DEV Community

Cover image for How to uninstall Sysmon
jdrch
jdrch

Posted on • Edited on

How to uninstall Sysmon

Sysmon is great until you need to uninstall it, in which case the documented instructions don't work. If you get an odd the service sysmon64 is already registered message, do this:

  1. Stop the Sysmon service in Services.msc.
  2. Open an elevated PowerShell prompt in the folder containing sysmon64.exe
  3. Run sysmon64.exe -u or sysmon64.exe -u force (if the 1st command doesn't work)

That should uninstall Sysmon completely. I've created a corresponding Microsoft Docs PR.

Top comments (0)

👋 Kindness is contagious

Engage with a wealth of insights in this thoughtful article, valued within the supportive DEV Community. Coders of every background are welcome to join in and add to our collective wisdom.

A sincere "thank you" often brightens someone’s day. Share your gratitude in the comments below!

On DEV, the act of sharing knowledge eases our journey and fortifies our community ties. Found value in this? A quick thank you to the author can make a significant impact.

Okay