Sysinternals

0 answers

The Peak Handles value shows the same value as Handles

The Peak Handles value within the Handles group on the Performance tab (process properties) appears to show the same value as Handles. i.e. its value drops as well as increases, when I would expect the peak value to only increase. This is observable with…

asked

Mark Incley 1

3 answers

BGinfo "Network Card" internal string name; what is it?

I an trying to display BGinfo's Network Card name without some extraneous information that is on the end of the Network Card description that BGinfo displays. The problem is that I don't know what the string name BGinfo uses for "Network…

asked

Bob Hurd 21

commented

Cheong00 3,476

1 answer

Bug in psexec 2.32 still - remote access doesn't work (e.g. psexec \\remotecomputer -h -u administrator -p password cmd.exe )

Remote access in psexec 2.32 doesn't work, please fix e.g. psexec \remotecomputer -h -u administrator -p password cmd.exe Which worked in psexec 2.20 and earlier, no longer works in 2.32. Works fine when I revert to 2.20 and earlier. But not with 2.32.…

asked

Mike Diack 51

answered

mariora 376

1 answer

portmon - instant crash on Windows XP (32-bit)

It's not running from a network drive and the user is an administrator. How can I diagnose/fix?

asked

Kieren Johnstone 6

answered

mariora 376

1 answer

MSI installer for Sysmon?

I'd like to put in a feature request to have a MSI installer for Sysmon (and the related services). This would allow integration with normal package managers and desired state tools (e.g. Puppet), without having to create wrappers to handle the Sysmon…

asked

Pat O'Connell 1

answered

Kevin Gould 16

0 answers

Structure of process GUIDs used in Sysmon ETW events

Back in July 2018, Matt Graeber figured out the structure of the process GUID used in Sysmon events and published a PowerShell script to decode them. Since then however it seems that the structure has changed. If mmmmmmmm-tttt-tttt-cccc-ccccwwwwwwww is…

asked

Dave McCormack 11

1 answer

BGInfo not recognising AMD CPU

When I use BGInfo v4.28 to display the CPU on my Windows Server 2019 Hyper-V VM, it shows as "Unknown Family" but is showing correctly in system information: Can this be added in a future release? It's been like this since way before…

asked

Fernando VINAN-CANO 1

commented

Fernando VINAN-CANO 1

2 answers

run psexec on remote pc

Hi I have a pc with a static ip address that has been moved to a site using DHCP. Can psexec be used to connect to it when the pc is connected to the network of a DHCP site when the pc has a static IP address. I guess not. I was just wanting to…

asked

MacFarlane, Alastair 1

commented

MacFarlane, Alastair 1

3 answers

Explorer.exe constantly consumes CPU around 20% just after recent Windows Update

This issue has just started after recent Windows Update yesterday. No running application on my Windows 10. I had never seen it ever. How could I resolve this issue? This issue continues more than 30 hours. Windows 10 Home Version: 2004 …

asked

galvion1 26

commented

galvion1 26

1 answer

Is there a way to see which dll created a specifc .txt file in a specific location?

I'm new to SysInternals and I have a text file being created and I'm not sure which .exe or .dll is creating the .txt file. Which SysInternal tool would be best for this? If it's Procmon, how would I filter it to find it? Does the process…

asked

J M 41

commented

J M 41

3 answers

Sysmon 11.10 - force uninstall causes system reboot

We were having severe memory issues on multiple production servers running version 11.10. These systems are running Server 2016. We have since halted Sysmon use and were trying to move to a newer version, 12.03. When we attempted the uninstall on one of…

asked

vizibility 1

answered

vizibility 1

1 answer

Sysmon 13.0 Config (System Error 1067)

Is Sysmon 13.0 backwards compatible with older configs ? Using SwiftOnSecurity's config with Sysmon 13.0 yields an error when trying to start the Sysmon64 service. No errors about the config are thrown when installing Sysmon 13.0, however upon trying to…

asked

Zane Gittins 21

accepted

Zane Gittins 21

3 answers

Sysmon 12.03 and Sysmon 13.00: RuleEngine Error: Multiple rule filters of the same type

