Windows Sysinternals Suite

Practical Field Guide for Troubleshooting, Recovery, Administration and Security

Edition: September 2026 Primary platform: Windows 10/11 and Windows Server, subject to each tool's supported versions Audience: Home-lab administrators, repair technicians, IT support, system administrators, developers and technically confident Windows users

Purpose of this guide This is a practical handbook for the tools included in Microsoft's Sysinternals Suite. It explains what each tool is for, when it is useful, how to start using it, and where it can cause damage if used carelessly. It is deliberately written as a field guide, not as a replacement for Microsoft's full reference documentation. Sysinternals tools evolve, so use each program's built-in -?, /?, Help menu, or current Microsoft Learn page when you need an exact switch for a specific version.

---

Contents

1. [What Sysinternals is](#1-what-sysinternals-is)
2. [Installing and running the Suite](#2-installing-and-running-the-suite)
3. [The five tools to learn first](#3-the-five-tools-to-learn-first)
4. [Rapid troubleshooting workflows](#4-rapid-troubleshooting-workflows)
5. [Tool reference by category](#5-tool-reference-by-category)
6. [PsTools remote-administration notes](#6-pstools-remote-administration-notes)
7. [Safe recovery-drive layout](#7-safe-recovery-drive-layout)
8. [Evidence and logging checklist](#8-evidence-and-logging-checklist)
9. [Command-line habits](#9-command-line-habits)
10. [Official references](#10-official-references)
11. [Alphabetical tool index](#11-alphabetical-tool-index)

---

1. What Sysinternals is

Sysinternals is Microsoft's collection of advanced Windows troubleshooting, diagnostic, administration, security and internals utilities originally created by Mark Russinovich and Bryce Cogswell.

The tools are unusually useful because many of them expose what Windows is actually doing rather than merely presenting a simplified control-panel view.

Typical questions Sysinternals can answer include:

• Which process has this file locked?
• Why does this application say Access Denied?
• What starts automatically with Windows?
• Which process opened this network connection?
• What is consuming physical RAM?
• What DLLs are loaded into this process?
• What changed immediately before an application failed?
• Who has permission to modify this service or folder?
• Which users are logged on to this remote PC?
• Can I capture a dump when this application next hangs?
• What files are queued for replacement at the next reboot?
• What is using all this disk space?
• What is hidden in an NTFS alternate data stream?
• What is this executable signed by?
• What is actually happening inside the Registry while an installer runs?

The Suite is portable-friendly: most tools are standalone executables and do not need a traditional installation.

---

2. Installing and running the Suite

2.1 Recommended recovery-drive method

For a portable technician/recovery drive:

\Tools\
    \Sysinternals\
        SysinternalsSuite\
        Logs\
        ProcMon-Captures\
        Dumps\
        Exports\

Keep the original Suite together. Do not scatter individual EXEs across twenty folders and then wonder six months later which copy is current. Humans invented version drift because ordinary chaos apparently lacked ambition.

2.2 Run from an extracted Suite

Open Terminal, Command Prompt or PowerShell in the Sysinternals directory:

cd /d D:\Tools\Sysinternals\SysinternalsSuite

Then run a tool:

procexp64.exe
procmon64.exe
autoruns64.exe
tcpview.exe
rammap.exe

For command-line utilities:

sigcheck -?
handle -?
psinfo -?

2.3 Sysinternals Live

Microsoft also provides Sysinternals Live, which can run tools directly from Microsoft's hosted share:

\\live.sysinternals.com\tools\procexp.exe

or browse:

\\live.sysinternals.com\tools\

For recovery work, a local copy is still preferable because the broken PC may have no internet, broken DNS, a blocked SMB path, or the sort of network stack that has decided today is its spiritual retreat.

2.4 First-run licence prompt

Many tools show the Sysinternals EULA on first launch.

Some command-line tools support:

-accepteula

Do not blindly add it to every tool. Check the current tool help first.

2.5 32-bit vs 64-bit variants

Where both exist:

• Prefer the 64-bit version on normal 64-bit Windows.
• Keep the 32-bit build available when analysing 32-bit-specific behaviour.
• ARM64 systems require compatible builds where supplied.

2.6 Administrator rights

A large portion of Sysinternals becomes more useful when run elevated.

Use:

Right-click → Run as administrator

or launch an elevated Terminal first.

Elevation does not magically make every action safe. It merely grants you the authority to make more impressive mistakes.

---

3. The five tools to learn first

If you learn only five Sysinternals tools initially, make them these.

3.1 Process Explorer

Use for:

• high CPU
• mystery processes
• locked files
• parent/child process chains
• DLLs and handles
• services hosted in svchost.exe
• suspicious process investigation

Think of it as Task Manager after Task Manager went to university.

3.2 Process Monitor

Use for:

• ACCESS DENIED
• application will not start
• missing configuration
• Registry problems
• installer failures
• missing DLL/files
• unexplained file/Registry activity

ProcMon is often the answer when the problem is:

"It fails, but Windows refuses to explain why."

3.3 Autoruns

Use for:

• slow boot/logon
• unwanted startup software
• shell extensions
• scheduled tasks
• services and drivers
• persistence/malware investigation

3.4 TCPView

Use for:

• unexpected internet connections
• listening ports
• mapping connection → process
• identifying what application is talking to a remote address

3.5 RAMMap

Use for:

• "Where has all my RAM gone?"
• file cache analysis
• standby memory
• driver/kernel memory questions
• system-wide physical-memory investigations

---

4. Rapid troubleshooting workflows

4.1 PC is generally slow

Start with:

1. Process Explorer

• CPU
• I/O
• Private Bytes
• Working Set
• process tree

1. Autoruns

• excessive logon/startup items
• services
• scheduled tasks

1. RAMMap

• physical-memory breakdown

1. DU

• disk-space usage

1. TCPView

• unexpected constant network activity

Do not begin by deleting random Registry keys. That method persists mainly because Windows sometimes survives it, which humans have mistaken for evidence.

