Sysinternals topics

DebugView v. 5.0 freezes

ziczac — Sun, 12 Apr 2026 04:37:59 GMT

It appears that if the file C:\Windows\MEMORY.DMP exists, DebugView/UI will freeze completely if permission to open/read the file hasn't been granted.
DebugView is also incapable of telling what it's trying to do at the time (ie. trying to process a crash dump file).

Running DebugView under a non-Administrative account & trying to process a renamed crash dump file yields the following error message:

Windows 10 File Explorer Hangs ,Crashes & no Taskbar JumpLists

roark_h — Wed, 08 Apr 2026 22:41:29 GMT

undefined

Migrate RDCMAN to another PC?

Pierre-de-la-Verre — Mon, 19 Jan 2026 11:42:33 GMT

I have a RDCMAN.cfg with approx. 50 stored connection to other PC or servers. Maybe about 5 of them have stored passwords, the other have only stored login-names without password.

I got a new PC and copied the rdcman.cfg to new PC, but now on every startup of RDCMAN I get an incredible long error message like:

There were problems decrypting some credentials. Click OK to copy the details to the clipboard. Custom passwords: path .. server .... password ... Key is not valid for defined state ... repeat it 50 times ..

How can I migrate my data to new PC?

Compare 2 promon files

skak — Mon, 24 Nov 2025 08:47:12 GMT

Hello,

How to compare 2 procmon files from different desktops for a troubleshoot, which tool can be used ?

Thanks

Skak

RDCMan v3.1: Recent Built-In Group Not Working

leewilmott — Tue, 04 Nov 2025 09:54:56 GMT

I am using Remote Desktop Connection Manager v3.1 (on Windows 11 Enterprise, 24H2) and have found the following two issues...

The "Recent" Built-In Group doesn't work...the recently connected servers do not appear in this group (this fails for my colleague too).
If you click on the URL shown in the "About" Dialogue box then RDCMan errors and then crashes! (Again, this too fails for my colleague).

Many thanks!

Lee

Autologon v3.10 fails to set password for Server 2025

BGleason — Wed, 08 Oct 2025 06:35:36 GMT

When attempting to setup AutoLogon for Windows Server 2025, the AutoAdminLogon, DefaultDomainName, DefaultUserName are all set, though it does not appear to be setting the encrypted password correctly where ever autologon stores that value.

I have tested it working successfully on Windows Server 2022.

How to check the certificate when using RDCMan 3.1

SokratisZotos — Wed, 20 Aug 2025 06:14:29 GMT

Hi all,

Is there an easy way to check the Certificate used within RDCMan 3.1 tool, while remoting to different servers?

I'm struggling to find this option, not sure if it even exists...

Thanks.

Process Explorer DPI scaling problem on 4K display with 200% scale (Windows 11 Build 26120)

LetaF — Fri, 20 Jun 2025 17:38:32 GMT

I'm running Process Explorer (procexp64.exe) on Windows 11 Pro Build 26120 with a 4K monitor scaled to 200% (NVIDIA GeForce GTX 1060 3GB card). Regardless of system scaling settings or compatibility adjustments, the UI of Process Explorer reverts to a "need strong reading glasses" size after launch. It seems to not be honoring my 200% scaling.

Here’s what I’ve tested:

Enabled “Override high DPI scaling behavior” and set it to “System (Enhanced)”
Enabled “Program DPI” with “I open this program” option
Created a custom external manifest (PerMonitorV2) in the same folder as procexp64.exe
Tried toggling between PerMonitorV2 and Application in the manifest
I did not enable the global PreferExternalManifest registry setting for safety reasons

Process Explorer momentarily honors scaling overrides or manifest settings at launch, but once initialized, it redraws its main window at a smaller, unreadable scale. Dialogs and property windows also do not respect the intended DPI awareness.

If I move the window to my second 1k monitor and change that display from 100% to 175% it looks good.

It would be helpful if future builds of Process Explorer could maintain DPI consistency on high-resolution displays, or at least expose a command-line or UI flag to force a specific scaling mode. I'm currently agonizing with this issue over ArcGIS Pro's UI on my monitor.

Co-Pilot helped me try to sort this issue, and also helped me write this report.

Suggestion for AD Explorer

Jeff_Lamb — Tue, 03 Jun 2025 16:48:19 GMT

I'd like to see a "Refresh (F5)" feature in AD Explorer. Example - I'll open AD Explorer to a user object and find that a mailbox was never enabled for that account. I'll pop-open Powershell and enable the mailbox. Now, back to AD Explorer, the changes made are not reflected. Having a Right-click/Refresh on the object would be much more convenient than disconnecting and reconnecting with the directory. Thanks for the awesome tools that I use daily!

SYSinternal Help needed

Tc27 — Sat, 26 Apr 2025 20:01:41 GMT

I have TCPview installed and whois with the Microsoft SYSinternal Suite app, and when I right-click to use whois in TCPview my computer gives me an error: Cannot resolve names or use local names. I'm pretty confident my network has been hacked into, and I need this program to work, I've been playing video games between 2 steam accounts where I've been tracked into every match I enter. When I try to run the Whois command prompt it doesn't load.

NCrypt Usage

scottandrewdaly — Mon, 21 Oct 2024 17:21:29 GMT

Are there any official restrictions on NCrypt Usage other than not calling from service main? For example, is it OK to use NCrypt from a service outside of service main?

