Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,169 questions
Unable to stop or uninstall Sysmon 15.0
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 94%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPD%3C/text%3E%3C/svg%3E)
Persson, Daniel
25
Reputation points
Since the new Sysmon version 15.0 we have been unable to stop the service or uninstall the application.
As you can see the service is unable to be stopped even when trying to uninstall it. We've tried this as administrator, System and through an SCCM Appliaction. It displays this behaviour regardless of how we try to do it.
We install it using configfile.xml -accepteula
We try to uninstall it simply using -u force
Is there any way to solve this that would work through mass deployment and does not require manual fixes?
Sysinternals
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 98%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWH%3C/text%3E%3C/svg%3E)
Wesley Heydlauff 20 Reputation points2023-08-18T15:29:12.7833333+00:00 I have this same issue but also seeing another issue when trying to install version 15 to windows 11 machines that have the latest update it comes back with this error
Sysmon64.exe - System Error
The code execution cannot proceed because C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22621.608_none_fb280a3c7926c2cc\COMCTL32.dll was not found. Reinstalling the program may fix this problem.
OK
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 76%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES%3C/text%3E%3C/svg%3E)
SPP12345 15 Reputation points2023-08-21T15:38:23.09+00:00 I have faced same/similar issue with sysmon15
https://learn.microsoft.com/en-us/answers/questions/1346358/sysmon-15-is-not-able-to-start-service-in-timely-m -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 45%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
Bigerl Stefan 1 Reputation point2023-08-25T09:29:56.4466667+00:00 We faced also uninstall issues..
Deleteing the 2 Sysmon hives in Registry - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
and rebooting helped...
Then the SysMon service and the filter driver are gone... But the files & Eventlog is still there...
Hope this helps.. -
Silvio Lorenzo Torre 0 Reputation points2023-08-26T16:33:05.07+00:00 Sysmon installs its service resiliently (high integrity) and might resist being stopped or uninstalled by processes with a lower integrity level, even when run as administrator.
Try using sysinternals psexec (https://learn.microsoft.com/en-us/sysinternals/downloads/psexec). With Psexec you can run commands acting as NT AUTHORITY SYSTEMExample: start a command line as administtrator and try this
psexec -accepteula -i -s cmd.exe
Now a new command line is open, with NT AUTHORITY SYSTEM privileges; so you can try to uninstall Sysmon:
c:\path_to_sysmon\sysmon.exe -u
Hope can be useful, Silvio
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 11%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EWK%3C/text%3E%3C/svg%3E)
Will Kleinhenz 5 Reputation points2023-08-29T14:22:28.52+00:00 Silvio, This solution doesn't work for me, even with running the uninstall command through PsExec im still seeing Access denied when it tries to stop and delete the service, If im understanding correctly with 15.0 it wouldnt matter if the process is running as NT Authority System if its not also running with the PPL permissions and for some reason it appears that running the Sysmon 15 doesnt though i havent confirmed that
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 76%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMN%3C/text%3E%3C/svg%3E)
Mohammad Nasir 0 Reputation points2024-02-28T15:34:49.8366667+00:00 We are facing the same issue as you can see the screenshot from the command prompt. we tried with run as an Admin. We also have older version on sysmon and we don't have any issue with it. we noticed that that issue is with version 15 only. Did anyone find any solution??
-
Mohammad Nasir 0 Reputation points
2024-02-28T15:34:59.4866667+00:00
Sign in to comment
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more