Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

learn more… | top users | synonyms

-1
votes
0answers
22 views

How to find all files and registry entries associated with a certain installed program?

I am trying to create a program that let me choose any installed application from the local PC and give me a list of all program's files and registry entries. In other words, I am trying to simulate ...
1
vote
1answer
49 views

How can I use Process Monitor to detect register changes made by GPEdit modifications?

It is supposed that Process Monitor can capture the registry changes made by any program. This thread explains it fine (thanks you, James T). But it seems things are not so easy when talking about ...
0
votes
1answer
83 views

Windows 8 - Logging Process Monitor/Explorer to Diagnose BSOD Cause

I recently started experiencing BSODs every time I allow my computer to go idle. The specific Bug Check error codes I'm receiving (0x139 with parameter 1 = 3) are, according to this Microsoft support ...
0
votes
1answer
28 views

Are filtered events in Process Monitor stored in memory or on disk?

When filtering events in Process Monitor, does it store the filtered events in memory or on disk, or does it just give you a filtered count? The reason I'm asking is, we're trying to figure out what ...
0
votes
0answers
20 views

How can I get a list of processes that were run and exited on Windows?

On occasion, a command-line window appears then instantly vanishes. I'm sure it is some scheduled task, or something that the company IT department runs periodically. How can I determine what this ...
0
votes
0answers
113 views

Troubleshooting Land Attack - Process monitor

I'm trying to find the real issue behind our Cisco ASA firewall log: Deny IP due to Land Attack from WAN_Web to WAN_Web. We're getting them every 5 or 10 min, so it will be nice to get rid of them. ...
1
vote
1answer
110 views

Process Monitor not showing stack for network events

I'm trying to trace down some network activity from a process, running under Windows XP. I see the network events in question, but when I go to look at the stack for that even (on the Stack tab), it ...
9
votes
3answers
29k views

Why is my disk at 99% usage here?

I have a similar issue as this user. You can pretty much take his screen shot and apply it to my issue: Windows 8.1, 99% disk usage or in that vicinity for a longer period of time (minutes). Yet the ...
0
votes
1answer
476 views

Changing default behavior of a Keyboard Multimedia Keys

Today I've got a Dell KB522 keyboard, which has 7 multimedia keys on top. I was wondering if it's possible to change the behaviour of those keys due to the lack of official Dell app to do that (for ...
2
votes
1answer
553 views

Process Monitor capture filter (or scripting)

As you know, Microsoft distributes the Russinovich extremely powerful process monitor. It captures a lot of system events and has a filter to show only some of them. I want to record a rare fault at ...
3
votes
2answers
453 views

identify which process is outputting sound

My computer periodically makes a random ding (among other sounds), and I can't figure out the source. Suggestions on SU include using bar indicators in the volume mixer to look for the source. ...
3
votes
1answer
5k views

Root cause for high CPU usage; which measurement to trust more: Windows Task Manager or Process Explorer?

Consider this Windows 8.1 machine (in-place upgrade from Windows 8) with differing reports on its CPU usage. The machine is idle, and has been for 3 days. There are no CPU intensive tasks running ...
0
votes
1answer
545 views

Can windows search indexer prevent file from deleting?

I know that when windows processes open files for reading, they lock them. How does Windows indexer do that? Can it prevent the file from being deleted in addition to slowing everything down? Can my ...
0
votes
1answer
57 views

Which process - in windows - changes system settings

I'm currently writing a program that changes certain system settings. For most of those settings, I was able to find information on registry keys on the internet. For others, however, I wasn't able to ...
0
votes
0answers
185 views

File access from client Windows Server 2012 works with procmon enabled, otherwise doesn't

Windows Server 2012, running Terminal Services has a client application installed. The server part is located on another Windows Server 2012. The client application is an old one, based on dBase. ...
0
votes
2answers
195 views

How can I determine which operations or processes prevent screen saver and sleep mode

My desktop will not enter sleep mode or fire up the screen saver. To troubleshoot, I have run procmon and procexp from sysinternals in order to determine if some event is making the system think it ...
3
votes
1answer
221 views

explorer.exe randomly hogging my CPU; any insight into this ProcessMonitor log?

My computer occasionally becomes terribly unresponsive. Opening Process Explorer reveals that it's explorer.exe hogging 100% of the CPU. I poked around until I found the thread id which was doing ...
0
votes
2answers
55 views

Start ProcessMonitor will unexpectedly execute another irrelevant exe

Well, I have encountered a weird problem recently. Whenever I try to start ProcessMonitor, another irrelevant program (an IM software indeed) starts instead. In the end, the only way I start ...
5
votes
4answers
9k views

Process Monitor fails to load

I am trying to load Process Monitor (Procmon.exe) from Sysinternals, and I get the following error on startup. Unable to load Process Monitor device driver In the Event Viewer, I get the ...