Sysmon -u vs -u force

Question

Is there any documentation on the precise difference between these two? I've done Regshots and haven't noticed any difference, but the uninstall has never "failed".

Answer 1

this would be your best bet for documentation
https://github.com/trustedsec/SysmonCommunityGuide/blob/master/install-and-configuration.md#uninstall

with a quick glance, looks like registry and file write or delete operations are the same, from the perspective of procmon, following sysmon -u and -u force actions.