Windows hosts commonly enter Reduced Functionality Mode when the Windows kernel changes and CrowdStrike has not yet certified that kernel for full sensor operation. This can happen after Microsoft updates. RFM is a protective mode that prevents compatibility problems while allowing the sensor to continue operating at reduced capacity. Loss of internet connectivity may affect cloud communication but does not by itself place the sensor in RFM. Network containment restricts network traffic but is unrelated to kernel compatibility. A sensor update policy issue could cause version drift, but RFM specifically relates to kernel support and sensor compatibility. The course guide explains that Windows RFM is most commonly tied to Microsoft updates and kernel certification status.

The likely cause is that the laptop is not a member of a host group assigned to the custom prevention policy.
Falcon policies are applied through host group membership and policy precedence. A policy must be enabled and assigned to one or more host groups; Falcon then applies the policy settings to hosts based on their group membership. If a host is not in any group assigned to an enabled custom policy, it automatically receives the Default Policy. Since the custom policy is already enabled and successfully running on more than 1,000 other hosts, the policy itself is functioning correctly. The issue is therefore not sensor health, firewall connectivity, or a manual prompt. Falcon does not require a 24-hour waiting period before applying custom policies to newly installed hosts, and administrators do not manually approve policy application on the endpoint through a local prompt. The resolution is to verify the laptop's group membership, dynamic group criteria, tags, OU, hostname pattern, or other assignment rule used by the custom policy's host group. Reference topics: Policy Application, host group membership, default policy fallback, prevention policy assignment.

In addition to host group assignment, prevention policies can have Custom IOA Rule Groups assigned to them. This is how custom IOA rules become active for hosts covered by a prevention policy. Host groups determine which endpoints receive the policy, while assigned Custom IOA Rule Groups determine which custom behavioral detections are included in that policy. Operating System Groups and Machine Learning Groups are not assignable group objects in this context. Custom IOC Groups are not the policy-assignment mechanism described here; custom IOCs are managed through IOC Management with actions such as detect, allow, or block. The CCFA rule configuration model requires administrators to understand that custom IOA rule groups are attached to prevention policies before they can trigger detections.

The required upload format is TXT . Static host groups can be populated by selecting hosts in the console, manually entering hostnames or host IDs, or uploading a text file. Falcon supports adding hosts by host ID or hostname depending on whether the static group was created as "Static by host ID" or "Static by hostname." The uploaded TXT file must contain only host IDs or only hostnames, with each entry separated by a new line. This method supports adding up to 1,000 hosts at a time, so uploading 500 servers is within the supported limit. XLSX, PDF, and JSON are not the documented upload formats for static host group membership. The course guide also notes that static groups are useful for controlled testing scenarios, such as validating a newly created sensor update policy against a specific set of hosts. Reference topics: Group Creation, Static Host Groups, Upload Hosts, Host ID and Hostname Assignment.