Two issues with AutoRuns 14.11

eitancaspi — Fri, 16 Aug 2024 09:21:03 GMT

Hi,

For AutoRuns 14.11:

At the folder of C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup I have an .LNK file with link to the patch of Windows Task Manager, C:\Windows\System32\Taskmgr.exe, but it is not shown in AutoRuns at all, mostly not the logon tab and it is not found when you search for it, not even when loading it as admin. Looks like a bug.

I also have an object there that is an .LNK file, but it is not linked to an executable, but it is a definition to launch the WhatsApp application, the link is disabled/blocked for a editing, looks something like "5319275A.WhatsAppDesktop_2.2342.7.0_x64__cv1g1gvanyjgm". So AutoRuns naturally marks its line with yellow background an the "Image Path" column states "File not found: .exe", which is technically true, but it will be wiser to consider to not showing a warning, since the object works OK and does launch the app, so it will better to mark it as windows app store object valid object.

Thank you.

Issue with Autoruns v14.11 – Offline System Registry Hives Not Unmounted

firepark32 — Thu, 08 Aug 2024 03:32:52 GMT

When using the Analyze Offline System option leaves registry hives mounted, risking system corruption.

Steps to Reproduce:

Open Autoruns v14.11.
Use File > Analyze Offline System.
Close AutoRuns.
Observe that registry hives remain mounted after the process has terminated. (Regedit.exe > HKLM > autoruns.software / autoruns.system / autoruns.user)

Impact:

Can render the offline system unbootable.
Prevents you from using Analyze Offline System again as the HKLM\autoruns.* mountpoints are already in use.

Workaround: Use v13.100, which works correctly.

Loss of default Route when turning on VPN

MikeM275 — Tue, 06 Aug 2024 19:31:28 GMT

When I use my FortiClient VPN to connect remotely, Windows loses my local internet connection.

I have used an elevated Command Prompt to try and adjust the default route to remedy.

Any advice ?

Here is the process I am using:

Open a cmd window with administrator privileges. You need them to add/delete routes later on.
before you connect the vpn execute a "route print" in there and look for the Target "0.0.0.0" - this is your default route. Note down the ip in the column "gateway" there.
Connect the vpn and then execute "route print" in the cmd again. You should notice that the gateway (and interface) for the default route has changed. Als note down that gateway ip.
Then do a "route delete 0.0.0.0" (I think "route delete default" might do as well but not sure).
Then do a "route add 0.0.0.0 MASK 0.0.0.0 <gateway ip you noted down before connecting vpn>"
At this point you should regain internet connectivity again.
To still be able to reach to your company servers you might have to analogously add a static route to the company subnet with correct subnet mask and the gateway you noted after connecting the vpn.
You don't need to enter interface or metric here.

Customizable shortcuts for ZoomIt?

yyang — Thu, 01 Aug 2024 07:10:36 GMT

The video recording feature is wonderful, but the expanding shortcuts conflict a lot with my existing settings of various programs, e.g. VSCode. Due to this reason I have to stick with v6.1.2. It would be dreamy if the shortcuts could be customized. Thanks!

Autoruns renders system unbootable

alphapremium — Fri, 26 Jul 2024 12:30:24 GMT

Autoruns renders system unbootable, while using it from within WinPE:

Autoruns -> Files -> Analyze Offline System...

Last version causing no trouble using it this way is 13.100.

https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns

Running Autoruns from a fully installed system and using this method does not cause any problems so far.

Affected registry hives are SOFTWARE and SYSTEM.

Recovering the system or at least some entries is only successful with an (older) existing backup of the registry files.
The corrupted registry file SYSTEM even lost the computername. All information off the harddrives are lost too.

Registry Recon confirms it. All red entries have been damaged.

I am not sure where exactly i should report this.

It can easily be reproduced by running it under any WinPE, it happens every time i used it.

I like to use the newest versions under PE again.

Maybe there is a way to recover the lost entries.

I appreciate any help.

With kind regards

Remote Connection Manager (RDMon)

JoePet — Wed, 15 May 2024 23:09:37 GMT

For those who use Remote Desktop Connection Manager, v2.93

I'm trying to utilize the feature of Hot Keys.

From the menu -> Tools -> Options -> Hot Keys (tab) -> Previous session.
I use the ctrl-alt-insert for full screen all the time.

Problem is the ctrl-alt-rightarrow / left arrow are not working.

I'm expecting it to cycle to the next open VM.

I've used this in the past but now it doesn't seem to work anymore.

EOL,EOS and EEOS DATE'S

Kiruthika15102002 — Tue, 07 May 2024 11:09:08 GMT

Hii all

Can somebody share me the EOL,EOS,EEOS dates for the sysinternals products

Technet and MSDN Library

lasirius — Sun, 09 Oct 2022 03:54:06 GMT

Can anyone tell me where Technet and the MSDN Library are located now, or where the new equivalents to those websites are located?

regards

Windows for Android Subsystem Architecture

Michael_Cherry — Thu, 10 Mar 2022 01:51:06 GMT

I am trying to discover more about the architecture of the Windows for Android Subsystem. It doesn't appear to follow the original subsystem architecture, nor the pico-process architecture of the Linux subsystem. I cannot find documentation on the Intel Bridge technology mentioned in the latest preview announcement. Is there any documentation of this subsystem?

Thanks

Michael Cherry