4.2 Application will not start

1. Start Process Monitor.
2. Stop capture.
3. Add filter:

• Process Name is app.exe

1. Clear events.
2. Start capture.
3. Launch the app once.
4. Stop capture.
5. Look for:

• ACCESS DENIED
• missing DLL/config file near the failure
• repeated missing paths
• Registry access failures

1. Use Process Explorer/ListDLLs if the process remains alive.
2. Use Sigcheck on suspicious or unexpectedly unsigned modules.

4.3 File cannot be deleted because it is in use

Use:

handle filename.ext

or:

Process Explorer → Ctrl+F → filename.ext

Then:

1. identify the owning process
2. close the application normally
3. retry deletion

Avoid forcibly closing the handle unless normal closure is impossible.

4.4 Suspected malware or unwanted persistence

Suggested sequence:

1. Disconnect from untrusted networks if appropriate.
2. Capture basic state before deleting anything.
3. Autoruns

• Hide Microsoft entries
• verify signatures

1. Process Explorer

• process tree
• signer
• command line
• parent process

1. TCPView

• remote connections/listeners

1. Sigcheck

• signature/hash review

1. Strings

• quick static clues

1. Streams

• alternate data streams

1. Process Monitor

• controlled behavioural trace

1. Export evidence before remediation.

For serious compromise, preserve evidence and consider rebuilding rather than playing whack-a-mole with persistence mechanisms.

4.5 Unknown network connection

1. Open TCPView.
2. Identify:

• process
• PID
• remote IP/name
• port
• state

1. Open the process in Process Explorer.
2. Check:

• image path
• signer
• parent
• command line

1. Run Sigcheck against the executable.
2. Use WhoIs and normal DNS/security tooling for context.
3. If needed, capture behaviour with Process Monitor or Sysmon.

4.6 High memory usage

First decide whether the problem is:

• one application, or
• Windows/system-wide memory usage.

One process

Use VMMap.

Whole system

Use RAMMap.

Application leak that happens over time

Use:

• Process Explorer performance history
• VMMap snapshots
• ProcDump triggers/dumps
• application-specific debugging

4.7 High disk activity

Use:

1. Process Monitor

• filter File System events

1. Process Explorer

• I/O columns

1. DiskMon

• low-level disk activity

1. DU

• capacity problems

1. NTFSInfo/DiskView

• filesystem/layout questions

4.8 PC needs risky repair

Before changing major system files:

1. Create/verify backup.
2. Consider Disk2vhd.
3. Export relevant Registry keys.
4. Capture:

• Process Explorer process state
• Autoruns
• Event Logs
• network state

1. Note pending moves with PendMoves.
2. Make one controlled change at a time.

4.9 Remote family-PC check

Where permissions/firewall allow:

psinfo \\PCNAME
psloggedon \\PCNAME
pslist \\PCNAME
psservice \\PCNAME query

Use PsExec only when remote command execution is genuinely needed.

---

5. Tool reference by category

Startup, Persistence & Malware Triage

Autoruns

What it is Deep inventory of Windows auto-start locations: logon entries, services, drivers, scheduled tasks, Explorer extensions, Winlogon items, codecs, WMI persistence and more.

When to use it One of the best Sysinternals tools for slow startup, mystery software, broken shell extensions, persistence hunting and malware triage.

How to use it GUI workflow

1. Run Autoruns64.exe elevated.
2. Let the scan finish.
3. Enable signature verification.
4. Use Options → Hide Microsoft Entries to reduce noise.
5. Inspect Logon, Scheduled Tasks, Services, Drivers, Explorer and WMI.
6. Prefer unchecking an entry first. Deleting it is harder to undo.

CLI examples

autorunsc -a * -s -h
autorunsc -a * -m -s -c > autoruns.csv

Caution An unsigned entry is not automatically malware. Do not disable Microsoft, security, storage or hardware entries merely because the name looks obscure.

---

Processes & Handles

Handle

What it is Command-line tool for finding open handles, including which process has a file, directory or other object open.

When to use it Use it when Windows says a file is 'in use', a folder cannot be renamed, a removable drive will not eject, or you need a scriptable Process Explorer-style handle search.

How to use it

handle filename
handle "C:\Path\Folder"
handle -p processname
handle -?

Use search output to identify the owning process before deciding whether to close anything.

Caution Forcibly closing handles can corrupt application state or data. Prefer closing the owning application normally.

---

Process Explorer

What it is Advanced Task Manager replacement showing process trees, CPU, memory, handles, DLLs, signatures, services, threads and much more.

When to use it Use it for high CPU, mystery processes, locked files, parent/child relationships, loaded DLLs, service hosting and malware triage.

How to use it

1. Run procexp64.exe as Administrator.
2. Enable Verify Image Signatures.
3. Add useful columns such as Command Line, Verified Signer, User Name, Integrity Level, CPU, Private Bytes and Working Set.
4. Use Ctrl+F to search handles/DLLs.
5. Double-click a process for threads, TCP/IP, environment, handles and image details.
6. Use Replace Task Manager only if you actually want that behaviour.

Caution Killing a process is easy; understanding why it existed is the useful part. Terminate only after identifying its role and impact.

---

Processes & Modules

ListDLLs

What it is Lists DLLs loaded into processes and can search for processes that have loaded a specific DLL.

When to use it Use it for DLL-version conflicts, unexpected module injection, dependency investigations and security triage.

How to use it

listdlls
listdlls processname
listdlls -d suspicious.dll
listdlls -?

Compare module path, signer and version, not just filename.

Caution A familiar DLL name does not prove legitimacy. Malware can use convincing names; inspect full paths and signatures.

---

Tracing & Deep Diagnostics

Process Monitor

What it is Real-time trace of filesystem, Registry, process/thread and image-load activity, with powerful filters and stack information.

When to use it Use it for almost any 'what is Windows actually trying to do?' problem: access denied, missing file, missing Registry key, failed DLL lookup, startup failure, installer problem, configuration mystery or application hang.

