Windows attempting to disable and enable Sysmon constantly

Hello,

We have been seeing issues with Sysmon since MS included it in the March 2026 Windows LCU. Since it was included, I have noticed these entries every few minutes.

The Setup Event log will show these entries every few min as if Windows/DISM is attempting to enable Sysmon, then Windows detects an issue and so it disables it. Then the cycle repeats indefinitely.

A few observations:

• We are using Win11 24H2.
• I have noticed this on multiple endpoints.
• We never had Sysmon installed on our endpoints prior to MS including it so there is no conflict with the standalone version.
• We are not using a customized WIM in our PC imaging solution.
• I imaged a PC with the March 2026 CU included in the WIM and there were no errors in the System event log. After it patched with the LCU that was available at the time, the errors started appearing.
• I have grabbed the latest Win11 ISO from the 365 Admin Center (updated Aug 2026) and imaged a PC with it. Again, no Sysmon errors were found in the System Event log. After it patched with the Sept 2026 CU, the errors started appearing.
• When the errors occur, the Sysmon Windows service is missing from the system. When the errors are not occurring, the Sysmon service is present and running.
• I attempted to remove Sysmon by unselecting it from Windows Features within Programs and Features and rebooted. Despite this, the errors continue to appear.
• The immediate impact is when booting, Windows may show it is configuring Windows Features prior to Windows loading. This may report there was a failure, and then is rolled back.

Has anyone experienced these issue or have any advice on how to troubleshoot further? Any suggestions are welcome.

Thanks