Sysinternals

The Sysinternals web site was created in 1996 by Mark Russinovich to host his advanced system utilities and technical information. Whether you’re an IT Pro or a developer, you’ll find Sysinternals utilities to help you manage, troubleshoot and diagnose your Windows and Linux systems and applications.

• Read the official guide to the Sysinternals tools, Troubleshooting with the Windows Sysinternals Tools
• Read the Sysinternals Blog for a detailed change feed of tool updates
• Watch Mark's Sysinternals Update videos on YouTube
• Watch Mark’s top-rated Case-of-the-Unexplained troubleshooting presentations and other webcasts
• Read Mark’s Blog which highlight use of the tools to solve real problems
• Check out the Sysinternals Learning Resources page
• Post your questions in the Sysinternals Forum

---

Sysinternals Live

Sysinternals Live is a service that enables you to run Sysinternals tools directly from the Web without manually downloading them.

Enter a tool's Sysinternals Live path in Windows Explorer as live.sysinternals.com/<toolname> or \\live.sysinternals.com\tools\<toolname>. In a command prompt use \\live.sysinternals.com\tools\<toolname>.

You can view the entire Sysinternals Live tools directory in a browser or Windows Explorer at https://live.sysinternals.com/.

What's New

What's New (March 26, 2026)

• listent 1.0 for macOS
  listent is a macOS command-line tool to discover and list code signing entitlements for executable binaries. It supports static scanning, real-time process monitoring, and background daemon operation.

• ZoomIt v11.0
  This update to ZoomIt, a screen magnification and annotation tool, adds panorama / scrolling screenshots support, text extraction during snip, break timer improvements, and enables the trimming clip editor for existing .mp4 files.

• Sysmon v15.2
  This update to Sysmon, an advanced host security monitoring tool, improves the handling of the internal events queue, making the service more resilient to dropped events on high system load.

• DebugView v5.0
  This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, improves Windows 11 support and offers a modern UI with a dark theme, and includes performance optimizations.

• NotMyFault v4.40
  This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds secure kernel and hypervisor crash triggers.

What's New (February 4, 2026)

• ZoomIt v10.0
  This update to ZoomIt, a screen magnification and annotation tool, adds a video clip editor for trimming recordings before saving them and supports recordings with system sounds.

• Sysmon 1.5 for Linux
  This update to Sysmon for Linux, a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more, adds EbpfEvent for monitoring Linux EBPF program loading.

What's New (December 16, 2025)

• Coreinfo v4.0
  This update to Coreinfo, a tool that reports processor, socket, NUMA memory, and cache topology of a system, as well as processor features supported, now includes a GUI version and adds checks for features present in modern CPUs.

What's New (November 11, 2025)

• ZoomIt v9.20
  This update to ZoomIt, a screen magnification and annotation tool, can now save screen recordings as either MP4 or GIF.

What's New (October 13, 2025)

• ZoomIt v9.10
  ZoomIt, a screen zooming, recording and annotation utility, adds image smoothing for higher-quality visuals.

What's New (September 16, 2025)

• jcd v1.0
  jcd (jump change directory) is a Sysinternals command-line tool for Linux and macOS that provides quick directory navigation with substring matching and smart selection.