How to Install or Uninstall Built-in Sysmon on Windows 11

What is Sysmon?

System Monitor (Sysmon) is a built-in Windows 11 tool that tracks background activity, recording events like program launches and network connections. Detailed logging clarifies what happens on your PC, giving security issues less room to hide.

Why use Sysmon? It offers a detailed view of your system’s activity. This deep visibility helps flag security threats and speeds up troubleshooting.

Turning on the feature starts logging system events automatically. Reviewing these logs shows a clear picture of computer activity over time.

Recent Windows 11 versions include Sysmon by default, eliminating the need for extra downloads.

Administrative privileges are required to install or remove this feature. ⚙️

Option 1Install or Uninstall Sysmon Using Windows Settings

1. Open Settings by pressing Win+I.
2. Click System from the left menu, then select Optional features on the right.
3. Click More Windows Features near the top.
4. In the new window, find Sysmon in the list.
5. To install, check the box next to Sysmon. To uninstall, uncheck the box.
6. Click OK.
7. Depending on your choice:

   • If installing 💿, click Close.
   • If uninstalling, click Restart now to finish the removal.

Press Win+I to open Settings ⚙️, then go to System › Optional features › More Windows Features to find Sysmon.

Finish Installing Sysmon via Command Line

1. Open Windows Terminal (Admin) (Admin). ⚙️ Choose either PowerShell or Command Prompt.
2. Type or paste the command below, then press Enter:
   
   Sysmon -i
   
3. After it finishes, you can close the Terminal and Settings.

Option 2Install Sysmon Using Command Line Only

1. Open Windows Terminal (Admin) ⚙️ and pick PowerShell or Command Prompt.
2. Run one of these commands to turn on the Sysmon feature:

   • PowerShell: Enable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command Prompt: DISM /Online /Enable-Feature /FeatureName:"Sysmon"
3. Next, run this command to install Sysmon itself:
   
   Sysmon -i
   
4. Close the Terminal when done.

Option 3Uninstall Sysmon Using Command Line

1. Open Windows Terminal (Admin) ⚙️ and pick PowerShell or Command Prompt.
2. Run one of these commands to turn off (uninstall) Sysmon:

   • PowerShell: Disable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command Prompt: DISM /Online /Disable-Feature /FeatureName:"Sysmon"
3. When asked, type Y and press Enter to restart your PC and finish uninstalling.

Summary

• What Sysmon Does: Tracks and logs important system activities to help spot security problems.
• Admin Rights Needed: You must be signed in as an administrator to add or remove Sysmon. ⚙️
• Easy Installation Options: Use Settings or Command Line tools like Windows Terminal.
• Restart May Be Required: Removing Sysmon usually needs a reboot to complete.
• Built into Windows 11: No need to download anything extra on newer Windows 11 versions.

Tracking background activity helps spot potential threats early. Administrator rights are required for any changes, and removing the feature usually calls for a system restart.