How to uninstall Sysmon

Sysmon is great until you need uninstall it, in which case the documented instructions don’t work. If you get an odd the service sysmon64 is already registered, do this:

  1. Stop the Sysmon service in Services.msc.
  2. Open an elevated PowerShell prompt in the folder containing sysmon64.exe
  3. Run sysmon64.exe -u or sysmon64.exe -u force (if the 1st command doesn’t work)

That should uninstall Sysmon completely. I’ve created a corresponding Microsoft Docs PR.

from jdrch

Author: jdrch

ISTJ, Rice Owl, UF Gator, mechanical engineer. STEM, sports, music, movies, humor. Account mine only & unaffiliated.


Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s