diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index aea60701fda..162e9e49b6c 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -34,6 +34,8 @@ https://github.com/elastic/beats/compare/1035569addc4a3b29ffa14f8a08c27c1ace16ef
 
 *Auditbeat*
 
+- Enable System module config on Windows. {pull}10237[10237]
+
 *Filebeat*
 
 - Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211]
diff --git a/x-pack/auditbeat/module/system/_meta/config.yml.tmpl b/x-pack/auditbeat/module/system/_meta/config.yml.tmpl
index e92cfd2a555..f06f53cab3e 100644
--- a/x-pack/auditbeat/module/system/_meta/config.yml.tmpl
+++ b/x-pack/auditbeat/module/system/_meta/config.yml.tmpl
@@ -1,4 +1,3 @@
-{{ if ne .GOOS "windows" -}}
 {{ if .Reference -}}
 # The system module collects security related information about a host.
 # All datasets send both periodic state information (e.g. all currently
@@ -25,8 +24,10 @@
   # The state.period can be overridden for any dataset.
   # host.state.period: 12h
   # process.state.period: 12h
+  {{ if eq .GOOS "linux" -}}
   # socket.state.period: 12h
   # user.state.period: 12h
+  {{- end }}
 {{ end }}
   {{ if eq .GOOS "linux" -}}
   # Enabled by default. Auditbeat will read password fields in
@@ -34,8 +35,3 @@
   # detect any changes.
   user.detect_password_changes: true
   {{- end }}
-  {{- if false -}}
-  {{/* Only remaining use in packages, to be removed completely. */}}
-  report_changes: true
-  {{- end -}}
-{{- end }}