Thank you so much! this is actually solve the issue, i though it could be permissions issue with the virtual account and tried even domain admin but nothing was change. with local admin user running the service it's start working. Edit: it is actually work but not through the sysmon app so i am getting pretty ugly format of sysmon. will keep investigate it. thank you again ... View more