Forum Discussion
wreinke
Mar 20, 2025Copper Contributor
PowerShell install updated Sysmon
Attempting to install an updated Sysmon to a computer. Sysmon has been uninstalled prior to updating; however, when running PowerShell in Intune to install it, it appears that Sysmon64.exe is copied to C:\Windows\, but no service is created for Sysmon64. This is running in System context, with WORKGROUP\SYSTEM for a user.
Running the following command in a PowerShell script only copies the file, but doesn't create the service:
Start-Process -Wait "sysmon64.exe" -ArgumentList "-i -accepteula"
Running the above line in PowerShell ISE, as myself outside of the Intune deployment, the service is created without issue.
What am I missing? Thanks!
No RepliesBe the first to reply