How to use it

1. Run Procmon64.exe as Administrator.
2. Immediately stop capture with Ctrl+E while preparing filters.
3. Clear old events with Ctrl+X.
4. Add filters for Process Name, PID, Path, Operation or Result.
5. Start capture, reproduce the problem once, then stop capture.
6. Look around the first meaningful failure, not every NAME NOT FOUND.
7. Save as .PML to preserve full data.

Useful results include ACCESS DENIED, PATH NOT FOUND, NAME NOT FOUND, SHARING VIOLATION and failed image loads, but context matters.

Caution ProcMon can record millions of events. Filtering is not optional unless scrolling until your retirement is part of the troubleshooting methodology.

---

Crash & Hang Diagnostics

ProcDump

What it is Creates process dump files on demand or when triggers occur, such as exceptions, hangs, CPU thresholds or other conditions.

When to use it Use it when an application crashes, freezes, leaks or intermittently misbehaves and you need a dump for WinDbg/developer analysis.

How to use it

procdump -?
procdump -ma <PID>
procdump -ma processname.exe

For trigger-based collection, build the command from the current procdump -? help so the condition matches your problem. Save dumps to a drive with enough free space.

Caution Full dumps can contain passwords, document contents, tokens, keys and other in-memory secrets. Treat dump files as sensitive.

---

Memory & Performance

CacheSet

What it is Controls the Windows Cache Manager working-set size.

When to use it Use it for specialised performance experiments involving the system file cache.

How to use it Run Cacheset.exe elevated, inspect current values, and change minimum/maximum cache working-set values only when you have a measured reason to do so.

Caution This is an advanced tuning utility, not a general 'make Windows faster' button. Modern Windows memory management is usually better left alone.

---

RAMMap

What it is Advanced physical-memory analyser showing process working sets, standby lists, file cache, driver/kernel allocations and physical pages.

When to use it Use when Task Manager says memory is heavily used but does not explain where it went, or when investigating cache/standby-list behaviour.

How to use it

1. Run RAMMap.exe elevated.
2. Start with Use Counts.
3. Check Processes for per-process working sets.
4. Use File Summary/File Details for cached-file memory.
5. Use Physical Pages and Priority Summary for deeper analysis.
6. Save snapshots before/after a workload when comparing behaviour.

Caution Do not routinely empty working sets or standby lists as a 'memory cleaner'. Windows uses spare RAM as cache intentionally.

---

VMMap

What it is Analyses the virtual and physical memory layout of an individual process.

When to use it Use for memory leaks, unusually large processes, developer diagnostics and understanding how a process allocates heap, image, stack, mapped file and other memory types.

How to use it

1. Run VMMap.exe.
2. Select the target process.
3. Review the summary and memory-type breakdown.
4. Take snapshots before/after the suspicious operation.
5. Compare changes to identify the allocation class that is growing.

Caution VMMap explains a process's address space; RAMMap explains physical memory system-wide. Use the one that matches the question.

---

Networking

TCPView

What it is GUI showing TCP and UDP endpoints, local/remote addresses, connection state and owning process. Includes Tcpvcon for command-line use.

When to use it Use for 'what is connecting to the internet?', unexpected listening ports, service connectivity, malware triage and identifying the process behind a network connection.

How to use it

1. Run TCPView.exe elevated.
2. Toggle name resolution if DNS names create noise.
3. Sort by Process, Remote Address, Remote Port or State.
4. Watch new/changed connections.
5. Save output before closing a suspicious connection.

CLI:

tcpvcon -a
tcpvcon -n -a
tcpvcon -c -a > connections.csv

Caution Closing a TCP connection does not remove the process that created it; many applications will reconnect immediately.

---

Networking / PsTools

PsPing

What it is Network test utility supporting ICMP ping plus TCP latency and bandwidth testing.

When to use it Use when ordinary ping is insufficient and you need to test whether a specific TCP service/port is reachable or measure TCP performance.

How to use it

psping hostname
psping hostname:443
psping -?

Use TCP mode to distinguish 'host reachable' from 'the required service port is reachable'.

Caution A failed test may be firewall policy, routing, service state or filtering. It does not automatically mean the remote machine is offline.

---

Networking / Internet

WhoIs

What it is Queries domain registration (WHOIS) information.

When to use it Useful for quick context about an unfamiliar domain found in logs or network connections.

How to use it

whois example.com

Use the result as one piece of context alongside DNS, certificates, reputation and network evidence.

Caution WHOIS privacy/proxy services are common. Registration data may be hidden, stale or unrelated to the actual operator of a service.

---

Security & Permissions

AccessChk

What it is Command-line permission inspector for files, folders, Registry keys, services, processes, shares, kernel objects and other securable Windows objects.

When to use it Use it when you need to answer who can access this?, what can this account modify?, or is this service/file writable by ordinary users?

How to use it

accesschk -?
accesschk -u -w "C:\Program Files"
accesschk -c SomeService
accesschk -k "HKLM\Software"

Start with accesschk -? because the object type switches matter. For security audits, look especially for unexpected write, change permissions, or full control access.

Caution Run elevated for a complete view. Treat unexpected writable services, executable folders, and sensitive Registry locations as security findings, not merely curiosities.

---

AccessEnum

What it is GUI utility that recursively displays permissions on directories, files and Registry keys.

When to use it Use it for a quick visual permissions audit, especially to find folders or Registry branches whose permissions differ unexpectedly from their parents.

How to use it

1. Run AccessEnum.exe as Administrator.
2. Choose a directory or Registry path.
3. Click Scan.
4. Sort and compare entries with unusually broad permissions.
5. Export results before changing ACLs.

Caution It is an auditing tool. Do not start changing ACLs simply because an entry looks unfamiliar; inherited permissions and service-specific ACLs can be intentional.

---

Security & Malware Triage

Sigcheck

What it is Reports file version, hashes, timestamps and digital-signature details, and can query VirusTotal status.

When to use it Use for executable/DLL verification, suspicious-file triage, signer auditing and hunting unsigned binaries.

How to use it

sigcheck -u -e C:\Windows\System32
sigcheck -h "C:\Path\file.exe"
sigcheck -a -h -i "C:\Path\file.exe"

VirusTotal features are optional and should be used with care because file hashes, and in some modes files themselves, may be sent to an external service.

