This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 94%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPD%3C/text%3E%3C/svg%3E)
Since the new Sysmon version 15.0 we have been unable to stop the service or uninstall the application.
As you can see the service is unable to be stopped even when trying to uninstall it. We've tried this as administrator, System and through an SCCM Appliaction. It displays this behaviour regardless of how we try to do it.
We install it using configfile.xml -accepteula
We try to uninstall it simply using -u force
Is there any way to solve this that would work through mass deployment and does not require manual fixes?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 98%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWH%3C/text%3E%3C/svg%3E)
I have this same issue but also seeing another issue when trying to install version 15 to windows 11 machines that have the latest update it comes back with this error
Sysmon64.exe - System Error
The code execution cannot proceed because C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_fb280a3c7926c2cc\COMCTL32.dll was not found. Reinstalling the program may fix this problem.
OK
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 76%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
I have faced same/similar issue with sysmon15
https://learn.microsoft.com/en-us/answers/questions/1346358/sysmon-15-is-not-able-to-start-service-in-timely-m
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 45%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
We faced also uninstall issues..
Deleteing the 2 Sysmon hives in Registry - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
and rebooting helped...
Then the SysMon service and the filter driver are gone... But the files & Eventlog is still there...
Hope this helps..
Sysmon installs its service resiliently (high integrity) and might resist being stopped or uninstalled by processes with a lower integrity level, even when run as administrator.
Try using sysinternals psexec (https://learn.microsoft.com/en-us/sysinternals/downloads/psexec). With Psexec you can run commands acting as NT AUTHORITY SYSTEM
Example: start a command line as administtrator and try this
psexec -accepteula -i -s cmd.exe
Now a new command line is open, with NT AUTHORITY SYSTEM privileges; so you can try to uninstall Sysmon:
c:\path_to_sysmon\sysmon.exe -u
Hope can be useful, Silvio
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 11%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWK%3C/text%3E%3C/svg%3E)
Silvio, This solution doesn't work for me, even with running the uninstall command through PsExec im still seeing Access denied when it tries to stop and delete the service, If im understanding correctly with 15.0 it wouldnt matter if the process is running as NT Authority System if its not also running with the PPL permissions and for some reason it appears that running the Sysmon 15 doesnt though i havent confirmed that
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 76%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMN%3C/text%3E%3C/svg%3E)
We are facing the same issue as you can see the screenshot from the command prompt. we tried with run as an Admin. We also have older version on sysmon and we don't have any issue with it. we noticed that that issue is with version 15 only. Did anyone find any solution??
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 23%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFT%3C/text%3E%3C/svg%3E)
Hi,
delete this path and restart the server. after that you won't see the service. delete files manuely in C:\Windows.
delete this: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sysmon64