Deploying Sysmon through Group Policy (GPO)

Here’s a way to deploy Sysmon to all of your domain endpoints using Group Policy.

Step1: Create sysmon install batch file

First create a batch file that will be placed on the root domain folder that is accessible to each domain client.

Here’s the batch file:

save as Sysmon_install.bat 

What does it do?

The script will copy the sysmon configuration file (config.xml) file to “C:\Windows\” and then if sysmon isn’t running, it will install it using that configuration that we copied.

Step 2: Create a folder on your domain that will be replicated with other domain controllers (in my example: apps), and copy the following:

Now that you have the prerequisites, let’s move on.

Step 3: Creating a Start-up script

Launch your group policy utility and perform the following:

Right click your domain OU and

  1.  Create GPO in this domain, and link it here
  2. Provide a name (Sysmon Deployment) , hit OK
  3. Right click your newly created GPO Sysmon Deployment and select Edit
  4. Navigate to Computer configuration > Policies > Windows Settings > Scripts > Startup
  5. Click on Startup and Add and browse to your script location \\domain.com\apps\Sysmon_Install.bat and finalize with OK
  6. Right click your newly created GPO and ensure that it’s enabled and enforced (if necessary)

This is it!

The Startup script will run as SYSTEM which should take care of the admin requirements for Sysmon.

Suggestions:
Create a test OU  and move a limited amount of  endpoints there to get started. Assuming that you already have a log collector, review the type of logs you are receiving and modify your configuration file to include/exclude certain logs so it won’t be overwhelming.

A challenge I came across was updating the configuration file across endpoints. If you were to update your configuration file, the change will only happen once the endpoint refreshes their group policy (defualt is 90 min) or longer at times.

The original configuration provided will initially install and configure sysmon; however, if you continue making changes to the configuration, here’s a modified script that will automatically overwrite the configuration.

 

If you have any questions feel free to send me a message on Twitter @Pablis2010 where I’ll answer quicker.

Leave a Reply