Sysinternals: Microsoft utilities for diagnosing Windows Server

Sysinternals — a set of free Microsoft utilities for Windows diagnostics. The Sysinternals site was created in 1996 by Mark Russinovich together with Bryce Cogswell; Microsoft acquired the company in 2006, and since then the utilities have been published on learn.microsoft.com. They show what is not visible in standard tools: which process holds a file, what exactly a program reads from the registry, what runs at system startup, and which processes open network connections.

The suite is updated regularly: for example, in 2026 Process Monitor 4.1, Autoruns 14.3 and a new version of Sysmon were released. Below are utilities that a Windows Server administrator will most often need, and ways to work with them.

How to get the utilities

• Sysinternals Suite archive from the official site: https://download.sysinternals.com/files/SysinternalsSuite.zip. Unpack it into a separate folder, for example C:\Tools\Sysinternals, and add the folder to the PATH environment variable.
• Sysinternals Live — run without downloading. In Explorer or the command line specify a path like \\live.sysinternals.com\tools\<utility_name>:

\\live.sysinternals.com\tools\procexp64.exe

A path like \\live.sysinternals.com\tools opens as a network resource, so in corporate networks where such outbound traffic is blocked, Sysinternals Live may be unavailable. On servers without internet access, it’s better to place the utilities in advance along with other admin tools.

On first run each utility shows the license agreement. In scripts accept it with the -accepteula flag.

Core utilities

Typical tasks

File locked by another process. When you cannot delete or replace a file, Handle will show who holds it:

handle.exe -accepteula C:\inetpub\logs\LogFiles\W3SVC1\u_ex260922.log

In Process Explorer the same is done via Find → Find Handle or DLL.

Program won’t start or behaves oddly. Process Monitor logs every file and registry operation. Immediately set a filter by process name (Filter → Process Name is …): without a filter hundreds of thousands of events are collected in a minute and the utility noticeably loads the system. Results with codes ACCESS DENIED and NAME NOT FOUND most often indicate the cause — lack of rights to a folder or a missing registry key.

Server boots slowly or something extra in autorun. Autoruns shows all autorun points on one screen. Enable Options → Hide Microsoft Entries to leave only third-party components, and check unsigned entries or those with an unknown publisher. Disable items by unchecking them, not deleting: that makes it easy to revert the change.

High CPU load or memory leak. Process Explorer shows each process’s CPU usage history, working set and handle count. A steadily increasing number of handles or private bytes for a long-running service is a typical sign of a leak. ProcDump is used to collect a dump of a hung process.

Who establishes network connections. TCPView shows connections with process names and allows closing a connection or terminating the process directly from the window.

Remote command execution: PsExec

PsExec runs processes on remote computers without pre-installing a client. The syntax allows specifying several computers separated by commas or a list from a file:

psexec \\server01,server02 -accepteula cmd /c "net stop wuauserv && net start wuauserv"
psexec @servers.txt -accepteula ipconfig /all

Things to consider:

• Rights. You need an account with administrator rights on the remote machine. PsExec delivers a helper component to the remote computer and runs it as a service, so it needs access to the administrative share ADMIN$ over SMB — the target machine must have SMB ports open and the Server service enabled.
• Context. Without the -u flag the process runs under your account but without access to network resources. If the command needs network resources, specify the user in the format Domain\User. The -s flag runs the process as System.
• Security. The password and command are transmitted encrypted. At the same time, antivirus products often react to PsTools: the utilities themselves contain no malicious code, but attackers use them. Therefore running PsExec in a network should be coordinated with the security team, and its appearance in logs should be expected.

For ad-hoc management of a server farm PsExec is convenient as a one-off tool. For ongoing automation, PowerShell Remoting or configuration management systems are more suitable.

Sysmon: a log for incident investigation

Sysmon installs as a service and driver and persists across reboots. It logs to the event log process creation with full command line and executable hash, driver loading, network connections, DNS queries, registry changes and much more. Sysmon itself does not analyze events: they are collected into a SIEM or centralized log store.

Install with a configuration file and update the configuration:

sysmon64 -accepteula -i C:\Tools\sysmon-config.xml
sysmon64 -c C:\Tools\sysmon-config.xml

Events are written to the log Applications and Services Logs/Microsoft/Windows/Sysmon/Operational. Without filters Sysmon generates a very large number of events, so configurations are based on tested templates, for example SwiftOnSecurity/sysmon-config, and adapted for your servers. The current version supports Windows Server 2019 and newer; there is also a separate version of Sysmon for Linux.

Integration with PowerShell

Console utilities are convenient to call from scripts. For example, check whether a file is locked before updating an application:

$result = & C:\Tools\Sysinternals\handle.exe -accepteula -nobanner "C:\App\app.dll"
if ($result -match 'pid:') {
    Write-Warning "File is locked: $result"
}

The -nobanner flag removes the copyright line from the output, making it easier to parse.

Common mistakes

• Running Process Monitor without a filter on a busy server: it quickly fills memory and slows the system. Set filters before starting the capture.
• Running Sysmon without a configuration or with a “log everything” configuration: the log fills up and useful events are lost.
• Deleting entries in Autoruns instead of disabling them: reverting such a change is harder.
• Putting PsExec passwords in plain text in scripts: the password remains in command history and files. Use an account with the required rights without passing the password on the command line.
• Old copies of utilities on servers: Microsoft regularly releases fixes, so update the suite along with other tooling.

Summary

Sysinternals covers most Windows Server diagnostic tasks without installing additional agents: find the process holding a file, understand why a program doesn’t start, check autorun, and collect logs for investigation. For continuous server monitoring they are complemented by monitoring and centralized log collection.

Resources

• Official Sysinternals page
• PsExec
• Sysmon
• Sysmon configuration template