Where are sensor install logs located if the installation is initiated by a user?

The sensor install logs are stored in the %LOCALAPPDATA%\Temp directory when the installation is initiated by a user. This location is specifically designated for temporary files that are user-specific. When the CrowdStrike Falcon sensor is installed by a user, the installation process generates logs that provide details about the installation event, any errors encountered, and other relevant information. Storing these logs in the %LOCALAPPDATA%\Temp ensures that they are accessible only to the user who initiated the installation, maintaining a level of privacy and separation from other users on the system.

It is important to note that the other options do not accurately reflect the specific storage location for user-initiated sensor install logs. For instance, while %TEMP%\CrowdStrike and %SYSTEMROOT%\Logs are valid directories that may hold various types of log files in different contexts, they do not serve as the designated area for logs produced from user-initiated installations of the CrowdStrike sensor. %USERPROFILE%\Logs is similarly not where these specific installation logs would be found, as it typically pertains to logs generated by user-specific applications or operations that are not related to the installation process of the Falcon sensor.