System Guard Runtime Monitor Broker (SgrmBroker) Service Defaults in Windows 11

Monitors and attests to the integrity of the Windows platform.

Default Settings

Startup type:

Windows 11 Home 21H2	Automatic
Windows 11 Pro 21H2	Automatic
Windows 11 Education 21H2	Automatic
Windows 11 Enterprise 21H2	Automatic
Windows 11 Home 22H2	Automatic
Windows 11 Pro 22H2	Automatic
Windows 11 Education 22H2	Automatic
Windows 11 Enterprise 22H2	Automatic
Windows 11 Home 23H2	Disabled
Windows 11 Pro 23H2	Disabled
Windows 11 Education 23H2	Disabled
Windows 11 Enterprise 23H2	Disabled
Windows 11 Home 24H2	Disabled
Windows 11 Pro 24H2	Disabled
Windows 11 Education 24H2	Disabled
Windows 11 Enterprise 24H2	Disabled

Display name:

System Guard Runtime Monitor Broker

Service name:

SgrmBroker

Service type:

own

Error control:

normal

Object:

LocalSystem

Path:

%SystemRoot%\system32\Sgrm\SgrmBroker.exe

Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SgrmBroker

Privileges:

SeImpersonatePrivilege

Default Behavior

System Guard Runtime Monitor Broker is a Win32 service. It starts automatically during the operating system startup in all editions of Windows 11 21H2, Windows 11 22H2. This service is disabled in all editions of Windows 11 23H2, Windows 11 24H2.

When the System Guard Runtime Monitor Broker service is started, it logs on as LocalSystem and running in its own process of SgrmBroker.exe. If System Guard Runtime Monitor Broker fails to start, the failure details will be recorded into Event Log. Then Windows 11 should boot up and notify the user about the SgrmBroker service startup failure.

Dependencies

System Guard Runtime Monitor Broker cannot be started, if the Remote Procedure Call (RPC) service won't start.

Restore Default Startup Configuration of System Guard Runtime Monitor Broker

Before you begin doing this, make sure that all the services on which System Guard Runtime Monitor Broker depends are configured by default and function properly. See the list of dependencies above.

1. Run the Command Prompt as an administrator.

2. Depending on the version of your operating system, copy the commands below, paste them into the command window and press ENTER.

For Windows 11 21H2 Home, Windows 11 21H2 Pro, Windows 11 21H2 Education, Windows 11 21H2 Enterprise, Windows 11 22H2 Home, Windows 11 22H2 Pro, Windows 11 22H2 Education, Windows 11 22H2 Enterprise:
sc config SgrmBroker start= auto
sc start SgrmBroker

For Windows 11 23H2 Home, Windows 11 23H2 Pro, Windows 11 23H2 Education, Windows 11 23H2 Enterprise, Windows 11 24H2 Home, Windows 11 24H2 Pro, Windows 11 24H2 Education, Windows 11 24H2 Enterprise:
sc stop SgrmBroker
sc config SgrmBroker start= disabled

3. Close the command window and restart the computer.

The SgrmBroker service is using the SgrmBroker.exe file that is located in the C:\Windows\system32\Sgrm directory. If the file is removed or corrupted, read this article to restore its original version from Windows 11 installation media.