A security team notices that several endpoints are in Reduced Functionality Mode (RFM) within the Falcon console. They want to understand why this issue is occurring and how it can be resolved effectively. What is the most likely cause for an endpoint to enter Reduced Functionality Mode (RFM)?

Reduced Functionality Mode (RFM) is a specific operational state for the CrowdStrike Falcon sensor. It is triggered when the sensor has been unable to communicate with the Falcon cloud for a continuous period of 30 days. This mode is a fail-safe designed to prevent an unmanaged sensor with outdated prevention policies from causing potential business disruption by blocking legitimate applications or processes. While in RFM, the sensor ceases all prevention activities but continues to record detection events locally, which will be uploaded if connectivity is restored.

A. Manually disabling the sensor's kernel extension would likely result in a sensor tampering alert or an offline status, not the specific RFM state.
C. An End-of-Life (EOL) sensor is flagged in the console for its unsupported version but does not automatically enter RFM; it continues to operate on its last known policy.
D. The Falcon agent will typically fail to install or run correctly on an unsupported operating system, preventing it from ever reaching a managed state like RFM.

1. CrowdStrike, Inc. (2023). Falcon Sensor for Windows: Reduced Functionality Mode. CrowdStrike Support Portal Documentation. This document explicitly states, "Reduced Functionality Mode (RFM) is a state that the Falcon sensor for Windows enters after it has been offline for 30 days... In this state, the sensor will no longer take any blocking or prevention actions."

2. CrowdStrike, Inc. (2023). Host and Host Group management. Falcon Platform Documentation. In the section detailing host statuses, it is clarified that the RFM state is directly tied to a prolonged loss of communication, distinguishing it from other states like offline, EOL, or uninstalled.

3. SANS Institute. (2022). Endpoint Protection and Response. Courseware for FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics. The course materials discuss various states of modern EDR agents, noting that cloud-managed sensors often enter a passive or reduced-functionality state after extended periods offline to avoid "bricking" a host with stale policies, aligning with the RFM concept.