Microsoft Sysinternals
ProcExp, ZoomIt, BgInfo, ListDLLs, ProcDump, ProcMon, PsKill, Sigcheck, ZoomIt for macOS, RDCMan (2026-10-16) commercialThe section your link pointed to isn't on Microsoft Sysinternals's page any more, so we've brought you to the top.
Microsoft Sysinternals is a suite of utilities for managing, diagnosing, troubleshooting, and monitoring Windows systems.
notmyfault.exe -c HalTimerWatchdogTriggerSystemReset
Summary
Microsoft Sysinternals is a commercial suite of command-line and GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. utilities for diagnosing and troubleshooting Windows systems at a low level, distributed as free downloads from Microsoft under the Windows platform. You run individual tools like PsExec, Handle, or Process Monitor from the command line, or use GUI ones like Process Explorer and Autoruns interactively, choosing whichever utility matches the job rather than installing one unified application. It is aimed at Windows system administrators and support engineers who need to inspect running processes, file and registry activity, or Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. objects rather than at developers building software. It sits in the Windows diagnostics and endpoint-troubleshooting space, covering ground that on other platforms is split across separate process monitors, permission viewers, and memory-dump tools.
Microsoft Sysinternals is a suite of utilities for managing, diagnosing, troubleshooting, and monitoring Windows systems.
How Microsoft Sysinternals helps
Which processes have a given file, folder, or handle locked open?
scans running processes for open handles matching the resource and lists the owning process and handle type, so a file that "can't be deleted" can be traced back to the process holding it
What is set to launch automatically at boot or logon on this machine?
enumerates every registry and file location that can configure auto-start and lists each entry with its target, so hidden or unfamiliar startup items can be found and disabled
What does a process actually do to the file system, registry, and network while it runs?
captures a live trace of every file, registry, and process/thread event a process generates, filterable by ancestry so all activity spawned by a parent process can be followed
Who has effective permission to read or modify this file, key, or service?
walks the effective access control on the object and reports which accounts and groups actually have rights, surfacing permission holes that aren't obvious from the security tab
Which named pipes or mailslots is a process using for interprocess communication?
reports IPC events alongside file and registry activity, showing which processes are talking to each other through pipes and under what names
Can a suspicious process be dumped for later analysis without killing it first?
captures a full memory dump of the running process on demand, leaving the process itself running, so the dump can be examined offline
Languages
Command line
5 commands for Microsoft Sysinternals, each with where it came from. This tool has no source analysis yet, so there is no option reference and no captured run beside them.
No command matches.
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
Five scores for Microsoft Sysinternals, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Microsoft Sysinternals puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
12 entries
No entries match these filters.
- October 20261
- September 20261
- August 20262
- July 20261
- June 20261
- May 20261
- March 20261
- February 20261
- December 20251
- November 20251
- September 20251
Articles
29 articles · updated Nov 4, 2026Where Microsoft Sysinternals turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.
Show all 28
-
How the OODA Loop Can Help Improve Detection Speed and Accuracy
This post will walk through a malware infection that used the Microsoft Sysinternals tool PsExec to attempt lateral movement, host reconnaissance, and network reconnaissance.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →