Sysinternals

The Sysinternals web site was created in 1996 by Mark Russinovich to host his advanced system utilities and technical information. Whether you’re an IT Pro or a developer, you’ll find Sysinternals utilities to help you manage, troubleshoot and diagnose your Windows and Linux systems and applications.

• Read the official guide to the Sysinternals tools, Troubleshooting with the Windows Sysinternals Tools
• Read the Sysinternals Blog for a detailed change feed of tool updates
• Watch Mark's Sysinternals Update videos on YouTube
• Watch Mark’s top-rated Case-of-the-Unexplained troubleshooting presentations and other webcasts
• Read Mark’s Blog which highlight use of the tools to solve real problems
• Check out the Sysinternals Learning Resources page
• Post your questions in the Sysinternals Forum

---

Sysinternals Live

Sysinternals Live is a service that enables you to run Sysinternals tools directly from the Web without manually downloading them.

Enter a tool's Sysinternals Live path in Windows Explorer as live.sysinternals.com/<toolname> or \\live.sysinternals.com\tools\<toolname>. In a command prompt use \\live.sysinternals.com\tools\<toolname>.

You can view the entire Sysinternals Live tools directory in a browser or Windows Explorer at https://live.sysinternals.com/.

What's New

What's New (June 17, 2026)

• Autoruns v14.3
  This update to Autoruns, a utility for monitoring startup items, adds bug fixes and improves the command-line application autorunsc.

• ZoomIt v12.1
  This update to ZoomIt, a screen magnification and annotation tool, adds image backgrounds, webcam background blur and microphone noise cancellation support.

What's New (May 7, 2026)

• Autoruns v14.2
  This update to Autoruns, a utility for monitoring startup items, adds support for Windows packaged apps.

• ProcDump v12.0
  This update to ProcDump, a command-line utility for generating memory dumps from running processes, adds process tree support with -pt.

• ZoomIt v12.0
  ZoomIt, a screen magnification and annotation tool, brings webcam overlay support for video captures and allows appending clips in the video trim editor.

What's New (March 26, 2026)

• listent 1.0 for macOS
  listent is a macOS command-line tool to discover and list code signing entitlements for executable binaries. It supports static scanning, real-time process monitoring, and background daemon operation.

• ZoomIt v11.0
  This update to ZoomIt, a screen magnification and annotation tool, adds panorama / scrolling screenshots support, text extraction during snip, break timer improvements, and enables the trimming clip editor for existing .mp4 files.

• Sysmon v15.2
  This update to Sysmon, an advanced host security monitoring tool, improves the handling of the internal events queue, making the service more resilient to dropped events on high system load.

• DebugView v5.0
  This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, improves Windows 11 support and offers a modern UI with a dark theme, and includes performance optimizations.

• NotMyFault v4.40
  This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds secure kernel and hypervisor crash triggers.

What's New (February 4, 2026)

• ZoomIt v10.0
  This update to ZoomIt, a screen magnification and annotation tool, adds a video clip editor for trimming recordings before saving them and supports recordings with system sounds.

• Sysmon 1.5 for Linux
  This update to Sysmon for Linux, a tool that monitors and logs system activity including process lifetime, network connections, file system writes, and more, adds EbpfEvent for monitoring Linux EBPF program loading.