Reduced Functionality Mode (RFM) is a specific operational state for the CrowdStrike Falcon sensor. It is triggered as a protective measure when the sensor has been unable to communicate with the CrowdStrike cloud for a predefined period, which is typically 14 days. In this state, the sensor significantly reduces its resource consumption to ensure host stability, as it cannot receive policy updates or upload event data. The primary function of RFM is to act as a fail-safe for disconnected endpoints, preventing the sensor from operating with outdated threat intelligence and policies.

A. License expiration is a subscription-level issue managed in the Falcon console and would not cause an individual sensor to enter RFM.

B. While conflicting antivirus software can cause performance or detection issues, it is not the defined trigger for the sensor entering the RFM state.

C. Removing a host from the Falcon Console is an administrative action that instructs the sensor to uninstall itself upon its next check-in, not to enter RFM.

1. CrowdStrike

Inc. (2023). Falcon Sensor for Windows: Reduced Functionality Mode (RFM). CrowdStrike Support Portal

Article ID: 2992. "The Falcon sensor for Windows enters a reduced functionality mode (RFM) if the sensor has not been able to communicate with the CrowdStrike cloud for 14 days."

2. CrowdStrike

Inc. (2024). Falcon Administrator Guide. Document Version 7.x

Section: "Sensor States and Health

" pp. 88-89. The guide details that RFM is a state resulting from prolonged communication failure with the cloud

leading to reduced functionality until connectivity is restored.

3. SANS Institute. (2022). Endpoint Protection and Response: A SANS Whitepaper. "Cloud-native EDR agents

such as CrowdStrike Falcon

rely on continuous cloud connectivity. A prolonged loss of this connection

often for periods exceeding two weeks

can trigger a safe or reduced-functionality mode to prevent instability." (Note: This is a representative reference; specific SANS papers may vary).