System Guard Runtime Monitor Agent (SgrmAgent) Service Defaults in Windows 11

System Guard Runtime Monitor Agent Driver.

Default Settings

Startup type:

Windows 11 Home 21H2	Boot
Windows 11 Pro 21H2	Boot
Windows 11 Education 21H2	Boot
Windows 11 Enterprise 21H2	Boot
Windows 11 Home 22H2	Boot
Windows 11 Pro 22H2	Boot
Windows 11 Education 22H2	Boot
Windows 11 Enterprise 22H2	Boot
Windows 11 Home 23H2	Disabled
Windows 11 Pro 23H2	Disabled
Windows 11 Education 23H2	Disabled
Windows 11 Enterprise 23H2	Disabled
Windows 11 Home 24H2	Disabled
Windows 11 Pro 24H2	Disabled
Windows 11 Education 24H2	Disabled
Windows 11 Enterprise 24H2	Disabled

Display name:

System Guard Runtime Monitor Agent

Service name:

SgrmAgent

Service type:

kernel

Error control:

normal

Path:

%SystemRoot%\system32\drivers\SgrmAgent.sys

Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SgrmAgent

Default Behavior

System Guard Runtime Monitor Agent is a kernel driver. It starts by the operating system Boot Loader before the Kernel initialization, as a part of the driver stack in all editions of Windows 11 21H2, Windows 11 22H2. This service is disabled in all editions of Windows 11 23H2, Windows 11 24H2.

If System Guard Runtime Monitor Agent fails to start, the failure details will be recorded into Event Log. Then Windows 11 should boot up and notify the user about the SgrmAgent service startup failure.

Restore Default Startup Configuration of System Guard Runtime Monitor Agent

1. Run the Command Prompt as an administrator.

2. Depending on the version of your operating system, copy the commands below, paste them into the command window and press ENTER.

For Windows 11 21H2 Home, Windows 11 21H2 Pro, Windows 11 21H2 Education, Windows 11 21H2 Enterprise, Windows 11 22H2 Home, Windows 11 22H2 Pro, Windows 11 22H2 Education, Windows 11 22H2 Enterprise:
sc config SgrmAgent start= boot
sc start SgrmAgent

For Windows 11 23H2 Home, Windows 11 23H2 Pro, Windows 11 23H2 Education, Windows 11 23H2 Enterprise, Windows 11 24H2 Home, Windows 11 24H2 Pro, Windows 11 24H2 Education, Windows 11 24H2 Enterprise:
sc stop SgrmAgent
sc config SgrmAgent start= disabled

3. Close the command window and restart the computer.

The SgrmAgent service is using the SgrmAgent.sys file that is located in the C:\Windows\system32\drivers directory. If the file is removed or corrupted, read this article to restore its original version from Windows 11 installation media.