MSI installer for Sysmon?

Question

I'd like to put in a feature request to have a MSI installer for Sysmon (and the related services). This would allow integration with normal package managers and desired state tools (e.g. Puppet), without having to create wrappers to handle the Sysmon command line logic. If specific details are needed, I can provide them.

Answer 1

I'm a big advocate for this. We've had significant issues in our environment from some variety in how it installs. Despite claims on the command line help, sometimes it doesn't uninstall without a reboot. A lock is retained on the service exe from the eventlog service, and what we experienced was the attempt to install the new version would then register the service against the installation source file, rather than copy the exe into place in the Windows directory. We also experienced some bluescreens in the uninstall. Detecting the lock to try to take evasive action on this has proven to be difficult. It would be nice to just have the installation/removal taken care of like another app.