Questions tagged [sysinternals]

Usually refers to applications from the Sysinternals Suite (eg. Process Explorer, Process Monitor, RAMMap, ...)

Filter by
Sorted by
Tagged with
1
vote
0answers
59 views

In Process Monitor, is it possible to see what data is written/read per entry?

In Process Monitor, is it possible see what data is being read/written to a particular item, be it a file or registry? For example, if a program added "platform=x64" to settings.ini somewhere, Process ...
0
votes
2answers
73 views

In the output of SysInternals Handle.exe what does RWD stand for?

I'm using handle.exe from SysInternals to grab information about open handles. Running just handle.exe -p cmd to get the handles for cmd.exe, I get the following output. Other output is similar, just ...
0
votes
0answers
20 views

DefaultPassword registry key not present after enabling autologon with sysinternals autologon

I'm trying to enable Autologon using SystInternals "Autologon" program. After entering Username , Domain and Password I got the message "Autologon successfully enabled". But the registry doesn't ...
1
vote
3answers
729 views

PsExec treats second remote computer in list as a program name

PsExec behaves very strangely when run on a specific server When I use PsExec to run a program on multiple remote machines in most cases, it works perfectly fine. When I run the same command on one ...
0
votes
0answers
75 views

Autoruns: Showing bogus dates in 'TimeStamp' column

My copy of Autoruns is showing some very strange dates in the Timestamp column. Dates as far back as 1915, with some in 1947 and several showing 2/24/1929. Could anyone explain what they think the ...
2
votes
1answer
105 views

Where does chocolatey install sysinternals?

Chocolatey has a nice sysinternals package, but where does it install to? (by default) https://chocolatey.org/packages/sysinternals
1
vote
0answers
142 views

How to change “Volume Serial Number” in Windows docker image?

I am trying to change the "Volume Serial Number" of a docker image with Sysinternals VolumeId but I'm getting Error reading drive: The request is not supported. when I run Volumeid64.exe C: 1AAA-111A -...
1
vote
1answer
154 views

System Internals procexp64 wont restore Task Manager

Prior versions of Process Explorer would allow you to toggle on/off the Replace with Task Manager option. However the current version seems not to toggle so well. After turning it on I can no longer ...
12
votes
1answer
6k views

Restore the original task manager after replacing it with the Sysinternals process explorer

After replacing the default Windows task manager with Sysinternals’ process explorer via the Options → Replace task manager menu, how do you undo that action, i.e. restore the original task manager? I’...
0
votes
1answer
359 views

Why do programs start working when I open Process Monitor?

I have a script I wrote that creates and writes to a file every 20 or 30 seconds and it has been doing that fine for the past 15 years or so on 5 versions of Windows, but I installed the outstanding ...
3
votes
1answer
579 views

How can I run SysInternals ProcMon (or equivalent) inside a docker Windows container?

I'm trying to diagnose an issue where a complicated process does not run inside of my Windows Core container. I really need to figure out why it is failing. If this was a VM, I would just pop up the ...
5
votes
2answers
6k views

Errors starting PsExec to run a program as a local service

When I run the following command from an Administrative Command Prompt: psexec64 -i -u "nt authority\network service" C:\Windows\System32\cmd.exe I'm getting these error messages: Couldn't install ...
2
votes
1answer
252 views

“I/O write” or “Disk write” affects the SSD?

I like to find out which program using mostly my SSD. I'm using Process Hacker (in elevated mode) to get an overview of my SSD usage and find the programs whose using it mostly. To test the ...
0
votes
0answers
515 views

Process Explorer: Process Disk: Read/Write bytes not working?

I like to find out which program using mostly my SSD. On Windows 7 x64 machine in Process Explorer (opened as Administrator) double clicking on a process opens up the details of it. On the Disk and ...
0
votes
0answers
2k views

Extremely high modified memory usage and pages won't flush

My Lenovo Y50-70 machine suffers of extremely poor performance lately. I'm disturbed by some memory-related issues. The machine has 8gb RAM and the pagefile size is currently 24gb ("Autmomatically ...
0
votes
1answer
324 views

Running Process Monitor causes application to work

This is a longshot, but perhaps someone with knowledge of the internal workings of Sysinternal's Process Monitor may have an idea. Recently we've had a very murky problem at work. We have a software (...
0
votes
1answer
268 views

Why does running a specific command remotely over SSH fail?

