Overcoming EDR (CrowdStrike Falcon Sensor) Blocks when Deleting Volume Shadow Copies

59 views Asked by At

We utilize Volume Shadow Copy to create backups, and our standard method for deleting these shadow copies is through 'vssadmin delete shadows.' However, when we attempt to execute this command, the EDR (CrowdStrike Falcon Sensor) system blocks the process, preventing us from deleting the created shadow copy.

Are there alternative methods for deleting the shadow copy without being blocked by the EDR?

0

There are 0 answers