Sysmon Uninstall successful but leaving locked executable

Question

Sysmon Uninstall successful but leaving locked executable

Chris Smith 6

Using the command "Sysmon -u force", I am able to uninstall Sysmon successfully with a return code of 0, however I'm finding it sometimes leaves the Sysmon.exe executable in C:\Windows. When trying to delete this executable, via cmd shell or Powershell, up to and including "Remove-item -force", I'm finding that the executable is locked by the Windows Event Log service and unable to be deleted. Has anyone else seen this before, and is there a way to handle this without rebooting? I'm not having any luck with Stop-service -name EventLog either, due to the service dependencies.

1 answer

Your answer

Answer 1

Michael Taylor 60,346

Without rebooting? Probably not. If you tell Windows to delete a file and that file is still in use by another process then it can get into a state where the file is permanently locked until reboot. Windows Explorer is notorious for this in my experience.

In theory you could use Process Explorer or perhaps Handles to search for any running processes that have a handle to this file and then try to stop the process but in my experience some of those processes are system processes and cannot be terminated, hence a reboot is needed.

Is it a really big deal if the file remains around until a reboot? What most uninstall code does is attempt to delete the file and, if that fails, add the file to the list of files to be removed at next reboot. The file remains around until the next reboot and is then removed early in the boot process. The downside is that you cannot put a new copy of the file in that same location but this might not be an issue for you.

Chris Smith 6 Reputation points

2022-12-21T17:55:31.587+00:00

Unfortunately, this is being done as part of an upgrade script (which will be mass deployed) to uninstall Sysmon and update to the latest version (14.13). In the cases where Sysmon.exe is left in the Windows folder, the install of Sysmon 14.13 is failing with a return code of 32, and only installs successfully when sysmon.exe is successfully deleted. Additionally, setting the script to resume/run as a startup task is frowned upon in my organization, so I'm hopefully needing it to be a one-and-done. Otherwise, I'll likely have to set it up as a series of scripts, with a reboot in between. We also don't like to do forced reboots organizationally, So leaving Sysmon uninstalled for multiple days could leave our SIEM/SOC blind to those devices while they await reboot, which will be a hard sell.
Vladimir Peyko 5 Reputation points

2023-06-08T12:33:08.8566667+00:00

Did you have any luck with this.

I got same issue removing older Sysmon Versions v7 v8 v10 need to replace with 14.16.
but some machines would hang on uninstall.
I think Spluk is a culprit
Maybe custom Sysmon Config that Splunk pushes.
Coincidently ruing Splunk.exe Stop and then removing SysmonDRV with fltMC.exe unload sysmondrv allows Sysmon to uninstall without hanging the system, BUT after that new Sysmon wont install..

it tries and then removes itself after saying it cant start or something along the line.

If you managed to get around this, please share :)
Chris Smith 6 Reputation points

2023-06-08T13:40:34.23+00:00

Vlad,

I was actually able to resolve the issue, albeit in a roundabout way. In our case scenario, we found that the Windows Event Log service kept locking the Sysmon executable. So even though our Powershell script attempts to stop the Sysmon service and all Sysmon PIDs, it wasn't able to stop it fully due to that Event Log Service locking the Sysmon.exe executable.

To get around this, we renamed the Sysmon executable, deleted SysmonDrv.sys, and then added the renamed file to the PendingFileRenameOperations registry key, with the below code. What this does is flag the file to be deleted upon next reboot. After the file rename is completed, the new version of Sysmon will install successfully.

Code Block:

New-ItemProperty -path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name "PendingFileRenameOperations" -Value $($((Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" -Name PendingFileRenameOperations -ErrorAction SilentlyContinue).PendingFileRenameOperations) + "??$NewFileName00") -Type MultiString -force | Out-Null

Note, the only variable you should need to change in the above string is $NewFileName, or at least instantiate that variable before running that line with the name of the renamed file.

Good luck!

Share via

Sysmon Uninstall successful but leaving locked executable

1 answer

Your answer