Windows sysinternals

Chapter 1
Getting Started with the
Sysinternals Utilities
The Sysinternals utilities are free, advanced administrative, diagnostic, and troubleshooting
utilities for the Microsoft Windows platform written by the founders of Sysinternals: me
(Mark Russinovich) and Bryce Cogswell 1 . Since Microsoft’s acquisition of Sysinternals in July
2006, these utilities have been available for download from Microsoft’s TechNet Web site.
Among the hallmarks of a Sysinternals utility are that it
■ Serves unmet needs of a significant IT pro or developer audience
■ Is intuitive and easy to use
■ Is packaged as a single executable image that does not require installation and can be
run from anywhere, including from a network location or removable media
■ Does not leave behind any significant incidental data after it has run
Because Sysinternals doesn’t have the overhead of a formal product group, I can quickly
release new features, utilities, and bug fixes. In some cases, I can take a useful and simple- toimplement
feature from suggestion to public availability in under a week.
However, the other side of not having a full product group and formal testing organization is
that the utilities are offered “as is” with no official Microsoft product support. The Sysinternals
team maintains a dedicated community support forum—described later in this chapter—on
the Sysinternals Web site, and I try to fix reported bugs as quickly as possible.
Overview of the Utilities
The Sysinternals utilities cover a broad range of functionality across many aspects of the
Windows operating system. While some of the more comprehensive utilities such as Process
Explorer and Process Monitor span several categories of operations, others can more or
less be grouped within a single category, such as “process utilities” or “file utilities.” Many of
the utilities have a graphical user interface (GUI), while others are console utilities with rich
command-line interfaces designed for automation or for use at a command prompt.
This book covers three major utilities (Process Explorer, Process Monitor, and Autoruns), each
in its own chapter. Subsequent chapters cover several utilities each, grouped by category.
1 Bryce left Microsoft in late 2010 and no longer contributes to the Sysinternals utilities.
www.it-ebooks.info
3