Make the script working

[super0xbad1dea]

The Domain check with wmic doesn't work, because whitespaces are also included, which breaks the path to your Sysvol. So set your domain in the script manually. Search for the term <YOUR_DOMAIN>.
SET SYSMONDIR was changed to C:\Windows. No specific reason, but when you install Sysmon manually from a folder outside C:\Windows, it will install itself to C:\Windows.
If you don't use C:\Windows, it will check if the new Sysmon folder exists.

:installsysmon
I've added additional hashes as installation parameter, but depending on your Sysmon config will this be overwritten.

:checkversion
If Sysmon was installed manually and not with the script, sigcheck64 may be missing. Added an additional check if it exists.

:updateconfig
If Sysmon was installed manually and not with the script, sigcheck64 may be missing. Added an additional check if it exists.
Also added a hash comparison of the Sysmon configs. The old way with set /p variable=<file didn't work, because it only reads the first line, which is everytime the path of the file and so, in the end, this check will never work, because file pathes are only compared.

:uninstallsysmon
Added chdir to the Sysmon path.

[shane-m1]

Thanks for your time. We'll take a look at the changes in a day or two, after testing the changes. At the moment we're likely keep the hash types as-is, because we need to compare against common threat intel feeds and check we're getting the right hash types.

[shane-m1]

Closing as we cherry picked the changes and merged earlier.