Caution Unsigned does not mean malicious, and signed does not mean safe. Do not upload confidential/proprietary files to VirusTotal without permission.

---

Security & Encryption

EFSDump

What it is Displays information about files encrypted with EFS and the accounts/certificates authorised to decrypt them.

When to use it Use it during EFS recovery investigations or before account/certificate changes.

How to use it

efsdump "C:\path"

Use recursive options shown by efsdump -? when auditing a directory tree.

Caution EFS recovery depends on keys and certificates. Merely changing NTFS permissions does not decrypt EFS data.

---

Security & Logon

Autologon

What it is Configures Windows automatic logon using supplied credentials.

When to use it Useful for kiosks, lab systems and controlled appliances where an unattended sign-in is required.

How to use it

1. Run Autologon.exe.
2. Enter username, domain and password.
3. Select Enable.
4. Use the same tool to disable automatic logon later.

Caution Automatic logon reduces physical-login security. Do not use it on ordinary laptops, shared computers or machines holding sensitive data unless the risk is explicitly accepted.

---

LogonSessions

What it is Lists active Windows logon sessions and can display processes associated with them.

When to use it Useful for determining who or what is logged on, distinguishing service/network/interactive sessions and investigating authentication activity.

How to use it

logonsessions
logonsessions -p

Run elevated for the fullest process/session mapping.

Caution Service and network logons are normal. A large list is not, by itself, evidence of compromise.

---

Security / PsTools

PsGetSid

What it is Translates account names to SIDs and SIDs back to account names, locally or remotely.

When to use it Useful when ACLs or logs contain raw SIDs, or when verifying account/domain identity.

How to use it

psgetsid username
psgetsid S-1-5-...
psgetsid \\PCNAME username

Caution Similar-looking account names on different machines/domains can have different SIDs. The SID is the security identity that matters.

---

PsLoggedOn

What it is Shows users logged on locally and users with resource connections to a system.

When to use it Use before rebooting/maintaining a remote PC or when investigating who has sessions against a machine.

How to use it

psloggedon
psloggedon \\PCNAME

Caution Remote resource connections and interactive logons are different things. Read the session type before deciding someone is actively using the keyboard.

---

Secure Deletion

SDelete

What it is Securely overwrites file data or free space so previously deleted content is harder to recover.

When to use it Use when securely retiring sensitive data on storage where overwriting semantics are meaningful.

How to use it

sdelete -?
sdelete "C:\Sensitive\file.ext"

For free-space cleaning, build the command from current help and verify you selected the correct volume.

Caution On SSDs, wear levelling, TRIM and controller behaviour mean overwrite assumptions differ from HDDs. Use full-disk encryption and proper device sanitisation for high-assurance SSD disposal.

---

File & Disk

Contig

What it is Defragments individual files or creates new files contiguously.

When to use it Useful for targeted fragmentation work without running a full-volume optimisation.

How to use it

contig -?
contig "C:\path\largefile.dat"
contig -s "C:\SomeFolder"

Use the help output to select recursive or analysis modes as required.

Caution Mostly relevant to HDDs and specialised workloads. Do not treat SSDs like 2003-era spinning disks in desperate need of hand-polished file extents.

---

DiskExt

What it is Shows the physical disk extents that make up a volume.

When to use it Useful when determining which physical disk(s) back a Windows volume, especially with dynamic/spanned arrangements.

How to use it

diskext

Use the output to map volume letters to disk extents before low-level storage work.

Caution Confirm disk identity separately before destructive operations. Drive letters are not stable identities.

---

DiskMon

What it is Monitors and logs physical disk activity.

When to use it Use it to observe bursts of disk I/O and correlate them with a problem.

How to use it Run Diskmon.exe, clear the display, reproduce the disk activity and save the resulting log for comparison with Process Monitor or Resource Monitor.

Caution It shows low-level activity, not necessarily which high-level application caused every operation. Pair with Process Monitor when attribution matters.

---

DiskView

What it is Graphical disk-sector/cluster visualisation utility.

When to use it Useful for examining how files occupy a volume and visualising fragmentation/layout.

How to use it Run DiskView.exe, choose the target volume, scan it, then select regions/files to inspect their allocation on disk.

Caution Primarily an analysis/visualisation tool. Do not infer SSD performance from traditional HDD-style layout assumptions.

---

DU (Disk Usage)

What it is Command-line directory-size calculator.

When to use it Use it to find where disk space has gone, script usage reports or compare folder growth over time.

How to use it

du "C:\Users"
du -nobanner "C:\SomeFolder"
du -?

Redirect output to a file for before/after comparisons.

Caution Run elevated if you need visibility into protected directories; otherwise access-denied paths can make totals incomplete.

---

FindLinks

What it is Reports file hard links and can show which paths reference the same underlying file record.

When to use it Use it when storage usage, dedup-like behaviour or suspicious duplicate-looking files may involve NTFS hard links.

How to use it

findlinks "C:\path\file.ext"

Compare returned paths before deleting or replacing any linked file.

Caution Deleting one hard-link name does not necessarily delete the file data while other links remain.

---

Junction

What it is Creates and inspects NTFS junction points.

When to use it Use it to examine reparse-point based directory redirects or create a deliberate directory junction.

How to use it

junction "C:\SomePath"
junction "C:\Link" "D:\Target"
junction -d "C:\Link"

Inspect first, modify second.

Caution Deleting the wrong path around junctions can have surprising consequences. Know whether you are deleting the link or content beneath the target.

---

LDMDump

What it is Examines Logical Disk Manager metadata used by Windows dynamic disks.

When to use it Useful for advanced recovery/diagnostic work on dynamic-disk configurations.

How to use it Run ldmdump from an elevated command prompt and use ldmdump -? for the supported target/switch syntax on the current build.

Caution Dynamic-disk metadata work is specialist territory. Capture images and configuration details before making storage changes.

---

NTFSInfo

What it is Displays detailed NTFS volume metadata including cluster size, MFT location/size and other filesystem structures.

