Русский flag Русский

IT support for business, startups and developers

All Posts

Sysinternals: the Swiss Army knife for Windows Server

2025-10-13

#Windows Server #Sysinternals #administration #tools #PowerShell

Introduction

Sysinternals is a collection of free utilities from Microsoft, created by Mark Russinovich and Bryce Cogswell.
It helps system administrators access low-level information about Windows Server: processes, the file system, network connections, and autostart.
The suite includes more than 60 tools and is the de-facto standard for troubleshooting and diagnostics.

Key features

  • CPU, disk and memory performance diagnostics.
  • Troubleshooting application crashes and errors.
  • Security monitoring and analysis of suspicious processes.
  • Remote administration via PsTools.
  • Work with Active Directory and services.

Key utilities

UtilityPurposeInterface
Process ExplorerAdvanced Task Manager; shows process relationships, loaded DLLs and handles.GUI
Process Monitor (ProcMon)Monitors file, registry and network operations.GUI
PsToolsRemote management suite (PsExec, PsList, PsKill).CLI
AutorunsView and manage program and service autostart entries.GUI
TCPViewMonitor all TCP/UDP connections and associated processes.GUI
SysmonLogs security events and system changes.CLI

Practical scenarios

  1. Slow system boot — use Autoruns to disable unnecessary autostart items.
  2. “File in use” error — Handle or Process Explorer will show which process holds the file.
  3. High CPU load — PsList or Process Explorer can help find the source.
  4. Suspicious network activity — TCPView will show who is establishing connections.
  5. Security auditing — configure Sysmon and analyze logs in the Event Viewer.

Automation with PsTools

Sysinternals is great for automation. With PsExec you can run PowerShell scripts or CMD commands on dozens of servers at once.
For example, to restart the Windows Update service:

079 | Hyper-V: Virtualization from Microsoft – Seamless Integration with Windows Server

2025-08-11

#Hyper-V #virtualization #Windows Server #Microsoft #failover #hypervisor #PowerShell #SCVMM

What is Hyper-V?

Hyper-V is Microsoft’s native virtualization platform, an integral part of Windows Server operating systems and optionally available on Windows 10/11 Pro/Enterprise. Hyper-V functions as a Type 1 hypervisor, installing directly on bare-metal hardware and offering functionality comparable to major players like VMware. Its main advantage is deep integration with the Microsoft ecosystem, making it a natural choice for administrators and businesses running Windows-based infrastructure.

Key Features and Advantages of Hyper-V

Hyper-V provides all the essential tools for building and managing virtualized environments, with a focus on simplicity and Windows integration.