Windows® Sysinternals Administrator’s Reference Mark Russinovich Aaron Margosis PUBLISHED BY Microsoft Press A Division of Microsoft Corporation One Microsoft Way Redmond, Washington 98052-6399 Copyright © 2011 by Aaron Margosis and Mark Russinovich All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Library of Congress Control Number: 2011931614 ISBN: 978-0-7356-5672-7 4 5 6 7 8 9 10 11 12 LSI 7 6 5 4 3 2 Printed and bound in the United States of America. Microsoft Press books are available through booksellers and distributors worldwide. If you need support related to this book, email Microsoft Press Book Support at [email protected]. Please tell us what you think of this book at http://www.microsoft.com/learning/booksurvey. Microsoft and the trademarks listed at http://www.microsoft.com/about/legal/en/us/IntellectualProperty/ Trademarks/EN-US.aspx are trademarks of the Microsoft group of companies. All other marks are property of their respective owners. The example companies, organizations, products, domain names, email addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred. This book expresses the author’s views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. Acquisitions Editor: Devon Musgrave Developmental Editor: Devon Musgrave Project Editor: Devon Musgrave Editorial Production: Waypoint Press Technical Reviewer: Christophe Nassare; Technical Review services provided by Content Master, a member of CM Group, Ltd. Copyeditor: Roger LeBlanc Indexer: Christina Yeager Cover: Twist Creative.Seattle [2012-10-19] To my fellow Windows troubleshooters: Never give up! Never surrender! — Mark Russinovich To Elise, who makes great things possible and then makes sure they happen. (And who is much cooler than I am.) — Aaron Margosis Contents at a Glance Part I Getting Started 1 Getting Started with the Sysinternals Utilities . 3 2 Windows Core Concepts . 15 Part II Usage Guide 3 Process Explorer . 39 4 Process Monitor . 101 5 Autoruns . 145 6 PsTools . 171 7 Process and Diagnostic Utilities . 211 8 Security Utilities . 261 9 Active Directory Utilities . 287 10 Desktop Utilities . 309 11 File Utilities . 325 12 Disk Utilities . 335 13 Network and Communication Utilities . 351 14 System Information Utilities . 359 15 Miscellaneous Utilities . 377 Part III Troubleshooting—”The Case of the Unexplained...” 16 Error Messages . 383 17 Hangs and Sluggish Performance . 405 18 Malware . 427 v Table of Contents Foreword . .xix Introduction . .xxi Tools the Book Covers . .xxi The History of Sysinternals . .xxi Who Should Read This Book . xxv Assumptions . xxv Organization of This Book . xxv Conventions and Features in This Book . .xxvi System Requirements . .xxvi Acknowledgments . xxvii Errata & Book Support . xxviii We Want to Hear from You . xxviii Stay in Touch . xxviii Part I Getting Started 1 Getting Started with the Sysinternals Utilities . 3 Overview of the Utilities . 3 The Windows Sysinternals Web Site . 6 Downloading the Utilities . 7 Running the Utilities Directly from the Web . 10 Single Executable Image . 11 The Windows Sysinternals Forums . 11 Windows Sysinternals Site Blog . 12 Mark’s Blog . 12 Mark’s Webcasts . 13 Sysinternals License Information . 13 End User License Agreement and the /accepteula Switch . 13 Frequently Asked Questions About Sysinternals Licensing . 14 What do you think of this book? We want to hear from you! Microsoft is interested in hearing your feedback so we can continually improve our books and learning resources for you. To participate in a brief online survey, please visit: www.microsoft.com/learning/booksurvey/ vii viii Table of Contents 2 Windows Core Concepts . 15 Administrative Rights . 15 Running a Program with Administrative Rights on Windows XP and Windows Server 2003 . 16 Running a Program with Administrative Rights on Windows Vista or Newer 18 Processes, Threads, and Jobs . 21 User Mode and Kernel Mode . 22 Handles . 23 Call Stacks and Symbols . 24 What Is a Call Stack? . 24 What Are Symbols? . 26 Configuring Symbols . 28 Sessions, Window Stations, Desktops, and Window Messages . 30 Terminal Services Sessions . 31 Window Stations . 32 Desktops . 33 Window Messages . 34 Part II Usage Guide 3 Process Explorer . 39 Procexp Overview . 39 Measuring CPU Consumption . 41 Administrative Rights . 42 Main Window . 43 Process List . 43 Customizing Column Selections . 53 Saving Displayed Data . 65 Toolbar Reference . 65 Identifying the Process That Owns a Window . 66 Status Bar . 67 DLLs and Handles . 67 Finding DLLs or Handles . 68 DLL View . 69 Handle View . 73 Process Details . 77 Image Tab . 78 Performance Tab . 79 Table of Contents ix Performance Graph Tab . 80 Threads Tab . 81 TCP/IP Tab . 82 Security Tab . 83 Environment Tab . 84 Strings Tab . 85 Services Tab . 86 .NET Tabs . 87 Job Tab . 88 Thread Details . 89 Verifying Image Signatures . 91 System Information . 92 Display Options . 95 Procexp as a Task Manager Replacement . 96 Creating Processes from Procexp . 97 Other User Sessions . 97 Miscellaneous Features . 97 Shutdown Options . 97 Command-Line Switches . 98 Restoring Procexp Defaults . 98 Keyboard Shortcut Reference . 98 4 Process Monitor . 101 Getting Started with Procmon . 102 Events . 104 Understanding the Column Display Defaults . 104 Customizing the Column Display . 107 Event Properties Dialog Box . 108 Displaying Profiling Events . 114 Finding an Event . 115 Copying Event Data . 115 Jumping to a Registry or File Location . 115 Searching Online . 116 Filtering and Highlighting . 116 Configuring Filters . 117 Configuring Highlighting . 119 Advanced Output . 120 Saving Filters for Later Use . 121 x Table of Contents Process Tree . 122 Saving and Opening Procmon Traces . 123 Saving Procmon Traces . 124 Opening Saved Procmon Traces . 125 Logging Boot, Post-Logoff, and Shutdown Activity . 127 Boot Logging . 127 Keeping Procmon Running After Logoff . 128 Long-Running Traces and Controlling Log Sizes . 129 Drop Filtered Events . 129 History Depth . 130 Backing Files . 130 Importing and Exporting Configuration Settings . 131 Automating Procmon: Command-Line Options . ..