Having worked in the software support industry for many years, and now even as a software developer, I’ve lost count of the number of times that Mark Russinovich’s Sysinternals tools have helped me solve seemingly impossible problems. From simple application crashes, to complex file security issues – there has always been a tool in the Sysinternals suite that has at least pointed me in the right direction to solving the problem.
Each tool in the suite has a specific purpose with a plethora of features. My favourites in the suite are:
I find Process Explorer extremely useful for tracking down hung processes that are causing excessive CPU usage and malicious process (Malware/Adware). It will even let you drill down in to specific threads of a process that is causing problems.
A few clicks in Process Explorer can sometimes solve the most annoying problems in a simple way.
Autoruns has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them.
For those more complex issues that deal with things like file/registry permissions, or missing assembly files (and many, many other file or registry related problems).
This tool is definitely the most useful in the suite for investigating unexplainable behaviour.
For an in-depth overview on how you can use these tools to assist you in investigating and troubleshooting unexplainable behaviour with Windows or third party software running on Windows, I would recommend watching the video after the break of one of Mark’s TechEd sessions.