Sysmon, one of Microsoft’s most useful Sysinternals utilities, is no longer something you have to download and install on your own. In Windows 11, it ships as a built-in optional feature, so you can enable it and start digging into what your PC is doing without hunting down a separate installer.
What is the Sysmon activity monitor?
Sysmon (short for System Monitor) is a Sysinternals tool that watches your computer and logs detailed activity straight into the Windows event log. Where Task Manager shows you a live snapshot of what’s running at this moment, Sysmon records the full history — process creation, network connections, file changes, registry activity, and more.
The tool was originally created by Mark Russinovich, Microsoft’s CTO of Azure, and has long been a staple for IT admins and security pros who need to investigate suspicious behavior or figure out exactly what changed on a machine. For years, the only way to get it was to download it from the Sysinternals page and run it manually.
Now that it’s baked into Windows 11, that friction is gone. You enable it like any other optional feature, and it launches directly from Windows Terminal.
Why it matters for everyday users
Most people will never need Sysmon, and that’s perfectly fine — Task Manager and Settings cover the basics for daily use. But if you’ve ever wondered which process spiked your CPU, which app reached out to the network overnight, or what actually changed on your system after an update, this tool gives you the forensic detail to find out.
It’s especially handy for anyone chasing down performance problems or trying to tell whether something on their machine is behaving unusually. Because Sysmon writes to the standard Windows event log, the data it collects can also be pulled into broader security and monitoring tooling for deeper analysis.
How to enable it in Windows 11
Enabling the feature is a simple process through the Settings app. Follow these steps:
- Open Settings and head to System > Optional Features (in some builds this still sits under Apps > Optional Features).
- Click Add a feature or the plus button to open the list.
- Search for System Monitor or Sysmon.
- Select it and choose Install.
Once the install finishes, the feature is ready to go. If you’d rather use the command line, you can add it as a Windows capability through PowerShell using the standard capability-install pattern, though the Settings route is the simplest path for most people.
How to use it once enabled
With Sysmon installed, open Windows Terminal and type Sysmon, then press Enter. This launches the interactive monitor, which streams activity from your system in real time.
By default, Sysmon logs a baseline set of events. To get the most out of it, power users typically drop in a configuration file — a small XML document that tells Sysmon precisely which events to track and how granular to be. This is the same approach used for years in the standalone version, and it’s where the tool really earns its keep for deep investigation.
What this means for you
The big takeaway is convenience: a tool that once required a separate download and manual setup is now a single click away on any Windows 11 machine. You don’t need to visit a Sysinternals website or worry about keeping a standalone binary up to date — it’s part of the OS itself.
That said, this is a power-user and professional-grade utility. If you’re not comfortable reading event logs or editing configuration files, you may not find an immediate day-to-day use for it. But it’s worth having available the moment you need to dig deeper than Task Manager lets you.
How to get it
Head to Settings > System > Optional Features, search for System Monitor, and install it. From there, just launch Windows Terminal and run Sysmon to start monitoring. It’s free, built into Windows 11, and ready whenever you want a closer look at what’s happening under the hood.
Source: Neowin
Over to you: Have you tried the built-in Sysmon yet, or do you still prefer the standalone Sysinternals version?
