I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests.

Sysmon appears to be capturing all other Event ID's except for 22. I have installed this on a 2012 box with the same .xml configuration file and 22 is being happily logged.

Has anyone else noticed the same on a Windows 2008 box?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.