10 Sysinternals Tools That Solve Everyday Windows Mysteries

The diagnosis trio: Process Explorer, Process Monitor, Autoruns

Process Explorer is Task Manager with X-ray vision: it shows the process tree, the DLLs each process loaded, the services living inside every svchost, and a hundred columns of detail. Its killer trick is Find Handle (Find → Find Handle or DLL): type the name of a stubborn file and it names the exact process holding it open — the answer to every "file is in use in another program" error. It can also send every running binary to VirusTotal (Options → VirusTotal.com → Check) and show the verdicts in a column. That one feature settles half the "what is this process" panics on a healthy machine. Keep it as your default Task Manager (Options → Replace Task Manager) and most mysteries stop being mysteries.

Process Monitor records every file, registry and network event on the machine — thousands of lines per second — so the skill is not recording, it is filtering. Include Result is ACCESS DENIED, or Path begins with the file you care about, and the noise collapses into an answer. It can also log a full boot (Options → Enable Boot Logging) to catch what happens before you even sign in. Autoruns is the third leg: it enumerates every autostart location — logon items, services, scheduled tasks, shell extensions, codecs — with publisher and signature columns, so the thing that starts with Windows and Task Manager's startup tab never heard of cannot hide.

• "The file is open in another program" — Process Explorer: Find → Find Handle, type the file name
• "What is this unknown process?" — Process Explorer's VirusTotal column plus the DLLs and Services tabs
• "What keeps touching this file or setting?" — Process Monitor with a filter on that exact path
• "Something starts with Windows that the startup list never shows" — Autoruns, with Microsoft entries hidden
• "Who is my PC talking to right now?" — TCPView, one glance per connection

The supporting cast: dumps, sockets, folders, signatures

ProcDump watches a process and writes a memory dump at the exact moment it misbehaves — procdump -c 90 app.exe captures the instant CPU crosses 90%, no killing involved. TCPView is netstat with a face: every connection and listening port, per process, refreshed live. Disk Usage (du.exe) prints folder sizes from a console — du -l 2 C:\Users reports two levels deep — and settles "where did the space go" arguments in seconds. sigcheck verifies signatures, versions and hashes (sigcheck -h file.exe), which answers "is this file what it claims to be" without launching it. Strings extracts readable text from any binary — URLs, paths, hints — the honest way to peek inside something suspicious.

The last two solve smaller mysteries that otherwise eat an evening. MoveFile schedules deletion of a locked file at the next reboot (movefile "C:\path\stubborn.dll" ""), which removes files even Process Explorer cannot unlock cleanly. BgInfo stamps hostname, IP address, boot time and memory onto the wallpaper — which sounds trivial until you support three family machines by phone and stop asking "which computer am I talking to".

How to run the suite without breaking anything

Everything is free from Microsoft's Sysinternals site, and every tool runs without installation — or straight from \\live.sysinternals.com\tools if you always want the latest build. Most tools accept /accepteula on the command line so first use stays quiet. Keep them in one folder, add that folder to PATH, and run elevated when the mystery involves system processes. The golden rule: these tools look, they do not change — the only edits are the ones you explicitly make, like killing a handle or disabling an Autoruns entry. Look first, understand, then act, and Windows stops keeping secrets.

Questions and Answers

Read next