Troubleshooting with the Windows Sysinternals Tools

Use Process Explorer to display detailed process and system information

Use Process Monitor to capture low-level system events, and quickly filter the output to narrow down root causes

List, categorize, and manage software that starts when you start or sign in to your computer, or when you run Microsoft Office or Internet Explorer

Verify digital signatures of files, of running programs, and of the modules loaded in those programs

Use Autoruns, Process Explorer, Sigcheck, and Process Monitor features that can identify and clean malware infestations

Inspect permissions on files, keys, services, shares, and other objects

Use Sysmon to monitor security-relevant events across your network

Generate memory dumps when a process meets specified criteria

Execute processes remotely, and close files that were opened remotely

Manage Active Directory objects and trace LDAP API calls

Capture detailed data about processors, memory, and clocks

Troubleshoot unbootable devices, file-in-use errors, unexplained communication, and many other problems

Understand Windows core concepts that aren’t well-documented elsewhere