sysinternals / sysmoncommon

The common parts of the Sysinternals Sysmon tool shared between the Windows and Linux versions.

Windows Sysinternals Documentation

This is the source repository for https://docs.microsoft.com/sysinternals/

Contributing

Please see CONTRIBUTING.md if you wish to contribute fixes or updates.

Microsoft Open Source Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

sysmoncommon's Issues

Sysmon 15 is not able to start service in timely manner?

Sysmon 15 installation failed during StartService operation and it tried to clean up machine by uninstalling it automatically, but uninstall operation failed as well and left the System in bad state so reinstallation is not working either.

System Monitor v15.0 - System activity monitor
By Mark Russinovich and Thomas Garnier
Copyright (C) 2014-2023 Microsoft Corporation
Using libxml2. libxml2 is Copyright (C) 1998-2012 Daniel Veillard. All Rights Reserved.
Sysinternals - www.sysinternals.com

Loading configuration file with schema version 4.81
Sysmon schema version: 4.90
Configuration file validated.
Sysmon64 installed.
SysmonDrv installed.
Starting SysmonDrv.
SysmonDrv started.
StartService failed for Sysmon64:
The service did not respond to the start or control request in a timely fashion.
Failed to start the service:
The service did not respond to the start or control request in a timely fashion.

Stopping SysmonDrv.
SysmonDrv stopped.
SysmonDrv removed.
Stopping the service failed:
The system cannot find the file specified.
DeleteService failed:
Access is denied.
. Stderr: 
. ExitCode: 1053 

Retrying install command will complain about it's already install, as I see that Sysmon64 service is installed but C:\Windows\Sysmon64.exe was deleted so it can't be started.

Procdump64 for Nano server is not working in the windows container?

Image

https://hub.docker.com/_/microsoft-windows-servercore-iis

Repo Steps

1. Build and run image as docker readme.
2. Download SysinternalsSuite-Nano.zip, extract and copy it to container.

3. The procdump64 executing will be stuck and can't return until Ctrl + C, like run procdump64 -? or procdump64 -ma pid. I tried commond prompt and powershell. The result are the same.

Request

Please help to check if it's a tool issue or cause by approriate usage.