Windows sysinternals

458
Sysinternals utilities
Sysinternals utilities (continued)
LogonSessions, 280–283
malware blocking access to,
427–429
Microsoft support, 3, 14
MoveFile, 334
new features, utilities, and
bug fixes, 3
number of copies, 14
overview, 3–6
PageDefrag, 345–346
PendMoves, 333–334
PipeList, 374–375
Portmon, 353–358
ProcDump, 227–237
process state, viewing with,
211–260
ProcFeatures, 369–370
RAMMap, 359–367
RegDelNull, 378–379
RegJump, 377
running from Web, 10
SDelete, 283–286
ShareEnum, 277–278
ShellRunAs, 278–280
SigCheck, 261–267
single executable images, 11
Streams, 326–328
Strings, 325–326
symbolic information, 28–30
Sync, 339–340
TCPView, 351–353
32-bit and 64-bit system
support, 11
VMMap, 211–227
VolumeID, 350
Web site, 6–13
Whois, 353
WinObj, 370–373
ZoomIt, 320–324
Sysinternals Web site, 6–13
SysinternalsBluescreen.scr, 379
System account, executing
programs in, 176, 182
system activity
boot activity, logging,
127–128
log of, 123–126
system clock, current resolution,
375
System Configuration Utility
(msconfig.exe), 145–146
System.Diagnostics.Debug class,
237
System.Diagnostics.Trace class,
237
System event log
displaying records of, 192
PsShutdiown errors, 205
system files, defragmenting,
345–346
system hangs and crashes,
troubleshooting, 127
System Idle Process, 48
system information, 187–188
desktop wallpaper, displaying
as, 309–318
memory usage, monitoring,
355
viewing, 92–95
System Information dialog box,
92–94
system information utilities, 6,
359–376
system performance
KnownDLLs and, 162
noncached reads impact on,
417–418
on-access virus scans and,
418–419
troubleshooting, 405–426
system performance metrics,
92–95
System process
high CPU usage,
troubleshooting, 408–410
logging activity of, 128
system processes, 43, 48
system requirements for PsTools
utilities, 208–209
system resources, access to,
15–20
system shutdown, logging
activity of, 127–129
System start drivers, load order,
373
system-start services, 200
system startup, kernel-mode
debug output at, 241
system uptime, 187
system volumes, capturing
images of, 336
systemwide commit charge, 65
T
tab-delimited text, saving
Autoruns scans as, 166
target processes
directory for, 183
interactive running, 182
limited rights execution, 183
priority of, setting, 180
process tree of, 189
runtime environment,
181–184
scheduling on multiprocessor
systems, 181
secure Winlogon desktop
environment, 182–183
terminating, 188–189
tracing, 214
Task Manager
CPU usage calculation, 41
vs. Process Explorer, 96–97
processes, viewing in, 39
replacing and restoring,
96–97
Show Processes From All Users
option, 431–432
Users tab, 97
Task Scheduler, 146, 158
Taskkill.exe, 189
TCP endpoints, viewing, 82,
351–353
TCP operations, metrics on,
62–63
TCP port 2020 connections, 248
TCPView, 351–353
connected endpoints, viewing,
352
Resolve Addresses option, 352
update options, 351–352
Whois lookups, 352
tdx driver (NetIO Legacy TDI
Support Driver), 200
TechEd presentations, 13
terminal server sessions
capturing output of, 240–241
interactive desktops as, 238
www.it-ebooks.info