Forum Discussion

wreinke's avatar
wreinke
Copper Contributor
Mar 20, 2025

PowerShell install updated Sysmon

Attempting to install an updated Sysmon to a computer. Sysmon has been uninstalled prior to updating; however, when running PowerShell in Intune to install it, it appears that Sysmon64.exe is copied to C:\Windows\, but no service is created for Sysmon64. This is running in System context, with WORKGROUP\SYSTEM for a user.

Running the following command in a PowerShell script only copies the file, but doesn't create the service:

Start-Process -Wait "sysmon64.exe" -ArgumentList "-i -accepteula"

Running the above line in PowerShell ISE, as myself outside of the Intune deployment, the service is created without issue.

What am I missing? Thanks!

No RepliesBe the first to reply

Resources