How to Install or Uninstall Built-in Sysmon on Windows 11

What is Sysmon?

Sysmon is a helpful Windows tool that keeps an eye on what’s going on inside your computer, logging important events like when new programs start or when your computer connects to the internet.

Why use Sysmon? It gives you a detailed view of your system’s activity. This helps you find security threats and troubleshoot problems.

What happens when you install it? Sysmon starts logging system events automatically. You can then review these logs to get a clear picture of your computer’s activity.

Good news! Newer versions of Windows 11 (such as build 26220 and later) already include Sysmon, so you won’t need to download any extra software.

Important: Before you start, though, remember this: you must be signed in as an Administrator to install or uninstall Sysmon. ⚙️

Option 1Install or Uninstall Sysmon Using ⚙️ Windows Settings

1. ⚙️ Open Settings by pressing ⊞ Win+I.
2. Click System from the left menu, then select Optional features on the right.
3. Click More Windows Features near the top.
4. In the new window, find Sysmon in the list.
5. To install, check the box next to Sysmon. To uninstall, uncheck the box .
6. Click OK.
7. Depending on your choice:

   • If 💿 installing, click Close.
   • If uninstalling, click Restart now to finish the removal.

You can easily add or remove Sysmon right from Windows 11’s Settings menu, which is a straightforward way to manage this useful tool without needing complicated commands.

Finish 💿 Installing Sysmon via Command Line

1. Open Windows Terminal (Admin) (Admin). ⚙️ Choose either PowerShell or Command Prompt.
2. Type or paste the command below, then press Enter:
   
   Sysmon -i
   
3. After it finishes, you can close the Terminal and Settings.

Option 2Install Sysmon Using Command Line Only

1. Open Windows Terminal (Admin) ⚙️ and pick PowerShell or Command Prompt.
2. Run one of these commands to turn on the Sysmon feature:

   • PowerShell: Enable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command Prompt: DISM /Online /Enable-Feature /FeatureName:"Sysmon"
3. Next, run this command to install Sysmon itself:
   
   Sysmon -i
   
4. Close the Terminal when done.

Option 3Uninstall Sysmon Using Command Line

1. Open Windows Terminal (Admin) ⚙️ and pick PowerShell or Command Prompt.
2. Run one of these commands to turn off (uninstall) Sysmon:

   • PowerShell: Disable-WindowsOptionalFeature -Online -FeatureName Sysmon
   • Command Prompt: DISM /Online /Disable-Feature /FeatureName:"Sysmon"
3. When asked, type Y and press Enter to 🔄 restart your PC and finish uninstalling.

Summary

• What Sysmon Does: Tracks and logs important system activities to help spot security problems.
• Admin Rights Needed: You must be signed in as an administrator to add or remove Sysmon. ⚙️
• Easy Installation Options: Use Settings or Command Line tools like Windows Terminal.
• Restart May Be Required: Removing Sysmon usually needs a reboot to complete.
• Built into Windows 11: No need to download anything extra on newer Windows 11 versions.

Sysmon on Windows 11 helps you track and log what your computer is doing, which is great for spotting security issues, and you can 💿 install it easily using ⚙️ Windows Settings or the command line.