When to use it Use it for filesystem investigations, capacity/layout analysis and advanced recovery context.

How to use it

ntfsinfo C:

Record the output before major filesystem recovery work.

Caution Diagnostic only. Understanding MFT and metadata layout does not make manual filesystem surgery safe.

---

Sync

What it is Flushes filesystem cached data to disk.

When to use it Useful in specialised testing or before certain removable/offline operations where you need to request cache flushes.

How to use it

sync
sync C:

Check sync -? for supported targeting on the current build.

Caution A successful flush does not replace backups, application-level transaction handling or safe-removal procedures.

---

VolumeID

What it is Changes the volume serial number of FAT or NTFS volumes.

When to use it Use only when a legacy application, cloned environment or lab scenario specifically requires a different volume ID.

How to use it

volumeid C:
volumeid C: XXXX-XXXX

Follow the exact format shown by volumeid -? for the filesystem.

Caution Changing a volume serial can affect licensing, scripts or software that uses it as an identifier. Record the original first.

---

File & Recovery

MoveFile

What it is Schedules a file move, rename or deletion for the next reboot so locked files can be handled before normal processes open them.

When to use it Use it for stubborn files that legitimately need replacing or deleting at boot.

How to use it

movefile "C:\Path\old.dll" "C:\Path\new.dll"
movefile "C:\Path\locked.tmp" ""

Then use PendMoves to verify what is queued.

Caution A typo can schedule deletion/replacement of critical boot files. Verify the pending operation before rebooting.

---

PendMoves

What it is Shows file rename/delete operations scheduled for the next boot.

When to use it Use it when an installer, malware cleanup or repair says a reboot is required to replace/delete files.

How to use it

pendmoves

Review queued operations before restarting, especially after manually using MoveFile.

Caution Unexpected pending changes to system files deserve investigation before reboot.

---

Imaging & Recovery

Disk2vhd

What it is Creates VHD/VHDX images from physical disks/volumes using Windows snapshot capabilities.

When to use it Excellent before risky repair work, for P2V migration, forensic-style preservation, or keeping a bootable-ish copy of a physical Windows system.

How to use it

1. Run Disk2vhd.exe as Administrator.
2. Select the required volumes, including boot/system partitions if you want a bootable VM image.
3. Prefer VHDX unless compatibility requires VHD.
4. Save the image to a different physical disk.
5. Mount the resulting VHDX read-only where practical to verify it.

Caution An image is not a backup until you verify it. Do not save the only recovery image onto the failing disk being imaged.

---

Registry

RegJump

What it is Opens Registry Editor directly at a specified Registry path.

When to use it Useful when documentation, a log or another tool gives you a long Registry path that you need to inspect.

How to use it

regjump "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion"
regjump "HKCU\Software"

Caution Jumping to a key is safe; changing random values because a forum post said so remains one of computing's oldest folk rituals.

---

RU (Registry Usage)

What it is Reports Registry space usage for a specified key/branch.

When to use it Use to find unusually large Registry branches or compare Registry growth.

How to use it

ru "HKLM\Software"
ru -?

Use recursive options carefully on large hives.

Caution Large Registry size is not automatically a fault. Identify what owns the data before cleanup.

---

Registry & Recovery

RegDelNull

What it is Finds and removes Registry keys containing embedded null characters that normal Registry tools cannot handle.

When to use it Use when malformed or malicious Registry keys cannot be deleted normally.

How to use it

regdelnull -?

Scan first. Delete only keys you have positively identified as invalid or unwanted.

Caution Registry deletion is irreversible without a backup/export. Create a restore/recovery path first.

---

System Information & Support

BgInfo

What it is Writes selected system information onto the desktop wallpaper or background.

When to use it Useful on repair benches, servers and VMs so hostname, IP, OS version, boot time and hardware facts are visible at a glance.

How to use it

1. Run Bginfo.exe.
2. Choose the fields you want.
3. Adjust position and appearance.
4. Use Apply for the current system.
5. Save a .bgi configuration if you want a reusable layout.

Caution Avoid placing passwords, serial numbers, private IP details or other sensitive information on a desktop that might be photographed or screen-shared.

---

System Information / PsTools

PsInfo

What it is Reports Windows system information locally or remotely.

When to use it Use it for quick inventory of OS, uptime, installation details and system configuration.

How to use it

psinfo
psinfo \\PCNAME
psinfo -d
psinfo -h

Use psinfo -? to select the categories required for your inventory.

Caution Remote queries require suitable permissions and Windows networking/firewall access.

---

CPU & Hardware

Coreinfo

What it is Displays relationships between logical processors, cores, sockets, NUMA nodes, caches and supported CPU features.

When to use it Use it to understand CPU topology, verify virtualisation/security instruction support, or troubleshoot affinity and NUMA-sensitive workloads.

How to use it

coreinfo
coreinfo -c
coreinfo -n
coreinfo -f

Run coreinfo -? to see current switches and feature legends.

Caution Virtual machines may expose synthetic or restricted CPU topology. Interpret output in the context of the hypervisor.

---

Drivers & Boot

LoadOrder

What it is Shows driver/service load-order information.

When to use it Use it when boot behaviour depends on driver groups, services or ordering.

How to use it Run LoadOrd.exe elevated and review drivers/services in the displayed load order. Compare suspicious or recently installed drivers with a known-good machine.

Caution Do not disable drivers merely because they load early. Storage, encryption and security drivers often must.

---

Services / PsTools

PsService

What it is Lists, queries, starts, stops, pauses and controls Windows services locally or remotely.

When to use it Use for service troubleshooting and remote administration.

How to use it

psservice query
psservice query servicename
psservice start servicename
psservice stop servicename
psservice \\PCNAME query

Caution Stopping dependency-heavy, security, networking, storage or authentication services can disconnect or destabilise the system.

---

Power / PsTools

PsShutdown

What it is Shuts down, reboots, locks or otherwise changes power/session state locally or remotely, with scheduling/countdown options.

When to use it Use for authorised remote restarts and controlled maintenance windows.

