Return to Windows DevOps - WinOps, choco install sysinternals

The Sysinternals web site was created in 1996 by Mark Russinovich to host his advanced system utilities and technical information. Whether you’re an IT Pro or a developer, you’ll find Sysinternals utilities to help you manage, troubleshoot and diagnose your Windows systems and applications.

• Definition: Sysinternals is a suite of advanced system utilities and technical resources created by Mark Russinovich and Bryce Cogswell. It is designed to help manage, diagnose, troubleshoot, and monitor Microsoft Windows environments.
• Function: Provides a comprehensive set of tools for system administrators and IT professionals to analyze system performance, security, and behavior.
• Components:

   * '''Process Explorer''': An advanced process management utility that shows detailed information about active processes, including their handles and DLLs.
   * '''Process Monitor''': A real-time monitoring tool that captures system activity related to processes, threads, file system, registry, and network operations.
   * '''Autoruns''': Shows which programs are configured to run during system bootup or login.
   * '''TCPView''': Displays detailed listings of all TCP and UDP endpoints on the system, including local and remote addresses and state of TCP connections.
   * '''Sysmon''': Monitors and logs system activity to the Windows event log for detailed forensic analysis.
   * '''PsTools''': A set of command-line utilities to manage processes, obtain system information, and perform various administrative tasks remotely.

• Features:

   * '''Detailed System Monitoring''': Provides in-depth analysis and real-time monitoring of system processes, performance, and security.
   * '''Advanced Troubleshooting''': Helps diagnose and resolve complex system issues with comprehensive tools.
   * '''Security Analysis''': Identifies potential security threats and unauthorized system changes.
   * '''Remote Management''': Facilitates remote administration and troubleshooting through command-line utilities.
   * '''Extensive Documentation''': Includes detailed documentation and usage examples for each tool.

• Using Process Explorer to view detailed process information:

   1. Download and run Process Explorer from the Sysinternals website.
   2. View detailed information about processes, including CPU usage, memory usage, and active handles.

• Monitoring system activity with Process Monitor:

   ```cmd
   procmon.exe
   ```
   * Captures real-time system activity and allows filtering to focus on specific events of interest.

• Listing startup programs with Autoruns:

   1. Run Autoruns from the Sysinternals suite.
   2. View and manage programs configured to run at startup, including those in the registry and startup folders.

• Viewing network connections with TCPView:

   ```cmd
   tcpview.exe
   ```
   * Provides a real-time view of all network connections, including details about local and remote addresses and connection states.

• Using PsTools to manage remote systems:

   ```cmd
   psexec \\remote-computer cmd
   ```
   * Executes a command prompt on a remote computer, allowing remote administration and task execution.

• Sysinternals: A suite of advanced system utilities and technical resources for managing, diagnosing, troubleshooting, and monitoring Microsoft Windows environments. It includes powerful tools like Process Explorer, Process Monitor, Autoruns, TCPView, Sysmon, and PsTools, providing comprehensive capabilities for system administrators and IT professionals.

Snippet from Wikipedia: Sysinternals

Windows Sysinternals is a website that offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment. Originally, the Sysinternals website (formerly known as ntinternals) was created in 1996 and was operated by the company Winternals Software LP, which was located in Austin, Texas. It was started by software developers Bryce Cogswell and Mark Russinovich. Microsoft acquired Winternals and its assets on July 18, 2006.

The website featured several freeware tools to administer and monitor computers running Microsoft Windows. The software can now be found at Microsoft. The company also sold data recovery utilities and professional editions of their freeware tools.

Creative Commons Attribution-Share Alike 4.0

Fair Use Source: https://www.youtube.com/watch?v=_MUP4tgdM7s&list=PLhFhDWFYccZ_GvdJ11NZwaBAhwDCWmni_&index=2

winget install sysinternals

• AccessChk
• AccessEnum
• CacheSet
• Contig
• Disk2vhd
• DiskExt
• DiskMon
• Disk Usage
• DiskView
• EFSDump
• LDMDump
• MoveFile
• NTFSInfo
• PendMoves
• RegMon
• SDelete
• Sigcheck
• Streams
• Sync
• VolumeID

• Active Directory Explorer
• Insight for Active Directory
• AdRestore
• PipeList
• PsFile
• PsPing
• ShareEnum
• TCPView
• Whois

• AutoRuns
• Handle
• ListDLLs
• Portmon
• ProcDump
• Process Explorer
• Process Monitor
• PsExec
• PsGetSid
• PsKill
• PsList
• PsService
• PsSuspend
• PsTools
• ShellRunas
• VMMap

• Autologon
• LogonSessions
• NewSID
• PsLoggedOn
• PsLogList
• RootkitRevealer
• Sysmon

• ClockRes
• Coreinfo
• LiveKd
• LoadOrder
• ProcFeatures
• PsInfo
• RAMMap
• WinObj

BgInfo BlueScreen Screen Saver CpuStres Ctrl2Cap DebugView Desktops Hex2dec NotMyFault PsPasswd PsShutdown RDCMan RegDelNull Registry Usage Reghide RegJump Strings Testlimit ZoomIt

Sysinternals Suite

You have sysinternals v2021.10.26 installed. Version 2021.12.16 is available based on your source(s).

Progress: Downloading sysinternals 2021.12.16… 100%

sysinternals v2021.12.16 [Approved]

sysinternals package files upgrade completed. Performing other installation steps.