I am creating two Bash scripts on my Raspberry Pi, which is running the default Debian-based Linux distro: one to sleep my desktop computer, and one to shut it down. The script to shutdown the ...
2
votes
1answer
229 views

What is the most practical way of finding out which certificate is the problematic one?

I've been using wsusoffline for quite sometime, but recently, I've had this problem. The program downloads an update but then immediately deletes it producing the following warning in the log: ...
1
vote
0answers
457 views

PSEXEC OpenSCManager fails when execute command for workgroup from domain

I am trying to run sysinternals' PSEXEC from my domain machine to workgroup machine and vice versa: Cmd Line: Psexec \\\MachineName -u "username" -p "password" -i -s -d cmd.exe If I run this ...
2
votes
0answers
109 views

PsGetSID shows two usernames and one SID

We changed the logon name of a person in AD from 'name1' to 'name2'. We had problems with some sql boxes picking up the old 'name2' and using it to authenticate so in tracking down why I ran: ...
6
votes
2answers
4k views

PsExec requirements on local computer

What services and settings are required to run psexec on local computer? (e.g. psexec -s -i -d regedit)
3
votes
1answer
2k views

Windows10 - DBGView-Sysinternals outputs from various Windows-Tasks

I´ve got a Laptop (HP ProBook 4720s) with Windows 10 running. For work we use DBGView from sysinternals too catch outputs from our self writen programs in order too find hard to find errors / bugs ...
0
votes
1answer
367 views

DEP: Sysinternals Process Explorer != static analysis != BinScope

I have an executable running ("heidisql.exe"). The Sysinternals Process Explorer shows "DEP (permanent)" in the column DEP. I checked the binary statically (among other things using pestudio). The ...
0
votes
1answer
770 views

Which processes are accessing CD/DVD drive?

I'm trying to install StarCraft 1 on my Windows 7 machine, but it's taking forever and it sounds like the DVD drive is thrashing. Is there any way to see which processes are reading from the DVD drive?...
0
votes
1answer
151 views

“Strings” utility including linefeed (LF) and carrier return (CR)

I want to filter a large file (a raw partition image) for strings (an accidentally deleted text file). The normal "strings" utility (Linux GNU strings or Windows sysinternals strings) does not count ...
0
votes
1answer
200 views

Huge number of strange entries reported by SysInternals' autoruns on my Win7 Ultimate pc

I have been searching for an answer to this for about a month, but without success: A Huge number of strange entries are reported by SysInternals' autoruns utility when I run it on my Windows 7 ...
0
votes
1answer
415 views

Running command on remote windows server and add results to a text file

I am trying to find the installed version of a piece of software on a lot of servers (800+). The command is: "dsmqver -f 2" which returns output like "Version: 7.5.0.2" I have been trying to ...
6
votes
1answer
16k views

What does “I/O Reads or Writes” and “I/O Read Bytes or Write Bytes” mean?

In Task Manager (and Sysinternals' Process Explorer) there are columns called "I/O Reads", "I/O Writes", "I/O Read Bytes" and "I/O Write Bytes". So what do these counters mean exactly? What else, ...
1
vote
1answer
642 views

Is there a GUI or context menu for Windows Explorer for PsFile?

PsFile is a great tool for closing network files that have been held open for some reason on another machine. This happens a lot with Office files, often because the user just left the file open and ...
1
vote
1answer
1k views

Run a scheduled task that can update the desktop background wallpaper without causing a foreground flash?

I like how certain Windows themes rotate through various images, but I also like to use BgInfo to write out various machine info to the desktop wallpaper image. I created a customized BGI file and ...
2
votes
1answer
2k views

Portmon - Portmsys.sys not found

I've been wrestling with Sysinternals' Portmon utility and am trying to get it working under Windows 8.1 64-bit. Initially it would not start - it gave "Error 2" and exited, as detailed in this Stack&...
0
votes
1answer
217 views

Can I use PsExec or similar tool to determine if a remote PC is already logged in?

