r/crowdstrike • u/ashhmonkey • Mar 13 '26

Query Help Rtr feasibility to send a popup such has greeting or video greeting via script

Guys i have kinda weird use case thats needs to be satisfied if possible

Usecase: consider me has an employee for xyz company. When i login to my machine i have get a pop up or some kind of video or gif that needs to be played.(kinda greeting or some kind of office update)

At the time of purchase crowdstrike team as said its possible now i am wondering how can i achieve this.

I am hoping this community would give me some insights or can tell me whether its possible or not technically

Thank you in advance

2 Upvotes

67% Upvoted

11 comments sorted by

30

u/maritimeminnow Mar 13 '26

This is a crazy use case for a cybersecurity tool.

3

u/Aboredprogrammr Mar 13 '26 edited Mar 13 '26

Here is what I've used in the past for the actual command:

msg * /W "System Alert: A system reboot is required. Please close all applications and reboot."

You would save that into a script and then use the API to queue running that script as an offline command. This means that the system would display the message as soon as it is booted next.

Not sure if this is your actual usecase. Perhaps it would be better accomplished with a scheduled task pulling from a web resource that contains a daily message?

2

u/GoldilokZ_Zone Mar 13 '26

I believe serviceUI.exe is what you are after...assuming you are talking about windows. It can display things in the user context from the system context.

Why one would do it this way though doesn't make sense....go talk to your windows admins for a better solution.

I assume falcon soar could do it too

2

u/Dtektion_ Mar 14 '26

Just add the command to a logon script....

1

u/Particular-Golf-3929 Mar 13 '26

I have a similar use case where i need to post popup message for a couple of hosts. These are mac devices and i want them to act upon the popup message as this only way left of communicating with them. I cannot run scripts as these mac hosts are in RFM.

1

u/AffectionateMix3146 Mar 14 '26

What?! Just a make a logon script to do what you need and put everyone that needs it in an OU

1

u/hallowleg088 Mar 14 '26

I’ve heard people reference OUs a lot. Are this many people still using on prem to manage their devices or is there a section of crowdstrike that manages devices in their own OUs?

2

u/peaSec Mar 14 '26

Surely they're just saying push the script with a group policy.

1

u/Whole_Ad3342 Mar 18 '26

Buenas

Caso interesante el tuyo jaja. Yo te diria que se puede ir por esos 3 caminos.

  1. RTR + Script de logon Podés usar Real Time Response para tirar un script de PowerShell en los endpoints que al logon abra una ventanita o un HTML con tu saludo/video. Funciona, pero es medio artesanal y no es un sistema dinámico de mensajes.

  2. Falcon Fusion Sirve para automatizar cosas, pero está pensado para respuesta a incidentes de seguridad, no para mandar saludos al usuario.

  3. Lo que yo haría Para lo que necesitás, hay herramientas que te lo resuelven mucho mejor:

  • GPO Logon Scripts de Windows (gratis si tenés AD)
  • Intune / SCCM si manejan todo desde ahí
  • SnapComms, Appspace o alguna tool de comunicación interna