See What Every App on Your PC Is Really Doing With Windows 11's Free Sysmon

Windows 11 now ships with Sysmon, Microsoft's free activity logger, and turning it on takes two commands and about two minutes.

Sysmon used to be a separate download from Microsoft's Sysinternals toolkit, but since the March 2026 update it is part of Windows 11 itself.

It works like a flight recorder for your PC, quietly noting which programs start, what they connect to and which files they create.

It is switched off by default, so here is how to turn it on, where to read what it records, and how to switch it off again.

What Sysmon actually does - and what it does not

Sysmon writes a detailed diary of activity into the Windows event log. It sees things Task Manager forgets the moment they happen, such as a program that ran for two seconds during an install and then vanished.

It does not block, quarantine or remove anything, and it is not antivirus. Think of it as a security camera rather than a guard - it records, and you or another tool decide what to do about it.

For a home user, it answers three practical questions:

• What did that installer actually run and drop on my PC?
• Which program keeps connecting to the internet in the background?
• After a scare - a strange pop-up, a suspicious download - what happened, and when?

Before you start

• Windows 11 with the March 2026 update or later. To check, press Windows + R, type winver and press Enter - Windows 11 builds are 22000 or higher, and anything lower is Windows 10, which does not have it.
• An administrator account on the PC.
• No older standalone Sysmon installed - the built-in one refuses to run alongside it. Step 2 below checks this for you.

How to turn on the built-in Sysmon

1. Open PowerShell as administrator. Right-click the Start button, choose Terminal (Admin) and click Yes - on Windows 11 it opens in PowerShell, which is what these commands need.
2. Check for an old copy. Type the first command below and press Enter - if it prints nothing, you are clear; if it lists a Sysmon service, uninstall that old version first.
3. Add the Sysmon feature. Run the second command below and wait for it to finish.
4. Start Sysmon. Run the third command, which installs the Sysmon service and driver with Microsoft's default settings.
5. That is it. No restart is needed, and Sysmon starts logging straight away.

Check for an existing standalone Sysmon:

Get-Service sysmon*

Add the built-in Sysmon feature:

Enable-WindowsOptionalFeature -Online -FeatureName Sysmon

Install and start Sysmon:

sysmon -i

If you copy commands from Microsoft's own setup page, watch the dash before the i. Some versions of that page show a long dash instead of a normal hyphen, and Terminal will not accept it.

Where to read what Sysmon recorded

Press Start, type Event Viewer and open it. In the left panel, open Applications and Services Logs, then Microsoft, then Windows, then Sysmon, and click Operational.

Every row is one event, and the Event ID column tells you what kind. These are the ones worth knowing:

Not every event type is switched on in the default setup, so some of these rows may never appear until you add a configuration file. Click any event and the General tab below shows the details in plain text.

Make it log more - or less

What Sysmon records is controlled by a small settings file in XML format. You do not have to write one yourself: Microsoft points to free community files, and SwiftOnSecurity's sysmon-config is the popular starting point because it already filters out most everyday noise.

Save the file somewhere simple, such as a new folder called Sysmon on your C: drive, then apply it from an admin Terminal. The change takes effect at once, with no restart.

sysmon -c C:\Sysmon\sysmonconfig.xml

How to turn Sysmon off again

To stop logging, run the first command below in an admin Terminal. To remove the feature completely, run the second one as well and restart when Windows asks.

sysmon -u

Disable-WindowsOptionalFeature -Online -FeatureName Sysmon

Who should look elsewhere

If you just want to see what is running right now, Task Manager already does that, with no setup. Sysmon is for what happened when you were not watching.

If you want to see the actual traffic leaving your PC rather than a list of connections, Wireshark shows every packet. And if Sysmon turns up adware or a browser hijacker, AdwCleaner removes it in a few clicks.

If things look genuinely bad, the cleanest fix is often to restore a system image from before the problem started. More free tools sit in our Security Tools section.

Still on Windows 10? The built-in version is Windows 11 only, but the standalone Sysmon from Sysinternals works the same way.

Quick questions