How to use it

psshutdown -?
psshutdown -r -t 60
psshutdown \\PCNAME -r -t 60

Confirm the target name before pressing Enter. Computers, unlike people, tend to obey catastrophic instructions literally.

Caution Always check for logged-on users and critical jobs before remote shutdown/reboot.

---

Processes / PsTools

PsKill

What it is Terminates processes by name or PID locally or remotely.

When to use it Use when a process cannot be stopped normally and you have already identified it correctly.

How to use it

pskill 1234
pskill processname
pskill \\PCNAME processname

Caution It is deliberately forceful. Killing the wrong process can terminate sessions, corrupt unsaved data or destabilise a service.

---

PsList

What it is Lists detailed process and thread information locally or remotely.

When to use it Useful for command-line process inventory, scripting and checking remote systems without a full GUI.

How to use it

pslist
pslist processname
pslist \\PCNAME
pslist -t

Check pslist -? for tree, thread and refresh options.

Caution Snapshot data can change immediately. Re-run or use monitoring options for intermittent behaviour.

---

PsSuspend

What it is Suspends and resumes processes without terminating them.

When to use it Useful to temporarily freeze a runaway application for investigation or to confirm whether it is causing resource contention.

How to use it

pssuspend processname
pssuspend -r processname

Use PID targeting when multiple processes share the same name.

Caution Suspending a process that owns locks, UI threads or service dependencies can freeze other software. Resume it promptly.

---

Logs / PsTools

PsLogList

What it is Command-line Event Log reader with local and remote support.

When to use it Use for scripted Event Log collection, filtered remote diagnostics or text-based incident bundles.

How to use it

psloglist System
psloglist Application
psloglist \\PCNAME System
psloglist -?

Use filters from the built-in help to restrict time, source or event criteria.

Caution Event logs can contain usernames, hostnames and operational data. Preserve original timestamps and avoid casually editing exported evidence.

---

Account Administration / PsTools

PsPasswd

What it is Changes local or domain account passwords, including on remote systems when authorised.

When to use it Useful for controlled administrative password changes across systems.

How to use it

pspasswd username
pspasswd \\PCNAME username

Prefer prompts over embedding passwords in command history or scripts.

Caution Password changes can break scheduled tasks, services or applications that still use the old credentials.

---

Remote Administration / PsTools

PsExec

What it is Runs processes locally or on remote Windows systems, including under alternate accounts or the SYSTEM account.

When to use it Use it for remote command-line administration, collecting diagnostics from another PC, or running a local diagnostic tool as SYSTEM when necessary.

How to use it

psexec \\PCNAME cmd
psexec \\PCNAME ipconfig /all
psexec -s -i cmd.exe

Use -c only when you deliberately need to copy an executable to the remote machine. Prefer interactive credential entry rather than putting passwords into reusable scripts.

Caution PsExec is dual-use and often flagged by security products because attackers use it too. Remote execution should be authorised, logged and constrained.

---

PsFile

What it is Lists files opened remotely on a Windows system and can close those remote file handles.

When to use it Use it when a network share file is locked by another workstation or user.

How to use it

psfile
psfile \\SERVER
psfile \\SERVER pathpart

List first; close a remote handle only when you understand which user/application owns it.

Caution Forcibly closing a remote file can cause data loss, especially with databases, Office files and applications that buffer writes.

---

PsTools

What it is The family containing PsExec, PsFile, PsGetSid, PsInfo, PsKill, PsList, PsLoggedOn, PsLogList, PsPasswd, PsPing, PsService, PsShutdown and PsSuspend.

When to use it Use PsTools when you want scriptable local/remote Windows administration without a heavyweight management console.

How to use it General pattern:

toolname -?
toolname \\COMPUTER [options]

Many PsTools can authenticate with alternate credentials. Prefer secure interactive/admin workflows rather than storing passwords in batch files.

Caution Remote administration must be authorised. Endpoint security may detect PsTools because the same capabilities are useful to attackers.

---

Remote Desktop

RDCMan

What it is Remote Desktop Connection Manager for organising and working with many RDP connections.

When to use it Useful for homelabs, server fleets and support environments where many RDP targets need grouping and consistent settings.

How to use it

1. Create a group/file.
2. Add servers by hostname/IP.
3. Set inherited display, gateway and credential options at the appropriate group level.
4. Connect to individual servers or groups as required.
5. Protect saved connection files and credentials.

Caution Treat connection files as sensitive. Use strong credential hygiene and avoid exposing RDP directly to the internet.

---

Network Shares & Security

ShareEnum

What it is Scans Windows network shares and reports their security settings.

When to use it Use it to find unexpectedly exposed shares or weak share permissions on a network you administer.

How to use it Run ShareEnum.exe, choose the authorised domain/workgroup scope, scan, then inspect share and NTFS permissions for unnecessary exposure.

Caution Only scan networks you are authorised to administer. Share permissions and NTFS permissions combine, so review both.

---

Active Directory

ADExplorer

What it is Advanced Active Directory viewer and editor with searching, navigation, snapshots and comparison features.

When to use it Use it to inspect AD objects and attributes, search a directory, or capture an AD snapshot for offline inspection/comparison.

How to use it

1. Launch ADExplorer.exe.
2. Connect to a domain controller or directory service.
3. Browse the directory tree or use Search.
4. Use snapshots before large investigations so you can compare states later.
5. Edit only when you understand the attribute and replication impact.

Caution AD changes can replicate across the domain. Read-only investigation first; editing production AD is not the place for experimental clicking.

---

ADInsight

What it is Real-time LDAP monitoring utility for troubleshooting Active Directory client applications.

When to use it Use it when an application is making LDAP calls and you need to see the requests, responses, timing, filters and failures.

How to use it

1. Run ADInsight.exe elevated.
2. Start capture.
3. Reproduce the AD/LDAP problem.
4. Stop capture.
5. Filter by process, operation, server or result and inspect the failing sequence.

Caution Captures can include directory names, account information and query content. Handle logs as potentially sensitive diagnostic data.

---

ADRestore

What it is Command-line utility for discovering and restoring tombstoned Active Directory objects where supported.

