How to Install or Uninstall Built-in Sysmon on Windows 11

What is Sysmon?

System Monitor (Sysmon) is a built-in Windows 11 tool that tracks background activity. It records events such as program launches and network connections. With this detail in the logs, it is easier to see what happens on your PC, and security issues have less room to hide.

Why use Sysmon? It gives you a detailed view of what your system is doing. That visibility helps you flag security threats and speeds up troubleshooting, because you can look back at what ran and what connected to what.

Once the feature is turned on, it starts logging system events automatically. Reviewing those logs over time gives you a clear picture of how the computer has been used.

Recent Windows 11 versions include Sysmon by default, so you don’t need to download anything extra. If you can’t find it on your PC, you are probably on a build that doesn’t have it yet. Run Windows Update and check again.

Option 1Install or Uninstall Sysmon Using Windows Settings

This method uses the Windows Features dialog and needs no commands. Follow the steps below. The same steps install or uninstall Sysmon, depending on whether you check or uncheck the box.

1. Press Win+I to open Settings.
2. Click System in the left menu, then select Optional features on the right. The page lists the optional features already installed on your PC.
3. Click More Windows Features near the top. A separate window titled Windows Features opens with a list of items and checkboxes. If Windows asks for permission, click Yes.
4. Scroll the list and find Sysmon. If it isn’t there, your Windows 11 build doesn’t include it.
5. Choose what you want to do:

   • To install, check the box next to Sysmon.
   • To uninstall, uncheck the box.
6. Click OK. Windows applies the change and shows a progress message.
7. When it finishes, follow the prompt for your choice:

   • If you installed Sysmon, click Close.
   • If you uninstalled it, click Restart now to finish the removal. Save your work first, because the PC restarts right away.

To get back to this screen at any time, press Win+I to open Settings, then go to System › Optional features › More Windows Features. To undo your change, repeat the steps and set the checkbox the other way.

Finish Installing Sysmon via Command Line

If you prefer the command line, this method needs only one command. You must run it from an elevated (administrator) window, or it will fail with an access error.

1. Open Windows Terminal (Admin) (Admin) and choose either PowerShell or Command Prompt. You can also right-click the Start button⊞ and pick Terminal (Admin). Click Yes if the User Account Control prompt appears. ⚙️
2. Type or paste the command below, then press Enter:
   
   Sysmon -i
   
3. Wait until the prompt returns. That means the command has finished.
4. Close the Terminal and Settings.

Option 2Install Sysmon Using Command Line Only

This method takes two stages. First you turn on the Sysmon Windows feature, then you install Sysmon itself. Run both commands from an elevated window.

1. Open Windows Terminal (Admin) and pick PowerShell or Command Prompt. Click Yes if User Account Control asks for permission. ⚙️
2. Run one of these commands to turn on the Sysmon feature. Use the one that matches the shell you opened:

   • PowerShellEnable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command PromptDISM /Online /Enable-Feature /FeatureName:"Sysmon"
3. Let the command finish and the prompt return. Do not move on while it is still working.
4. Next, run this command to install Sysmon itself:
   
   Sysmon -i
   
5. Close the Terminal when the command is done.

If the first command fails, check that the window title says Administrator. A normal, non-elevated window is the usual cause.

Option 3Uninstall Sysmon Using Command Line

Removing Sysmon from the command line is a single step, but it ends with a restart. Save and close your open work before you begin.

1. Open Windows Terminal (Admin) and pick PowerShell or Command Prompt. ⚙️
2. Run one of these commands to turn off (uninstall) Sysmon:

   • PowerShellDisable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command PromptDISM /Online /Disable-Feature /FeatureName:"Sysmon"
3. When asked, type Y and press Enter. The PC restarts and finishes uninstalling Sysmon. If you type N instead, the removal is not finished until you restart the🔄 PC yourself.

To bring Sysmon back later, use either install method above.

Summary

• What Sysmon DoesIt tracks and logs important system activity, such as program launches and network connections, to help spot security problems.
• Admin Rights NeededYou must be signed in as an administrator, or be able to enter an administrator password, to add or remove Sysmon. ⚙️
• Easy Installation OptionsUse Settings (System › Optional features › More Windows Features) or command-line tools in Windows Terminal.
• Restart May Be RequiredRemoving Sysmon usually needs a reboot to complete. Installing it through Settings only needs you to click Close.
• Built into Windows 11You don’t need to download anything extra on newer Windows 11 versions. If Sysmon isn’t listed, update Windows and check again.

Tracking background activity helps you spot potential threats early. Administrator rights are required for any change, and removing the feature usually calls for a system restart.