Sysmon not working after upgrade from 5.2 to 15.0

Victorio, Elisha Israel 20 Reputation points
2023-06-29T17:22:23.3033333+00:00

I'm trying to upgrade sysmon in my Windows server because it was detected with a security vulnerability. I copied and pasted the new version 15.0 sysmon file to the server because I haven't searched better how to upgrade sysmon, and unfortunately it did not work resulting in sysmon not starting. I tried to use the install command in cmd but it says "The service Sysmon is already registered. Uninstall Sysmon before reinstalling." I also tried to uninstall but I get the "Access is denied" error even though I'm logged in as an administrator and using command prompt as administrator. Is there any chance I can still get this installation/upgrade fixed? Any help will be appreciated. Thank you

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,235 questions
0 comments No comments
{count} votes

Accepted answer
  1. Alex Mihaiuc 256 Reputation points Microsoft Employee
    2023-07-04T13:08:19.14+00:00

    That's a really old Sysmon running there, v5.02. Just manually delete it and then switch to v15.0. Also look in the Registry under ControlSet001:

    • Remove the reference to the service and driver from the Registry:
      • Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sysmon[64]
      • Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sysmon[64]
      • Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SysmonDrv
      • Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonDrv
    • Reboot and delete the binaries C:\Windows\sysmon[64].exe, C:\Windows\SysmonDrv.exe.
    • Install the new v15.0 client which should work.
    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
  1. Alex Mihaiuc 256 Reputation points Microsoft Employee
    2023-06-30T16:26:52.2533333+00:00

    Hey, there might be a mismatch between the new Sysmon client and the old service and driver.

    Try

    .\sysmon64.exe -u force
    

    which should work even with the v15.0 executable. Restart the computer and attempt installation afterwards.

    If that keeps failing, you can always "manually" dispose of the driver by deleting its autostart entry from the Registry - Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysmonDrv. The same can be done for the service, it's at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sysmon64. Following a system restart, for extra safety, delete C:\Windows\sysmon64.exe and C:\Windows\SysmonDrv.sys.

    Installing Sysmon v15.0 should work afterwards, just force uninstall first, to be sure, followed by install:

    .\sysmon64.exe -u force
    .\sysmon64.exe -i my_config.xml
    

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.