Sysinternals Suite is going to be installed in 'C:\ProgramData\chocolatey\lib\sysinternals\tools'

Downloading sysinternals

from 'https://download.[[sysinternals.com]]/files/[[SysinternalsSuite]].[[zip]]'

Progress: 100% - Completed download of C:\Users\USERNAME\AppData\Local\Temp\chocolatey\sysinternals\2021.12.16\SysinternalsSuite.zip (45.51 MB).

Download of SysinternalsSuite.zip (45.51 MB) completed. Hashes match.

Extracting C:\Users\USERNAME\AppData\Local\Temp\chocolatey\sysinternals\2021.12.16\SysinternalsSuite.zip to C:\ProgramData\chocolatey\lib\sysinternals\tools…

C:\ProgramData\chocolatey\lib\sysinternals\tools

• ShimGen has successfully created a shim for accesschk.exe

• accesschk64.exe

• AccessEnum.exe

• ADExplorer.exe

• ADExplorer64.exe

• ADInsight.exe

• ADInsight64.exe

• adrestore.exe

• adrestore64.exe

• Autologon.exe

• Autologon64.exe

• Autoruns.exe

• Autoruns64.exe

• autorunsc.exe

• autorunsc64.exe

• Bginfo.exe

• Bginfo64.exe

• Cacheset.exe

• Cacheset64.exe

• Clockres.exe

• Clockres64.exe

• Contig.exe

• Contig64.exe

• Coreinfo.exe

• Coreinfo64.exe

• CPUSTRES.exe

• CPUSTRES64.exe

• ctrl2cap.exe

• Dbgview.exe

• dbgview64.exe

• Desktops.exe

• Desktops64.exe

• disk2vhd.exe

• disk2vhd64.exe

• diskext.exe

• diskext64.exe

• Diskmon.exe

• Diskmon64.exe

• DiskView.exe

• DiskView64.exe

• du.exe

• du64.exe

• efsdump.exe

• FindLinks.exe

• FindLinks64.exe

• handle.exe

• handle64.exe

• hex2dec.exe

• hex2dec64.exe

• junction.exe

• junction64.exe

• ldmdump.exe

• Listdlls.exe

• Listdlls64.exe

• livekd.exe

• livekd64.exe

• LoadOrd.exe

• LoadOrd64.exe

• LoadOrdC.exe

• LoadOrdC64.exe

• logonsessions.exe

• logonsessions64.exe

• movefile.exe

• movefile64.exe

• notmyfault.exe

• notmyfault64.exe

• notmyfaultc.exe

• notmyfaultc64.exe

• ntfsinfo.exe

• ntfsinfo64.exe

• pagedfrg.exe

• pendmoves.exe

• pendmoves64.exe

• pipelist.exe

• pipelist64.exe

• portmon.exe

• procdump.exe

• procdump64.exe

• procexp.exe

• procexp64.exe

• Procmon.exe

• Procmon64.exe

• PsExec.exe

• PsExec64.exe

• psfile.exe

• psfile64.exe

• PsGetsid.exe

• PsGetsid64.exe

• PsInfo.exe

• PsInfo64.exe

• pskill.exe

• pskill64.exe

• pslist.exe

• pslist64.exe

• PsLoggedon.exe

• PsLoggedon64.exe

• psloglist.exe

• psloglist64.exe

• pspasswd.exe

• pspasswd64.exe

• psping.exe

• psping64.exe

• PsService.exe

• PsService64.exe

• psshutdown.exe

• psshutdown64.exe

• pssuspend.exe

• pssuspend64.exe

• RAMMap.exe

• RDCMan.exe

• RegDelNull.exe

• RegDelNull64.exe

• regjump.exe

• ru.exe

• ru64.exe

• sdelete.exe

• sdelete64.exe

• ShareEnum.exe

• ShareEnum64.exe

• ShellRunas.exe

• sigcheck.exe

• sigcheck64.exe

• streams.exe

• streams64.exe

• strings.exe

• strings64.exe

• sync.exe

• sync64.exe

• Sysmon.exe

• Sysmon64.exe

• tcpvcon.exe

• tcpvcon64.exe

• tcpview.exe

• tcpview64.exe

• Testlimit.exe

• Testlimit64.exe

• vmmap.exe

• vmmap64.exe

• Volumeid.exe

• Volumeid64.exe

• whois.exe

• whois64.exe

• Winobj.exe

• Winobj64.exe

• ZoomIt.exe

• ZoomIt64.exe

The upgrade of sysinternals was successful.

Software installed to 'C:\ProgramData\chocolatey\lib\sysinternals\tools'

• https://github.com/Sysinternals
• https://docs.microsoft.com/en-us/sysinternals

• Read the official guide to the Sysinternals tools, Troubleshooting with the Windows Sysinternals Tools
• Read the Sysinternals Blog for a detailed change feed of tool updates
• Watch Mark's Sysinternals Update videos on YouTube
• Watch Mark’s top-rated Case-of-the-Unexplained troubleshooting presentations and other webcasts
• Read Mark’s Blog which highlight use of the tools to solve real problems
• Check out the Sysinternals Learning Resources page
• Post your questions in the Sysinternals Forum

• https://www.microsoft.com/en-us/p/sysinternals-suite/9p7knl5rwt25?activetab=pivot:overviewtab