How do you stop Sysmon64.exe so that the program can be uninstalled / upgraded

Clint D'Souza 5 Reputation points
2024-06-07T04:34:05.26+00:00

We have an issue with Sysmon 15.12 causing Windows Server 2022 VM's (ESX 7) to unexpectedly reboot. Microsoft Unified Support informed us to upgrade to Sysmon 15.14 however I am unable to stop the service despite having highest priveledges.

What is the correct way to stop the service?

Sysmon64.exe -u

System Monitor v15.12 - System activity monitor

By Mark Russinovich and Thomas Garnier

Copyright (C) 2014-2023 Microsoft Corporation

Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.

Sysinternals - www.sysinternals.com

Stopping Sysmon64.

Sysmon64 failed to stop.

DeleteService failed:

Access is denied.

Stopping the service failed:

The service cannot accept control messages at this time.

DeleteService failed:

The specified service has been marked for deletion.

Removing service files...............................

Failed to delete C:\Windows\Sysmon64.exe

Failed to delete SysmonDrv.sys

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,170 questions
0 comments No comments
{count} vote

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.