To enable built-in Sysmon in Windows 11, turn on its optional feature and then run sysmon -i in an administrator terminal. This guide walks administrators through setup, verification, and the basics of handling Sysmon events.

Enabling the Windows feature is only the first step: run sysmon -i afterward to start Sysmon.

What built-in Sysmon does

Sysmon records system activity in Windows Event Log so other tools can collect and analyze it. It does not analyze events, generate alerts, or block activity. For threat analysis, send its events to a downstream system such as Windows Event Collection, an endpoint detection and response (EDR) product, or a security information and event management (SIEM) system. Microsoft’s Sysmon overview explains the feature’s role and limits.

The built-in feature and the standalone Sysmon utility cannot be enabled on the same device at the same time. If you already have standalone Sysmon installed, remove it before setting up the Windows feature.

Enable Sysmon and check that it is logging

An English-language walkthrough covers the optional-feature route and the standalone Sysmon prerequisite.

You’ll need a supported Windows 11 device and administrator privileges. Follow these steps in order:

  1. Remove standalone Sysmon, if it is installed. In an administrator terminal, run sysmon -u to uninstall it. The built-in and standalone installations cannot coexist.
  2. Enable the optional Windows feature. In Settings, go to System > Optional features > More Windows features and select Sysmon. Alternatively, run this command in an administrator PowerShell window:Enable-WindowsOptionalFeature -Online -FeatureName Sysmon
  3. Install and start Sysmon. In an administrator terminal, run:sysmon -i Enabling the optional feature does not replace this installation step. Microsoft’s setup instructions specify both actions.
  4. Check the event log. Open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > Sysmon > Operational. Look for entries such as Process Create, Network Connect, or File Create.

Configure the events you want to collect

Sysmon uses an XML configuration to specify event types and include or exclude filters. Apply a configuration file from an administrator terminal with:

sysmon -c <configfile>

Configuration changes take effect dynamically, without a restart. Microsoft cautions that restrictive or poorly tuned configurations can create high event volume, so choose filters with the events you need in mind. Sysmon records the resulting events; a separate system handles their analysis.

Account for language differences and updates

On a Windows device set to another language, Event Viewer’s rendered Sysmon messages are localized, while the underlying XML event data remains consistent across languages. Scripts that process rendered message text may need adjustment. For multilingual log collection, this distinction matters: display wording can vary even when the XML data stays consistent. Microsoft’s overview describes both formats.

Microsoft services built-in Sysmon through Windows updates whether the feature is enabled or disabled. An enabled installation keeps its configuration through a binary update without a restart; a disabled installation stays disabled. These updates do not change a separate standalone Sysmon installation. Non-security improvements are delivered through Windows quality updates, with optional preview updates preceding broad deployment; critical security fixes are delivered through monthly security updates.