When to use it Use it after an accidental AD object deletion when recovery from tombstone information is appropriate.

How to use it

adrestore
adrestore -r

Run without aggressive options first to enumerate candidates and read the built-in help for the exact restore workflow on the target environment.

Caution Modern AD also has the Recycle Bin and other recovery mechanisms. Choose the recovery method that preserves the most attributes and relationships.

---

Processes & IPC

PipeList

What it is Lists named pipes on the system.

When to use it Useful when troubleshooting inter-process communication, service/client communication or identifying named-pipe attack surface.

How to use it

pipelist

Capture output while the relevant application/service is running.

Caution A named pipe is not suspicious merely because its name is unfamiliar.

---

Legacy Port Monitoring

PortMon

What it is Monitors serial and parallel port activity.

When to use it Useful for legacy hardware, industrial equipment and applications communicating through COM/LPT ports.

How to use it Run Portmon.exe, select the relevant ports, clear the display, reproduce the hardware/software communication and save the trace.

Caution Mostly relevant to legacy or specialist hardware. Modern USB devices often use different driver stacks.

---

Windows Internals

WinObj

What it is Graphical browser for the Windows Object Manager namespace.

When to use it Use for advanced investigation of named kernel objects such as devices, symbolic links, sections, events, mutexes and object directories.

How to use it Run WinObj.exe elevated and browse paths such as \Device, \GLOBAL?? and \BaseNamedObjects. Use it mainly to understand how names map to kernel objects and devices.

Caution This is an internals inspection tool. Familiarity with Object Manager concepts is needed before drawing security or reliability conclusions.

---

Kernel Debugging

LiveKd

What it is Allows Microsoft kernel debuggers to inspect a live Windows system using a crash-dump-like view.

When to use it Use it for advanced kernel, driver and memory-manager investigation without deliberately crashing the machine.

How to use it Install a compatible Windows debugger, run livekd elevated, and follow the current livekd -? syntax to launch the debugger against the live system.

Caution Kernel debugging assumes you understand debugger commands and kernel structures. It is powerful enough to produce extremely confident nonsense if interpreted badly.

---

Debugging

DebugView

What it is Captures application and kernel debug output without requiring a debugger.

When to use it Use it when software emits OutputDebugString or kernel debug messages and you need a live trace.

How to use it

1. Run Dbgview.exe elevated.
2. Enable the capture types you need.
3. Clear the window.
4. Reproduce the issue.
5. Save the trace and correlate timestamps with the failure.

Caution High-volume traces become noisy quickly. Capture the shortest reproduction window possible.

---

Binary / Malware Triage

Strings

What it is Extracts printable ANSI/Unicode strings from binary files.

When to use it Useful for quick triage of executables, DLLs, dumps and unknown files to find URLs, paths, commands, error text or embedded names.

How to use it

strings suspicious.exe
strings -n 8 suspicious.exe
strings suspicious.exe > strings.txt

Search the output for URLs, domains, PowerShell fragments, paths and distinctive error text.

Caution Strings are clues, not proof of behaviour. Data can be unused, compressed, encrypted or deliberately misleading.

---

Utility / Conversion

Hex2dec

What it is Converts hexadecimal numbers to decimal and decimal numbers to hexadecimal.

When to use it Handy when reading addresses, flags, error values or low-level diagnostic output.

How to use it

hex2dec 0xFF
hex2dec 255

Check hex2dec -? for accepted forms.

Caution A convenience tool, not a diagnostic conclusion generator. The converted number still needs context.

---

Desktop / Session Utility

Desktops

What it is Creates multiple Windows desktops using native desktop objects.

When to use it Useful for isolating sets of applications or demonstrating Windows desktop-object behaviour.

How to use it Run Desktops.exe, configure the hotkey and number of desktops, then switch using the configured key combination or tray icon.

Caution This is not the same implementation as modern Windows Task View virtual desktops, and applications may behave differently across desktop objects.

---

Keyboard / Driver Utility

Ctrl2Cap

What it is Kernel-mode keyboard filter that maps Caps Lock to Control.

When to use it Useful only if you deliberately want that keyboard remapping.

How to use it Run the utility with its install option as documented in ctrl2cap -?, reboot if requested, and verify the mapping before relying on it.

Caution It installs a keyboard filter driver. Do not deploy casually on someone else's repair target.

---

Presentation & Support

ZoomIt

What it is Screen zoom, annotation, drawing and presentation utility.

When to use it Excellent for remote support, training, screen recording and highlighting tiny UI elements without making everyone squint at a 4K desktop.

How to use it

1. Run ZoomIt.exe.
2. Configure hotkeys.
3. Use zoom mode to magnify an area.
4. Use drawing/annotation mode during demonstrations.
5. Use break/timer features where useful.

Caution Check hotkeys before a live session so they do not conflict with the application you are demonstrating.

---

Demonstration / Security Research

RegHide

What it is Demonstration utility showing how Registry data with embedded nulls can be hidden from ordinary tools.

When to use it Useful for security training and understanding why RegDelNull exists.

How to use it Use only in a disposable lab VM and follow its built-in instructions to create/observe the demonstration key.

Caution This is a demonstration of an evasion technique, not a repair utility. Keep it out of casual production use.

---

Demonstration / Novelty

BlueScreen

What it is A simulated blue-screen screen saver intended as a convincing demonstration rather than a repair utility.

When to use it Mostly useful for demos, training and causing unnecessary alarm in rooms full of Windows administrators.

How to use it Run the included BlueScreen screen saver only in a test or demonstration context. It simulates crash-style output; it is not a BSOD diagnostic utility.

Caution Do not use it to diagnose real crashes. For real crash work use Event Viewer, dump files, WinDbg, ProcDump or LiveKd.

---

Testing / Dangerous

NotMyFault

What it is Deliberately triggers crashes, hangs, leaks and other kernel/system failures for driver, dump and recovery testing.

When to use it Use only in disposable VMs or dedicated test systems to test crash-dump collection, watchdogs and recovery procedures.

