Is there a known way to force ProcMon v4.01 to avoid starting 'Boot Logging' at next boot after selecting Enable Boot Logging from the Options menu ?

Question

In another question/answer I already created last week (pls see 'Any other way to solve ProcMon already known issue(s) when loading (or reloading) already previously saved filters ?' contents) I found out that after using ProcMon v3.83 on my Windows 7 SP1 x64 Ultimate PC (and probably after enabling 'Enable Advanced Output' in Options menu, or in Filter menu when using ProcMon v4.01, and/or also after confirming 'Enable Boot Logging' selection made from Options menu with [ OK ] and I'm almost sure that right before I temporarily switched enabled 'Generate thread profiling events' from 'Every second' (default setting) to 'Every 100 milliseconds' to then revert that setting back to its 'Every second' (same initial default setting)) and after that I also found I was even also able to properly start ProcMon v4.01 to overcome older v3.83 limitation to unsuccessfully re-load same filters I already saved on disk while using v3.83 (this was needed to continue an investigation I was doing after properly capturing events with v3.83 and saving filtered results on disk before I also made very wrong decision to 'Reset Filter' from Filter menu of v3.83).

All this happened last week after I was initially able to just load 'C:\Windows\system32\Drivers\PROCMON24.SYS' into memory while using v3.83 (also yesterday in System Event Log I found an Event ID 6 [Source: FilterManager] displayed message "Loading file system filter 'PROCMON24' (0.0, ‎2021‎-‎06‎-‎22T12:41:40.000000000Z) and registering with Filter Manage succeeded." also confirming this) and still having it in memory also continued with v4.01 (even if at that time I was initially unsure if v4.01 was still only using older v3.83 version because already loaded into memory), but then all this situation changed yesterday morning when I also found that after just selecting 'Enable Boot Logging' in v4.01 Options menu and then simply choosing [ Cancel ] then I could find same PROCMON24.SYS driver also saved into C:\Windows\system32\drivers folder but this time from its file properties I'm also sure that it's v4.01 version (during past days I always checked that it was never saved there and that driver only remained loaded into memory).

Because of my initial past attempts to load ProcMon v4.01 without previously using v3.83, I also know that current release wasn't loading and displaying error message "Unable to load Processor Monitor device driver: The specified procedure could not be found." (while in System Log a new related Event ID 26 [Source: Application Popup] saying "Application Popup: : ??\C:\Windows\system32\Drivers\PROCMON24.SYS cannot find ntoskrnl.exe KeInitializeSpinLock") was also added) because of such known missing API from Windows 7 SP1 x64 NTOSKRNL.EXE (and probably at least also KeAcquireSpinLockRaiseToDpc and KeReleaseSpinLock APIs I identified while using latest Process Explorer v17.06), so now main reason behind this question 'Is there a known way to force ProcMon v4.01 to avoid starting 'Boot Logging' at next boot after selecting Enable Boot Logging from the Options menu ?' is that I'd really like to try to find a way to force avoiding ProcMon v4.01 Boot Logging to remain unneedingly enabled, while also contemporarily avoid my OS to unsuccessfully start at next boot, since my very strong understanding is that trying such never before tested and totally unsupported configuration would very likely always fail, and so I'd really also like to ensure to avoid my OS to Blue Screen as much as possible.

Thus, many thanks to you all in advance for your attention (further replies with even more related ideas or suggestions will be welcome too).

Best Regards

Rob

Answer 1

P.S. Please note that due to urgency I had same day I created my own question above I decided to try to implement this workaround: simply rename C:\Windows\System32\drivers\PROCMON24.SYS as PROCMON24_.SYS_ while also hoping that it might have been enough to avoid Windows 7 SP1 x64 Ultimate to Blue Screen, and luckily enough it worked because 2 days later my OS became unstable and then for unclear reasons (even if I do have some ideas, i.e. I may have lowered too many services or apps Priority to Below Normal or even Background) it stopped working properly and after about 30 minutes it Blue Screened with a Stop 0x0000007a ***KERNEL_DATA_INPAGE_ERROR ***(0xfffff6fc500082b0, 0xffffffffc0000185, 0x00000000938da880, 0xfffff8a001056000) that later I also found reported as Event ID 1001 [Source: Error control] into System Event Log and that from its quick dump analysis I completed was found as "Probably caused by : memory_corruption ( nt!MiWaitForInPageComplete+63e )" just like another last previous Blue Screen I experienced on April 29 2025 (so I guess I'll need to be even much more careful while changing services or some other apps Priority to Below Normal or even Background). :-o :-s

But anyway, at least after that I was also able to verify that my extremely basic workaround indeed worked perfectly. So, I luckily avoided PROCMON24.SYS driver from ProcMon v4.01 to unsuccessfully try to load (and then also certainly Blue Screen because only built & supported for Windows 10) during my next unexpected reboot. 0:-)

Once more, many thanks to you all for your attention (further replies with even other related ideas or suggestions will still be welcomed too).

Best Regards

Rob

Answer 2

When I launch procmon, I see these registry entries being defined.

When I enable boot logging, I see additional values added so that the service starts at boot time.

Most sites say that to remove procmon you can just delete the driver.

del /ah C:\Windows\system32\Drivers\PROCMON24.SYS

If the driver is already loaded, then that will fail with an access denied error.

You can then delete the service, reboot, and then delete the procmon24.sys file.

reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PROCMON24 /f

Deleting the service will also prevent boot logging from starting.

I did the testing on Win10 with procmon 3.91.

More info: https://superuser.com/questions/1346125/how-can-i-unload-the-process-monitor-driver-without-restarting/1559047#1559047