Windows Sysinternals Suite 2025.11.11 A complete set of utilities…

Sysinternals Suite A complete set of very useful and well-known tools in the field of troubleshooting and fixing problems Windows in the form of a package Softwarehas provided for you. The tools in the Sysinternals collection also have a help file. Using Sysinternals helps you, as one of the IT specialists or developers, to be able to find and diagnose defects in the Windows operating system and software.

Tools available in Sysinternals Suite:

• AccessChk: A command-line tool for viewing effective permissions on files, registry keys, services, processes, kernel objects, and more.
• AccessEnum: This simple yet powerful security tool shows you who has access to the directories, files and registry keys on your system. Use it to find holes in your licenses.
• AdExplorer: is an advanced Active Directory (AD) viewer and editor.
• AdInsight: A real-time LDAP (Lightweight Directory Access Protocol) monitoring tool aimed at troubleshooting Active Directory client applications.
• AdRestore: Delete Active Directory Server 2003 objects.
• Autologon: Bypassing the password screen during login.
• Autoruns: See what programs are configured to start automatically at system boot and logon. Autoruns also shows you a complete list of registry and file locations where programs can configure auto-start settings.
• BgInfo: This app is fully customizable to automatically set backgrounds Desktop which contains important information about the system including IP addresses, computer names, network adapters, etc.
• BlueScreen: This screen saver not only accurately simulates a blue screen, but also performs a simulated reboot (complete with CHKDSK), and on Windows Works with NT 4, Windows 2000, Windows XP, Server 2003, and Windows 95 and 98.
• CacheSet: is a program that allows you to control the size of the Cache Manager’s working set using functions provided by NT. It is compatible with all versions of NT.
• ClockRes: View the system clock resolution, which is also the timer’s maximum resolution.
• Contig: Wish you could quickly integrate your frequently used files? Use Contig to optimize individual files or create new files that are contiguous.
• Coreinfo: A new command-line tool that shows you the mapping between logical processors and physical processor, the NUMA node and socket they reside on, as well as the cache allocated to each logical processor.
• Ctrl2cap: This is a kernel-mode driver that exposes the keyboard input filter right above the keyboard class driver to convert caps-locks to control keys. Filtering at this level allows converting and hiding keys before NT even “sees” them. Ctrl2cap also shows how to use NtDisplayString() to print messages on the initial blue screen.
• DebugView: Another first from Sysinternals: this program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It is possible to view and record the debug session output on your local machine or across Internet Gives without active debugger.
• Desktops: This new tool allows you to create up to four virtual desktops and use a tray interface or hotkeys to preview what’s on each desktop and easily switch between them.
• Disk2vhd: It simplifies the migration of physical systems to virtual machines (p2v.md).
• DiskExt: Display disk volume map.
• Diskmon: This tool records all hard disk activity or like a disk activity light Software It works in your system tray.
• DiskView: Tool section Graphicsdisk
• Disk Usage (DU): View disk usage by directory.
• EFSDump: View information of encrypted files.
• FindLinks: Reports the file directory and any hard links (alternative file paths on the same volume.md) that exist for the specified file. A file’s data is allocated as long as at least one filename refers to it.
• Handle: This handy command-line tool shows you what files are opened by which processes and more.
• Hex2dec: Convert hex numbers to decimal and decimalphoto.
• Junction: Create Win2K NTFS symbolic links.
• LDM Dump: Dump the contents of the Logical Disk Manager on-disk database that describes the partitioning of Windows 2000 Dynamic disks.
• ListDLLs: A list of all DLLs that are currently loaded, including where they were loaded and their version numbers.
• LiveKd: Use Microsoft’s kernel debuggers to check a live system.
• LoadOrder: View the loading order of the devices on your WinNT/2K system.
• LogonSessions: List of active login sessions in a system.
• MoveFile: Allows you to schedule transfer and delete commands for the next reboot.
• NotMyFault: is a tool that you can use to crash, hang and leak kernel memory on your Windows system.
• NTFSInfo: Use NTFSInfo to view detailed information about NTFS volumes, including the size and location of the main file table (MFT) and MFT area, as well as the size of NTFS metadata files.
• PendMoves: Enumerate a list of file rename and delete commands that will be executed at the next boot.
• PipeList: Displays the named pipes on your system, including the maximum number of samples and active samples for each pipe.
• PortMon: Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you part of the send and receive data. The new 3.x version is powerful with user interface improvements and advanced filtering capabilities.
• ProcDump: This command line tool is designed to capture dump processes from points that are difficult to isolate and reproduce. It also acts as a generic process dump tool and can also monitor and generate a process dump when a process has a hung window or unhandled exception.
• Process Explorer: Find out what files, registry keys, and other objects are open processes, which DLLs they have loaded, and more. This uniquely powerful tool even shows you who owns each process.
• Process Monitor: Monitor file system, registry, process, thread and DLL activity in real time.
• PsExec: Implementation of processes in remote systems.
• PsFile: See what files are opened remotely.
• PsGetSid: Displays the SID of the computer or user.
• PsInfo: Obtain information about a system.
• PsKill: Terminate local or remote processes.
• PsPing: Measure network performance.
• PsList: Display information about processes and threads.
• PsLoggedOn: Display users who are logged in to the system.
• PsLogList: Dump event log records.
• PsPasswd: Changes the account password.
• PsService: View and control services.
• PsShutdown: Shuts down and optionally restarts the computer.
• PsSuspend: Suspend and resume processes.
• PsTools: The PsTools suite includes command-line tools for listing processes running on local or remote computers, running processes remotely, rebooting computers, deleting event logs, and more.
• RAMMap: An advanced tool is Physical Memory Usage Analysis, which presents usage information in several different ways in several different tabs.
• RDCMan: Manage multiple Remote Desktop connections.
• RegDelNull: Scan and remove registry keys that contain embedded null characters that cannot otherwise be removed by standard registry editing tools.
• Registry Usage (RU): View the registry space usage for the specified registry key.
• RegJump: Navigate to the registry path you specified in Regedit.
• SDelete: Securely overwrite your sensitive files and clear your space of previously deleted files with this DoD-compliant secure deletion program.
• ShareEnum: Scan file shares on your network and view their security settings to close security holes.
• ShellRunas: Launch applications as a different user via a shell context menu entry.
• Sigcheck: Dump the file version information and verify that the images on your system are digitally signed.
• Streams: Expose alternate NTFS streams.
• Strings: Search for ANSI and UNICODE strings in binary images.
• Sync: Clear cached data to disk.
• Sysmon: Monitors and reports key system activities through the Windows Event Log.
• TCPView: Active socket display.
• VMMap: It is a process virtual and physical memory analysis tool.
• VolumeId: Set the volume ID of FAT or NTFS drives.
• Whois: See who owns a web address.
• WinObj: Here is the final Object Manager namespace viewer.
• ZoomIt: Presentation tools for zooming and drawing on the screen.