Formerly known as Winternals and initially released in 1996, Windows Sysinternals is now a product from Microsoft after it acquired Winternals Software on July 18, 2006. Today, Windows Sysinternals includes a suite of Windows utilities that can be downloaded as a collection or individually for free from Microsoft.

List of Windows Sysinternals utilities

  • Sysinternals Suite - The entire set of Sysinternals utilities rolled up into a single download.
  • AccessChk - Command-line tool for viewing the effective permissions on files, registry keys, services, processes, kernel objects, and more.
  • AccessEnum - Tool that shows who has what access to directories, files, and registry keys on your systems. Use it to find holes in your permissions.
  • AdExplorer - The Active Directory Explorer is an advanced AD (Active Directory) viewer and editor.
  • AdInsight - An LDAP (Lightweight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications.
  • AdRestore - Undelete Server 2003 Active Directory objects.
  • Autologon - Bypass password screen during logon.
  • Autoruns - See what programs are configured to startup automatically when your system boots and you log in. Autoruns also shows you the full list of registry and file locations where applications can configure autostart settings.
  • BgInfo - This program generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.
  • BlueScreen - This screen saver accurately simulates blue screens and reboots as well (complete with CHKDSK).
  • CacheSet - CacheSet is a program that lets you control the cache manager’s working set size using functions provided by NT. It’s compatible with all versions of NT.
  • ClockRes - View the resolution of the system clock, which is also the maximum timer resolution.
  • Contig - Optimize individual files or create new files that are contiguous.
  • Coreinfo - Show the mapping between logical processors and the physical processor, NUMA node, the socket they reside, and the cache’s assigned to each logical processor.
  • Ctrl2cap - A kernel driver that demonstrates keyboard input filtering above the keyboard class driver to turn Caps Lock into control keys. Filtering at this level allows conversion and hiding of keys before NT even “sees” them. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue screen.
  • DebugView - Intercept calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.
  • Desktops - Create up to four virtual desktops and use a tray interface or hotkeys to preview what’s on each desktop and easily switch between them.
  • Disk2vhd - Simplify the migration of physical systems into virtual machines (p2v).
  • DiskExt - Display volume disk-mappings.
  • Diskmon - Capture all hard drive activity or act like a software disk activity light in your system tray.
  • DiskView - Graphical disk sector utility.
  • DU (Disk Usage) - View disk usage by directory.
  • EFSDump - View information for encrypted files.
  • FindLinks - FindLinks reports the file index and any hard links (alternate file paths on the same volume) that exist for the specified file. A file’s data remains allocated so long as at it has at least one file name referencing it.
  • Handle - Show what files are open by what processes and more.
  • Hex2dec - Convert hex numbers to decimal and vice versa.
  • Junction - Create Windows 2000 NTFS symbolic links. See our junction page for further information on these links.
  • LDMDump - Dump the contents of the Logical Disk Manager’s on-disk database, which describes the partitioning of Windows 2000 dynamic disks.
  • ListDLLs - List all the DLLs that are currently loaded, including where they are loaded and their version numbers.
  • LiveKd - Use the Microsoft kernel debuggers to examine a live system.
  • LoadOrder - See the order where devices are loaded on your WinNT/2K system.
  • LogonSessions - List the active logon sessions on a system.
  • MoveFile - Allows you to schedule move and delete commands for the next reboot.
  • NTFSInfo - Get detailed information about NTFS volumes, including the size and location of the MFT (Master File Table) and MFT-zone, and the size of the NTFS metadata files.
  • PendMoves - Enumerate the list of file rename and delete commands that will be executed the next boot.
  • PipeList - Display the named pipes on your system, including the number of maximum instances and active instances for each pipe.
  • PortMon - Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and shows you a portion of the data sent and received.
  • ProcDump - Capture process dumps of otherwise difficult to isolate and reproduce CPU spikes. It also serves as a general process dump creation utility and can also monitor and generate process dumps when a process has a hung window or unhandled exception.
  • Process Explorer - Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility even shows you who owns each process.
  • Process Monitor - Monitor file system, registry, process, thread, and DLL activity in real-time.
  • PsExec - Execute processes on remote systems.
  • PsFile - See what files are opened remotely.
  • PsGetSid - Displays the SID of a computer or a user.
  • PsInfo - Obtain information about a system.
  • PsKill - Terminate local or remote processes.
  • PsList - Show information about processes and threads.
  • PsLoggedOn - Show users logged on to a system.
  • PsLogList - Dump event log records.
  • PsPasswd - Changes account passwords.
  • PsPing - Measure network performance.
  • PsService - View and control services.
  • PsShutdown - Shuts down and optionally reboots a computer.
  • PsSuspend - Suspend and resume processes.
  • PsTools - Includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
  • RAMMap - An advanced physical memory usage analysis utility that presents usage information in different ways in each of its tabs.
  • RegDelNull - Scan for and delete registry keys that contain embedded null characters that are otherwise undeleteable by standard registry-editing tools.
  • RU (Registry Usage) - View the registry space usage for the specified registry key.
  • RegJump - Jump to the registry path you specify in Regedit.
  • SDelete - Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD compliant secure delete program.
  • ShareEnum - Scan file shares on your network and view their security settings to close security holes.
  • ShellRunas - Launch programs as a different user via a convenient shell context menu entry.
  • Sigcheck - Dump file version information and verify that images on your system are digitally signed.
  • Streams - Reveal the NTFS alternate streams.
  • Strings - Search for ANSI and UNICODE strings in binary images.
  • Sync - Flush cached data to disk.
  • Sysmon - Monitor and report key system activities via the Windows event log.
  • TCPView - Active socket command-line viewer.
  • VMMap - VMMap is a process virtual and physical memory analysis utility.
  • VolumeId - Set the Volume ID of FAT or NTFS drives.
  • Whois - See who owns an Internet address.
  • WinObj - Object Manager namespace viewer.
  • ZoomIt - Presentation utility for zooming and drawing on the screen.

Auto, Disk usage, Software terms, Utility

  • Full list of downloads to each of the above Windows Sysinternals utilities.