Outcome: You’ll enable built-in Sysmon on Windows 11 to capture detailed security and troubleshooting logs (processes, network activity, and more).

Who this is for: Windows 11 power users, IT admins, and security-curious beginners who want deeper visibility without extra download tools.

Time required: About 5 minutes.

Quick Answer

After updating to Windows 11 KB5079473 (or newer), install the Sysmon optional feature, then run sysmon -i in an elevated terminal. Sysmon starts logging to Event Viewer under Applications and Services Logs → Microsoft → Windows → Sysmon.

Prerequisites

  • Windows 11 with KB5079473 (March 2026) or newer
  • Administrator account on the PC
  • Access to PowerShell or Command Prompt as admin

Step-by-Step: Enable Native Sysmon

  1. Install the latest Windows updates.
    Go to Settings → Windows Update, click Check for updates, install all pending updates, and restart if prompted.
    Expected result: Your system is on KB5079473 or a newer build where Sysmon appears as an optional feature.
  2. Install Sysmon from Optional Features.
    Open Settings → System → Optional features, choose View features, search for Sysmon, check it, and click Install.
    Expected result: Sysmon installs successfully and becomes available from terminal.
  3. Open an elevated terminal.
    Right-click Start, choose Terminal (Admin) or Windows PowerShell (Admin).
  4. Initialize Sysmon service.
    Run:
    sysmon -i
    Expected result: Sysmon service installs and starts.
  5. Verify logs in Event Viewer.
    Open Event Viewer and navigate to:
    Applications and Services Logs → Microsoft → Windows → Sysmon → Operational.
    Expected result: You see recent Sysmon event entries (such as process creation events).

Expected Result Checks

  • sysmon -i runs without errors
  • Sysmon service appears and is running in Services
  • Sysmon Operational log is visible in Event Viewer
  • New events populate as you open apps or browse websites

Common Mistakes

  • Running terminal without admin rights: Sysmon install command fails or partially applies.
  • Not rebooting after updates: Optional feature list may not refresh until restart.
  • Confusing old Sysinternals install with native feature: Existing legacy setup can conflict.
  • Ignoring event volume: Default logs can grow quickly if left unmanaged.

Troubleshooting (Quick Fixes)

  • Sysmon not in Optional Features: Recheck Windows Update + Optional updates, then reboot and try again.
  • sysmon -i errors: Run as admin, then remove old instance with sysmon -u and reinstall.
  • No logs showing: Confirm Sysmon service is running in services.msc, then reopen Event Viewer.
  • Too many logs or CPU spikes: Use a tuned config file and install with sysmon -i config.xml.

Why This Trick Is Worth Trying

Sysmon gives you “detective mode” for Windows: far better visibility into what actually runs on your machine than standard logs alone. It’s useful for malware triage, app troubleshooting, and learning how your system behaves in real life.

Related FreeTechTricks Guides

Next Step

After confirming Sysmon is working, add a curated configuration file to reduce noise and focus on high-value events like suspicious process chains and unusual network connections.

References