> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/i-am-having-issues-with-sysmon-on-windows-hosts-in-enginsight-what-can-i-d.md).

# I am having issues with Sysmon on Windows hosts in Enginsight. What can I do?

Sysmon (System Monitor) is a Windows system service for monitoring and logging system activity. The Enginsight agent Pulsar also uses it to log system events.

During installation on a Windows host, Pulsar checks whether Sysmon is already installed on the host. If it is not, Pulsar installs Sysmon on the corresponding host. During this process, the file **sysmon-managed.txt** is created in the Pulsar installation directory.

If Sysmon already exists on the host, Pulsar detects this and does not perform an installation.

In this article, we will show you what you can do if you experience issues with Sysmon on a Windows host where Pulsar is also installed.

***

## Issues with Sysmon Stability

If you are experiencing stability issues with Sysmon on your Windows host and these issues are caused by Pulsar, or if there are issues uninstalling Sysmon, you have several options.

### 1. Restart the host

Restart your host. In most cases, this helps resolve stability issues, for example.

### 2. Force Sysmon to uninstall

If simply restarting the host does not resolve the issue, you can force Sysmon to uninstall and, if necessary, reinstall Sysmon.

Follow these steps:

{% stepper %}
{% step %}
Stop the Pulsar service and the Supervisor service on your Windows host.
{% endstep %}

{% step %}
Open a system CMD or PowerShell window with administrator privileges.
{% endstep %}

{% step %}
Run one of the following commands to uninstall Sysmon:

**32-bit**

```
& "C:\Program Files\Enginsight\Pulsar\sysmon\Sysmon.exe" -u force
```

**64-bit x86 (x86\_64/amd64)**

```
& "C:\Program Files\Enginsight\Pulsar\sysmon\Sysmon64.exe" -u force
```

**64-bit ARM (ARM64)**

```
& "C:\Program Files\Enginsight\Pulsar\sysmon\Sysmon64a.exe" -u force
```

{% endstep %}

{% step %}
Start the Pulsar service and the Supervisor service again.
{% endstep %}
{% endstepper %}

If the forced uninstallation is not successful this way, you can try repeating it not as an administrator, but as the SYSTEM user.

To do this, use the Windows command-line tool [PSExec](https://learn.microsoft.com/de-de/sysinternals/downloads/psexec) to open a system CMD or PowerShell window, for example using the following command:

```
psexec -i -s powershell.exe
```

***

## Issues with Sysmon Installations by Third-Party Software

If you want to install and use Sysmon with a third-party configuration, issues may occur if Pulsar is already installed on the corresponding Windows host. For example, the Sysmon service with the third-party configuration may be automatically disabled or removed entirely.

In this case, you must manually delete the file **sysmon-managed.txt** from the Pulsar installation directory.

Follow these steps:

{% stepper %}
{% step %}
Stop the Pulsar service.
{% endstep %}

{% step %}
Navigate to the Pulsar installation directory:

```
C:\Program Files\Enginsight\Pulsar
```

{% endstep %}

{% step %}
Delete the file `sysmon-managed.txt` from the directory.
{% endstep %}

{% step %}
Start the third-party software that you want to use to install and manage Sysmon.
{% endstep %}

{% step %}
Start the Pulsar service again.
{% endstep %}
{% endstepper %}

***