How to Install or Uninstall Built-in Sysmon on Windows 11

What is Sysmon?

Sysmon is a free tool for Windows 11 that watches your computer’s actions closely, logging important events like when programs start or connect to the internet. This detailed logging in sysmon windows 11 helps you understand what’s happening on your PC and can help you find security problems.

Why use Sysmon? It gives you a detailed view of your system’s activity. This helps you find security threats and troubleshoot problems.

Sysmon installation starts logging system events automatically. Users can then review these Sysmon logs to get a clear picture of computer activity.

Good news! Newer versions of Windows 11 (such as build 26220 and later) already include Sysmon, so you won’t need to download any extra software.

Option 1Install or Uninstall Sysmon Using ⚙️ Windows Settings

1. Open Settings by pressing ⊞ Win+I.
2. Click System from the left menu, then select Optional features on the right.
3. Click More Windows Features near the top.
4. In the new window, find Sysmon in the list.
5. To install, check the box next to Sysmon. To uninstall, uncheck the box .
6. Click OK.
7. Depending on your choice:

   • If 💿 installing, click Close.
   • If uninstalling, click Restart now to finish the removal.

You can install or uninstall Sysmon on Windows 11 using the built-in ⚙️ Settings app. First, open Settings by pressing the Windows key and ‘I’ together. Then, go to System, select Optional features, and click More Windows Features to find Sysmon in the list.

Finish 💿 Installing Sysmon via Command Line

1. Open Windows Terminal (Admin) (Admin). ⚙️ Choose either PowerShell or Command Prompt.
2. Type or paste the command below, then press Enter:
   
   Sysmon -i
   
3. After it finishes, you can close the Terminal and Settings.

Option 2Install Sysmon Using Command Line Only

1. Open Windows Terminal (Admin) ⚙️ and pick PowerShell or Command Prompt.
2. Run one of these commands to turn on the Sysmon feature:

   • PowerShell: Enable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command Prompt: DISM /Online /Enable-Feature /FeatureName:"Sysmon"
3. Next, run this command to install Sysmon itself:
   
   Sysmon -i
   
4. Close the Terminal when done.

Option 3Uninstall Sysmon Using Command Line

1. Open Windows Terminal (Admin) ⚙️ and pick PowerShell or Command Prompt.
2. Run one of these commands to turn off (uninstall) Sysmon:

   • PowerShell: Disable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command Prompt: DISM /Online /Disable-Feature /FeatureName:"Sysmon"
3. When asked, type Y and press Enter to 🔄 restart your PC and finish uninstalling.

Summary

• What Sysmon Does: Tracks and logs important system activities to help spot security problems.
• Admin Rights Needed: You must be signed in as an administrator to add or remove Sysmon. ⚙️
• Easy Installation Options: Use Settings or Command Line tools like Windows Terminal.
• Restart May Be Required: Removing Sysmon usually needs a reboot to complete.
• Built into Windows 11: No need to download anything extra on newer Windows 11 versions.

Sysmon in Windows 11 tracks and logs important system activities to help you spot security problems. You need administrator rights to install or remove it. Installation is easy using Settings or command line tools, and removing Sysmon may require a restart.