you also use Crowdstrike in combination with VMware DEM?

I can reproduce the behavior:
without Crowdstrike Sensor: 50 sec. logon time
with Crowdstrike Sensor: 125 sec. logon time

[Idanba19]

I'm experience the same problem as you are, did you manage to resolve the issue?

[VMHero4Ever]

Hi,

I collected a lot of logs and sent them to Crowdstrike support.
They recommended to exclude "FlexService.exe".

I did it but doesn't really help 😞

I see often slower logons (with Crowdstrike) when there is a "big" profile which imports a lot of registry values.

[Idanba19]

We also tried that, so you didnt manage to improve the slow logons...?

[ap_idb]

What if you try to unzip one of those reg files yourself, after logon?

What kind of change are you seeing before Crowdstrike vs After?