Forum Widgets
Latest Discussions
Suggestion for ProcessExplorer?
Could not find any public tracker or feedback system for sysinternals suite or process explorer itself (really needs something IMHO if for no other reason just so people can check if if something has already been suggested) Anyway, I would really like if Process explorer could have a graph to watch aggregate NETWORK i/o separate from disk(block) I/O. To avoid having to use multiple tools to to figure out a systems' (and process) network utilization to find issues. In addition, the system information popout window (summary, cpu, memory, i/o, gpu) should both include this on the summary tab, as well as include GPU (which is missing) on the summary tab. If there is an actual place to file such suggestions/feedback that is NOT the forum please let me know.
Two issues with AutoRuns 14.11
Hi, For AutoRuns 14.11: 1. At the folder of C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup I have an .LNK file with link to the patch of Windows Task Manager, C:\Windows\System32\Taskmgr.exe, but it is not shown in AutoRuns at all, mostly not the logon tab and it is not found when you search for it, not even when loading it as admin. Looks like a bug. 2. I also have an object there that is an .LNK file, but it is not linked to an executable, but it is a definition to launch the WhatsApp application, the link is disabled/blocked for a editing, looks something like "5319275A.WhatsAppDesktop_2.2342.7.0_x64__cv1g1gvanyjgm". So AutoRuns naturally marks its line with yellow background an the "Image Path" column states "File not found: .exe", which is technically true, but it will be wiser to consider to not showing a warning, since the object works OK and does launch the app, so it will better to mark it as windows app store object valid object. Thank you.
Issue with Autoruns v14.11 – Offline System Registry Hives Not Unmounted
When using the Analyze Offline System option leaves registry hives mounted, risking system corruption. Steps to Reproduce: Open Autoruns v14.11. Use File > Analyze Offline System. Close AutoRuns. Observe that registry hives remain mounted after the process has terminated. (Regedit.exe > HKLM > autoruns.software / autoruns.system / autoruns.user) Impact: Can render the offline system unbootable. Prevents you from using Analyze Offline System again as the HKLM\autoruns.* mountpoints are already in use. Workaround: Use v13.100, which works correctly.
Loss of default Route when turning on VPN
When I use my FortiClient VPN to connect remotely, Windows loses my local internet connection. I have used an elevated Command Prompt to try and adjust the default route to remedy. Any advice ? Here is the process I am using: Open a cmd window with administrator privileges. You need them to add/delete routes later on. before you connect the vpn execute a "route print" in there and look for the Target "0.0.0.0" - this is your default route. Note down the ip in the column "gateway" there. Connect the vpn and then execute "route print" in the cmd again. You should notice that the gateway (and interface) for the default route has changed. Als note down that gateway ip. Then do a "route delete 0.0.0.0" (I think "route delete default" might do as well but not sure). Then do a "route add 0.0.0.0 MASK 0.0.0.0 <gateway ip you noted down before connecting vpn>" At this point you should regain internet connectivity again. To still be able to reach to your company servers you might have to analogously add a static route to the company subnet with correct subnet mask and the gateway you noted after connecting the vpn. You don't need to enter interface or metric here.
Autoruns renders system unbootable
Autoruns renders system unbootable, while using it from within WinPE: Autoruns -> Files -> Analyze Offline System... Last version causing no trouble using it this way is 13.100. https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns Running Autoruns from a fully installed system and using this method does not cause any problems so far. Affected registry hives are SOFTWARE and SYSTEM. Recovering the system or at least some entries is only successful with an (older) existing backup of the registry files. The corrupted registry file SYSTEM even lost the computername. All information off the harddrives are lost too. Registry Recon confirms it. All red entries have been damaged. I am not sure where exactly i should report this. It can easily be reproduced by running it under any WinPE, it happens every time i used it. I like to use the newest versions under PE again. Maybe there is a way to recover the lost entries. I appreciate any help. With kind regardsRemote Connection Manager (RDMon)
For those who use Remote Desktop Connection Manager, v2.93 I'm trying to utilize the feature of Hot Keys. From the menu -> Tools -> Options -> Hot Keys (tab) -> Previous session. I use the ctrl-alt-insert for full screen all the time. Problem is the ctrl-alt-rightarrow / left arrow are not working. I'm expecting it to cycle to the next open VM. I've used this in the past but now it doesn't seem to work anymore.