I'm writing a utility which lets you remotely run a test application on network PCs. I plan to use PsExec to remotely launch the application on each PC but I need to check The PC is reachable The PC ...
8
votes
4answers
4k views

TrueCrypt dismount on Windows 8.1 keeps prompting: “volume contains files or folders being used by applications or system”

I have a volume mounted by TrueCrypt. All works fine, except when I try to dismount it (after verifying I don't have any application or explorer using anything in it). Every time I click the Dismount ...
7
votes
1answer
42k views

Could not start PSEXESVC service on [MachineName]: Access is denied

I'm trying to use PsExec to start a process on a remote machine. I posted this question on SO, but I realized it's probably better suited here. I also have spent a few hours trying to figure this out, ...
11
votes
1answer
5k views

SysInternals Desktops not launching Chrome

I'm using Desktops from SysInternals on Windows 8 and experiencing a problem launching Chrome. Even if I go to the exe of Chrome it will not launch in anything but the first Desktop. Does anyone know ...
0
votes
1answer
1k views

Why is high repurposed standby memory a sign of memory pressure?

I've been watching an older episode of defrag tools, where Andrew Richards explains RAMMap (http://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-6-RAMMap) At 24:45 he mentions that repurposing ...
3
votes
0answers
817 views

“Access is denied” to Admin when using Sysinternals Contig to defrag the $LogFile metadata file

I have folders with hundreds of thousands, to over a million files and subfolders in each parent. I'm reading that the NTFS log file may be responsible for slow file creation and other actions. How ...
0
votes
0answers
83 views

Strings.exe does not see Cyrillic

Sysinternals utility Strings.exe does not see Cyrillic strings despite the fact that it works with Unicode. Does exist any utilities or libraries that really can extract all printable Unicode strings ...
0
votes
2answers
813 views

capture output of runas command cross domain

I want to run the sysinternals tool psloglist to get the event log of a server that is on another domain. If I run runas /netonly /user:DOMAIN2\USER psloglist \\TARGETSERVER Then a new command ...
4
votes
4answers
4k views

Defrag NTFS $LogFile

I have the super descriptive "my computer is slow" issue. In resource manager I notice that c:\$LogFile access times are continuously around 800 ms, and I suspect this is causing much of the slowdown. ...
0
votes
0answers
57 views

How may I suppress the pslist (un)welcome lines?

How may I suppress the pslist (un)welcome text lines seen here? 2>NUL need not apply, since I want error output not suppressed.
2
votes
2answers
870 views

Sysinternals - Streams access is denied error

I am using streams.exe to remove blocking of game by Windows but it is showing me "Access is denied" error although I am running the command with administrator. Article (that one I am following) : ...
27
votes
2answers
23k views

MKLINK vs. Junction.exe

SysInternals has a program junction.exe that creates Junctions (aka. reparse points, aka. symlinks) in Windows. However, Windows also comes with a mklink which seems to do the same thing. Is there a ...
1
vote
1answer
315 views

in ProcessExplorer what is the difference between remote address = 127.0.0.1:0 and *:*?

In Process Explorer when I select a process click on "TCP/IP" tab it shows 5 columns: Protocol, Local Address, Remote Address, State, Service. Under Remote Address, I often see entries such as 127.0.0....
1
vote
0answers
874 views

Windows sessions: Process Explorer vs. Logonsessions.exe

In researching a problem with an API call that is limited to particular sessions, I found some information that implied when you use runas to create a process as another user, a new security token is ...
3
votes
2answers
893 views

Changing colors of Process Explorer

I want to make my Process Explorer dark. I managed to change all colors except these very bright columns: How can I change these bright colors to something dark?
21
votes
4answers
3k views

What does the path '\REGISTRY\A\…' in Sysinternals Procmon log mean?

I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to the registry hives ...
4
votes
1answer
2k views

Internet Explorer 10 doesn't seem to work with Sysinternals Desktops

I heavily use Sysinternals Desktops version 2 to manage multiple desktops. In the past, I used Internet Explorer 9 as this was the only web browser I found that could function across multiple ...
6
votes
1answer
396 views

Is there a way to reset the toolbar minigraphs in Process Explorer?

Windows Sysinternals Process Explorer includes in its toolbar some minigraphs showing recent usage history for CPU, Memory, and so on: These are nice. However, an inadvertent click on the 'thumb' of ...
0
votes
2answers
518 views

How can I determine which operations or processes prevent screen saver and sleep mode

My desktop will not enter sleep mode or fire up the screen saver. To troubleshoot, I have run procmon and procexp from sysinternals in order to determine if some event is making the system think it ...