Forum Widgets
Latest Discussions
Autoruns renders system unbootable
Autoruns renders system unbootable, while using it from within WinPE: Autoruns -> Files -> Analyze Offline System... Last version causing no trouble using it this way is 13.100. https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns Running Autoruns from a fully installed system and using this method does not cause any problems so far. Affected registry hives are SOFTWARE and SYSTEM. Recovering the system or at least some entries is only successful with an (older) existing backup of the registry files. The corrupted registry file SYSTEM even lost the computername. All information off the harddrives are lost too. Registry Recon confirms it. All red entries have been damaged. I am not sure where exactly i should report this. It can easily be reproduced by running it under any WinPE, it happens every time i used it. I like to use the newest versions under PE again. Maybe there is a way to recover the lost entries. I appreciate any help. With kind regardsProcess Explorer DPI scaling problem on 4K display with 200% scale (Windows 11 Build 26120)
I'm running Process Explorer (procexp64.exe) on Windows 11 Pro Build 26120 with a 4K monitor scaled to 200% (NVIDIA GeForce GTX 1060 3GB card). Regardless of system scaling settings or compatibility adjustments, the UI of Process Explorer reverts to a "need strong reading glasses" size after launch. It seems to not be honoring my 200% scaling. Here’s what I’ve tested: Enabled “Override high DPI scaling behavior” and set it to “System (Enhanced)” Enabled “Program DPI” with “I open this program” option Created a custom external manifest (PerMonitorV2) in the same folder as procexp64.exe Tried toggling between PerMonitorV2 and Application in the manifest I did not enable the global PreferExternalManifest registry setting for safety reasons Process Explorer momentarily honors scaling overrides or manifest settings at launch, but once initialized, it redraws its main window at a smaller, unreadable scale. Dialogs and property windows also do not respect the intended DPI awareness. If I move the window to my second 1k monitor and change that display from 100% to 175% it looks good. It would be helpful if future builds of Process Explorer could maintain DPI consistency on high-resolution displays, or at least expose a command-line or UI flag to force a specific scaling mode. I'm currently agonizing with this issue over ArcGIS Pro's UI on my monitor. Co-Pilot helped me try to sort this issue, and also helped me write this report.Suggestion for AD Explorer
I'd like to see a "Refresh (F5)" feature in AD Explorer. Example - I'll open AD Explorer to a user object and find that a mailbox was never enabled for that account. I'll pop-open Powershell and enable the mailbox. Now, back to AD Explorer, the changes made are not reflected. Having a Right-click/Refresh on the object would be much more convenient than disconnecting and reconnecting with the directory. Thanks for the awesome tools that I use daily!
SYSinternal Help needed
I have TCPview installed and whois with the Microsoft SYSinternal Suite app, and when I right-click to use whois in TCPview my computer gives me an error: Cannot resolve names or use local names. I'm pretty confident my network has been hacked into, and I need this program to work, I've been playing video games between 2 steam accounts where I've been tracked into every match I enter. When I try to run the Whois command prompt it doesn't load.
Suggestion for ProcessExplorer?
Could not find any public tracker or feedback system for sysinternals suite or process explorer itself (really needs something IMHO if for no other reason just so people can check if if something has already been suggested) Anyway, I would really like if Process explorer could have a graph to watch aggregate NETWORK i/o separate from disk(block) I/O. To avoid having to use multiple tools to to figure out a systems' (and process) network utilization to find issues. In addition, the system information popout window (summary, cpu, memory, i/o, gpu) should both include this on the summary tab, as well as include GPU (which is missing) on the summary tab. If there is an actual place to file such suggestions/feedback that is NOT the forum please let me know.
Two issues with AutoRuns 14.11
Hi, For AutoRuns 14.11: 1. At the folder of C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup I have an .LNK file with link to the patch of Windows Task Manager, C:\Windows\System32\Taskmgr.exe, but it is not shown in AutoRuns at all, mostly not the logon tab and it is not found when you search for it, not even when loading it as admin. Looks like a bug. 2. I also have an object there that is an .LNK file, but it is not linked to an executable, but it is a definition to launch the WhatsApp application, the link is disabled/blocked for a editing, looks something like "5319275A.WhatsAppDesktop_2.2342.7.0_x64__cv1g1gvanyjgm". So AutoRuns naturally marks its line with yellow background an the "Image Path" column states "File not found: .exe", which is technically true, but it will be wiser to consider to not showing a warning, since the object works OK and does launch the app, so it will better to mark it as windows app store object valid object. Thank you.
Issue with Autoruns v14.11 – Offline System Registry Hives Not Unmounted
When using the Analyze Offline System option leaves registry hives mounted, risking system corruption. Steps to Reproduce: Open Autoruns v14.11. Use File > Analyze Offline System. Close AutoRuns. Observe that registry hives remain mounted after the process has terminated. (Regedit.exe > HKLM > autoruns.software / autoruns.system / autoruns.user) Impact: Can render the offline system unbootable. Prevents you from using Analyze Offline System again as the HKLM\autoruns.* mountpoints are already in use. Workaround: Use v13.100, which works correctly.