Hello, Since Sysmon 12.03 we have the issue, that the config file can't be parsed by Sysmon 12.03. Even with the latest version 13.00 this issue still exists. The same config file is parseable with Sysmon 12.01.

asked

Joe Doe 156

answered

Joe Doe 156

1 answer

Too Long Shutdown - kernal power event 43 to 107 takes 1 minute

I have fast startup enabled. But Shutdown takes too long, around 90 seconds in Win 10

asked

M Sra 1

answered

Mario Raccagni Consulente 1

1 answer

Bug: QueryDirectory results item 2 missing

Process Monitor records the directory listing for QueryDirectory but it skips item 2. I noticed this when I had a directory with two sub directories and the QueryDirectory record in Process Monitor only showed 1. To test this I made 3 sub directories…

asked

Ray Satiro 46

accepted

Ray Satiro 46

1 answer

How to add Safer path filter in process monitor

One of the experiments in Windows Internals requires that I add a a path filter for Safer in process monitor. I tried this but no events are displayed. How does one add a path filter for "Safer" ?

asked

adelhi 1

commented

adelhi 1

1 answer

DU utility shows 'á' instead of separator

I am using WIndows 10 (v 10.0.19042) and when I run the DU utility it does not format the output correctly. The screenshot below shows the problem. I am using the system locale 1053 / sv-SE.

asked

Joakim 11

answered

mariora 376

1 answer

ScanPST Deletion Entry in Logs

Hello, I need to know the entry that ScanPST creates when a file is deleted. This is pertaining to the following Microsoft article: https://learn.microsoft.com/en-us/outlook/troubleshoot/data-files/how-to-repair-personal-folder-file Point 5…

asked

Warren Weston 1

commented

Jade Liang-MSFT 9,976 Microsoft Employee

0 answers

BSOD Page Fault in Non Paged Area using SysInternals Sysmon V11

HI All We recently been getting BSOD's on our Windows Server 2016 servers. We had Sysmon V11 installed and running since September but the last few days we been getting BSOD's saying Page Fault in Non Paged Area and the mini dump shows Sysmondrv.sys as…

asked

chaps-0125 1

commented

dstaulcu 351

1 answer

Crash in strings v2.53 with interactive EULA prompt

Open a Command Prompt (not PowerShell) and run something like: strings.exe C:\Windows\System32\notepad.exe > notepad.txt If the EULA has not been accepted the program will crash immediately after accepting it. Declining will not cause a crash,…

asked

Samuel Leslie 1

commented

Samuel Leslie 1

Filter

Content

1,132 questions with Sysinternals-related tags

The Peak Handles value shows the same value as Handles

BGinfo "Network Card" internal string name; what is it?

Bug in psexec 2.32 still - remote access doesn't work (e.g. psexec \\remotecomputer -h -u administrator -p password cmd.exe )

portmon - instant crash on Windows XP (32-bit)

MSI installer for Sysmon?

Structure of process GUIDs used in Sysmon ETW events

BGInfo not recognising AMD CPU

run psexec on remote pc

Explorer.exe constantly consumes CPU around 20% just after recent Windows Update

Is there a way to see which dll created a specifc .txt file in a specific location?

Sysmon 11.10 - force uninstall causes system reboot

Sysmon 13.0 Config (System Error 1067)

Sysmon 12.03 and Sysmon 13.00: RuleEngine Error: Multiple rule filters of the same type

Too Long Shutdown - kernal power event 43 to 107 takes 1 minute

Bug: QueryDirectory results item 2 missing

How to add Safer path filter in process monitor

DU utility shows 'á' instead of separator

ScanPST Deletion Entry in Logs

BSOD Page Fault in Non Paged Area using SysInternals Sysmon V11

Crash in strings v2.53 with interactive EULA prompt