We recently deployed sysmon64 across our domain via group policy. We ran into issues where windows xp clients were no longer able to access file shares on newer windows file servers (2012r2/2016/2019) after sysmon 64 was installed on said file servers.
The windows XP clients run proprietary manufacturing equipment we cannot upgrade.
When running netstat on the file servers, we noticed that ONLY win xp clients would open a connection to file server on 445 and then after a few minutes that connection would go into CLOSE_WAIT status and win xp client would open another connection on 445 and then it would repeat until the file server was rebooted.
Newer versions of Windows clients did not have this issue; only Win XP.
We eventually determined that it had something to do with sysmondrv service. Once we forcefully stopped the sysmondrv service and uninstalled sysmon64 from the file servers; the issue went away.
NOTE: sysmon 32-bit or 64-bit was NEVER installed on any of the Win XP clients, only the file servers.
Our security team wants to redeploy sysmon64; but we need to understand why this issue occurred and how to prevent it first as it did affect or production manufacturing lines.
Our security team wants