How to use it Lab workflow only

1. Create a VM snapshot.
2. Ensure crash-dump settings are configured.
3. Run NotMyFault inside the VM.
4. Select the specific fault type required by the test.
5. Analyse the resulting behaviour/dump.

Caution ⚠️ Do not run on a machine containing unsaved work or important services. It is intentionally capable of crashing or hanging Windows.

---

• [AccessChk](#accesschk) — Security & Permissions
• [AccessEnum](#accessenum) — Security & Permissions
• [ADExplorer](#adexplorer) — Active Directory
• [ADInsight](#adinsight) — Active Directory
• [ADRestore](#adrestore) — Active Directory
• [Autologon](#autologon) — Security & Logon
• [Autoruns](#autoruns) — Startup, Persistence & Malware Triage
• [BgInfo](#bginfo) — System Information & Support
• [BlueScreen](#bluescreen) — Demonstration / Novelty
• [CacheSet](#cacheset) — Memory & Performance
• [ClockRes](#clockres) — System Information & Performance
• [Contig](#contig) — File & Disk
• [Coreinfo](#coreinfo) — CPU & Hardware
• [Ctrl2Cap](#ctrl2cap) — Keyboard / Driver Utility
• [DebugView](#debugview) — Debugging
• [Desktops](#desktops) — Desktop / Session Utility
• [Disk2vhd](#disk2vhd) — Imaging & Recovery
• [DiskExt](#diskext) — File & Disk
• [DiskMon](#diskmon) — File & Disk
• [DiskView](#diskview) — File & Disk
• [DU (Disk Usage)](#du-disk-usage) — File & Disk
• [EFSDump](#efsdump) — Security & Encryption
• [FindLinks](#findlinks) — File & Disk
• [Handle](#handle) — Processes & Handles
• [Hex2dec](#hex2dec) — Utility / Conversion
• [Junction](#junction) — File & Disk
• [LDMDump](#ldmdump) — File & Disk
• [ListDLLs](#listdlls) — Processes & Modules
• [LiveKd](#livekd) — Kernel Debugging
• [LoadOrder](#loadorder) — Drivers & Boot
• [LogonSessions](#logonsessions) — Security & Logon
• [MoveFile](#movefile) — File & Recovery
• [NotMyFault](#notmyfault) — Testing / Dangerous
• [NTFSInfo](#ntfsinfo) — File & Disk
• [PendMoves](#pendmoves) — File & Recovery
• [PipeList](#pipelist) — Processes & IPC
• [PortMon](#portmon) — Legacy Port Monitoring
• [ProcDump](#procdump) — Crash & Hang Diagnostics
• [Process Explorer](#process-explorer) — Processes & Handles
• [Process Monitor](#process-monitor) — Tracing & Deep Diagnostics
• [PsExec](#psexec) — Remote Administration / PsTools
• [PsFile](#psfile) — Remote Administration / PsTools
• [PsGetSid](#psgetsid) — Security / PsTools
• [PsInfo](#psinfo) — System Information / PsTools
• [PsKill](#pskill) — Processes / PsTools
• [PsList](#pslist) — Processes / PsTools
• [PsLoggedOn](#psloggedon) — Security / PsTools
• [PsLogList](#psloglist) — Logs / PsTools
• [PsPasswd](#pspasswd) — Account Administration / PsTools
• [PsPing](#psping) — Networking / PsTools
• [PsService](#psservice) — Services / PsTools
• [PsShutdown](#psshutdown) — Power / PsTools
• [PsSuspend](#pssuspend) — Processes / PsTools
• [PsTools](#pstools) — Remote Administration / PsTools
• [RAMMap](#rammap) — Memory & Performance
• [RDCMan](#rdcman) — Remote Desktop
• [RegDelNull](#regdelnull) — Registry & Recovery
• [RegHide](#reghide) — Demonstration / Security Research
• [RegJump](#regjump) — Registry
• [RU (Registry Usage)](#ru-registry-usage) — Registry
• [SDelete](#sdelete) — Secure Deletion
• [ShareEnum](#shareenum) — Network Shares & Security
• [ShellRunas](#shellrunas) — Security & Administration
• [Sigcheck](#sigcheck) — Security & Malware Triage
• [Streams](#streams) — File & Security
• [Strings](#strings) — Binary / Malware Triage
• [Sync](#sync) — File & Disk
• [Sysmon](#sysmon) — Security Monitoring
• [TCPView](#tcpview) — Networking
• [VMMap](#vmmap) — Memory & Performance
• [VolumeID](#volumeid) — File & Disk
• [WhoIs](#whois) — Networking / Internet
• [WinObj](#winobj) — Windows Internals
• [ZoomIt](#zoomit) — Presentation & Support

---

Appendix A — My recommended recovery order

For a typical unknown Windows fault:

1. Do not delete anything yet.
2. Check backups / consider Disk2vhd if the repair is risky.
3. PsInfo / basic system inventory.
4. Process Explorer.
5. Autoruns.
6. TCPView.
7. RAMMap if memory is relevant.
8. DU if storage is relevant.
9. Process Monitor for the specific failing application/action.
10. Sigcheck / Strings / Streams if a file is suspicious.
11. ProcDump if the application crashes or hangs.
12. Make the smallest reversible change possible.
13. Re-test.
14. Record what changed.

Appendix B — "Which tool do I need?"

Appendix C — Tools to keep away from casual use

These are legitimate tools but deserve an extra warning label:

NotMyFault

Designed to cause faults, hangs, leaks and crashes.

Use in disposable labs only.

RegHide

Security demonstration involving hidden Registry data.

Use in a VM, not as an everyday Registry tool.

SDelete

Can permanently destroy recoverable file data.

Verify the target twice.

VolumeID

Changes a filesystem identifier that some software may depend on.

Record the original first.

MoveFile

Can schedule replacement/deletion of files at reboot.

Check with PendMoves before reboot.

PsKill / PsShutdown / PsExec

Powerful remote-control tools.

Verify the machine name before execution.

---

End of Field Guide

Keep the guide beside the tools on the recovery drive so it remains usable when the target PC has no internet connection.