System Monitor

Winsage
March 11, 2026
Microsoft has released the March 2026 Patch Tuesday update, KB5079473, for all supported versions of Windows 11 (25H2 and 24H2). Key changes include: - A Network Speed Test Tool in the Taskbar for measuring Ethernet, Wi-Fi, and cellular performance. - New pan and tilt options for supported cameras in the Settings menu. - Built-in System Monitor (Sysmon) available as an optional feature; users should uninstall previous versions before enabling it. - Remote Server Administration Tools (RSAT) support for Windows 11 Arm64 devices. - Quick Machine Recovery tool enabled for Windows Professional devices not domain-joined or enrolled in enterprise management. - Ability to use .webp image files for desktop backgrounds. - Introduction of new emojis from Emoji 16.0, including a face with bags under the eyes and a fingerprint. - BitLocker improvements for device responsiveness after entering a recovery key. - Enhanced reliability of search functions in File Explorer. Additionally, Microsoft is publishing patch notes for the upcoming version 26H1, which is currently available to Windows Insiders on the Canary Channel but not yet public. The KB5079466 patch for version 26H1 includes features already seen in earlier Windows 11 versions.
Winsage
February 26, 2026
Microsoft has released a non-security feature preview update for Windows 11, designated as version KB5077241, which introduces performance and visual enhancements. This optional update is available for all Windows 11 users and is not yet part of the stable channel, with a full release expected on March 10. Key features of the update include: 1. A built-in network speed test accessible via the taskbar, allowing users to evaluate their network connection's performance. 2. Improvements to the taskbar search function, enabling result previews without opening additional windows. 3. Minor system upgrades, including backup and restore options for select Windows Professional devices, new emojis, an updated accounts menu, a built-in system monitor, and a revamped widgets settings menu. 4. Enhancements to printing services, nearby sharing features, and Windows Update, along with new camera settings for supported devices. 5. Performance improvements in File Explorer, including more reliable window opening using shortcuts and the introduction of an "Extract All" option for non-ZIP archived folders. 6. Optimizations in the Network page of File Explorer for better device display and improvements in display responsiveness after sleep.
Winsage
February 25, 2026
Microsoft has released optional February updates for Windows 11 versions 25H2 and 24H2, which include several enhancements: - A network speed test tool accessible from the taskbar for measuring Ethernet, Wi-Fi, and cellular connections. - Enhanced camera settings with new pan and tilt options for supported cameras. - A built-in version of the System Monitor (Sysmon) tool, available as an optional feature. - Improvements to Remote Server Administration Tools (RSAT) for Windows 11 Arm64 devices. - A new automatic recovery tool for Windows 11 Professional devices not domain-joined. - Support for .webp images as desktop backgrounds. - Introduction of new emojis in the Emoji 16.0 release. - BitLocker improvements to prevent devices from becoming unresponsive after entering a recovery key. Additionally, Microsoft has shared release notes for an upcoming optional update for Windows 11 version 26H1, which is currently only available to Insiders on the Canary Channel and is expected to debut on new devices with advanced silicon.
Winsage
November 19, 2025
Microsoft will integrate native System Monitor (Sysmon) functionality into Windows 11 and Windows Server 2025, enhancing security operations for IT teams. This integration will provide instant threat visibility, automate compliance through Windows Update, and include features such as process monitoring, network connection tracking, credential access detection, file system monitoring, process tampering detection, WMI persistence tracking, and custom configuration support. It will also offer official customer service support and allow seamless access to events through Windows Event Logs or Security Information and Event Management (SIEM) systems. Administrators can enable Sysmon using the command "sysmon -i." Future plans include expanding Sysmon’s capabilities with enterprise-scale management and AI-powered detection.
Winsage
November 19, 2025
Microsoft will integrate its forensic tool, System Monitor (Sysmon), into the Windows kernel with the upcoming releases of Windows 11 and Server 2025. This integration will transform Sysmon from a standalone utility into a native “Optional Feature” that will be serviced automatically through Windows Update. Administrators will no longer need to manually distribute Sysmon; instead, it can be activated through the “Turn Windows features on or off” dialog or command-line instructions. The integration will ensure that updates flow through the standard Windows Update pipeline, providing official support and Service Level Agreements (SLAs) for Sysmon. Microsoft plans to utilize local computing capabilities for AI inferencing to enhance security measures, focusing on detecting credential theft and lateral movement patterns. Sysmon will maintain backward compatibility with existing workflows, allowing the use of custom configuration files and adhering to the XML schema while continuing to log events to the Windows event log. Community-driven configuration repositories will remain operational, preserving established community knowledge.
Winsage
November 18, 2025
Microsoft is integrating Sysmon into Windows 11 and Windows Server 2025, eliminating the need for separate deployments of Sysinternals tools. This integration will allow users to utilize custom configuration files for filtering captured events, which will be logged in the Windows event log. Sysmon is a free tool that monitors and blocks suspicious activities while logging events such as process creation, DNS queries, and executable file creation. It will be easily installable via the "Optional features" settings in Windows 11, with updates delivered through Windows Update. Sysmon will retain its standard features, including support for custom configuration files and advanced event filtering. Key events logged by Sysmon include process creation, network connections, process access, file creation, process tampering, and WMI events. Comprehensive documentation and new enterprise management features will be released next year.
Search