DEV Community

loading...
Cover image for How to uninstall Sysmon

How to uninstall Sysmon

jdrch profile image jdrch ・1 min read

Sysmon is great until you need uninstall it, in which case the documented instructions don't work. If you get an odd the service sysmon64 is already registered, do this:

  1. Stop the Sysmon service in Services.msc.
  2. Open an elevated PowerShell prompt in the folder containing sysmon64.exe
  3. Run sysmon64.exe -u or sysmon64.exe -u force (if the 1st command doesn't work)

That should uninstall Sysmon completely. I've created a corresponding Microsoft Docs PR.

Discussion (0)

Forem Open with the Forem app