Windows Sysinternals Administrator's Reference

by Margosis, Aaron; Russinovich, Mark E.

• ISBN13: 9780735656727
• ISBN10: 073565672X
• Edition: 1st
• Format: Paperback
• Copyright: 2011-06-15
• Publisher: Microsoft Press

Summary

Get an edge on Windows diagnostics and support-direct from the Sysinternals experts at Microsoft. The Windows Sysinternals tools, available for download from Microsoft TechNet, are designed to help you manage, troubleshoot, and diagnose Windows clients and servers. This Administrator's Reference provides essential, scenario-based guidance and inside insights to help maximize your work with these tools. Get timesaving solutions, workarounds, and troubleshooting tips from Windows internals expert Marc Russinovich and senior MCS consultant Aaron Margosis Drill into the features and functions of Sysinternals utilities and references, gleaning practical, hands-on insights for resolving real-world issues Learn to work more effectively with utilities for managing, troubleshooting, and optimizing files, disks, processes, security features, networking, maintenance, and other essential operations

Author Biography

Mark Russinovich is a Technical Fellow in the Windows Azure group at Microsoft. He is coauthor of Windows SysInternals Administrator’s Reference, co-creator of the Sysinternals tools available from Microsoft TechNet, and coauthor of the Windows Internals book series. Aaron Margosis is a Principal Consultant with Microsoft Public Sector Services. He specializes in application development on Windows platforms, with a focus on security, least privilege, and compatibility in locked-down environments.

Table of Contents

Foreword

Introduction

Tools the Book Covers

The History of Sysinternals

Who Should Read This Book

Organization of This Book

Conventions and Features in This Book

System Requirements

Acknowledgments

Errata & Book Support

We Want to Hear from You

Stay in Touch

Getting Started

Getting Started with the Sysinternals Utilities

Overview of the Utilities

The Windows Sysinternals Web Site

Sysinternals License Information

Windows Core Concepts

Administrative Rights

Processes, Threads, and Jobs

User Mode and Kernel Mode

Handles

Call Stacks and Symbols

Sessions, Window Stations, Desktops, and Window Messages

Usage Guide

Process Explorer

Procexp Overview

Main Window

DLLs and Handles

Process Details

Thread Details

Verifying Image Signatures

System Information

Display Options

Procexp as a Task Manager Replacement

Miscellaneous Features

Keyboard Shortcut Reference

Process Monitor

Getting Started with Procmon

Events

Filtering and Highlighting

Process Tree

Saving and Opening Procmon Traces

Logging Boot, Post-Logoff, and Shutdown Activity

Long-Running Traces and Controlling Log Sizes

Importing and Exporting Configuration Settings

Automating Procmon: Command-Line Options

Analysis Tools

Injecting Debug Output into Procmon Traces

Toolbar Reference

Autoruns

Autoruns Fundamentals

Autostart Categories

Saving and Comparing Results

AutorunsC

Autoruns and Malware

PsTools

Common Features

PsExec

PsFile

PsGetSid

PsInfo

PsKill

PsList

PsLoggedOn

PsLogList

PsPasswd

PsService

PsShutdown

PsSuspend

PsTools Command-Line Syntax

PsTools System Requirements

Process and Diagnostic Utilities

VMMap

ProcDump

DebugView

LiveKd

ListDLLs

Handle

Security Utilities

SigCheck

AccessChk

AccessEnum

ShareEnum

ShellRunAs

Autologon

LogonSessions

SDelete

Active Directory Utilities

AdExplorer

AdInsight

AdRestore

Desktop Utilities

BgInfo

Desktops

ZoomIt

File Utilities

Strings

Streams

NTFS Link Utilities

DU (Disk Usage)

Post-Reboot File Operation Utilities

Disk Utilities

Disk2Vhd

Diskmon

Sync

DiskView

Contig

PageDefrag

DiskExt

LDMDump

VolumeID

Network and Communication Utilities

TCPView

Whois

Portmon

System Information Utilities

RAMMap

CoreInfo

ProcFeatures

WinObj

LoadOrder

PipeList

ClockRes

Miscellaneous Utilities

RegJump

Hex2Dec

RegDelNull

Bluescreen Screen Saver

Ctrl2Cap; Troubleshooting—"The Case of the Unexplained..."

Error Messages

The Case of the Locked Folder

The Case of the Failed AV Update

The Case of the Failed Lotus Notes Backups

The Case of the Failed Play-To

The Case of the Crashing Proksi Utility

The Case of the Installation Failure

The Case of the Missing Folder Association

The Case of the Temporary Registry Profiles

Hangs and Sluggish Performance

The Case of the IExplore-Pegged CPU

The Case of the Excessive ReadyBoost

The Case of the Slow Keynote Demo

The Case of the Slow Project File Opens

The Compound Case of the Outlook Hangs

Malware

The Case of the Sysinternals-Blocking Malware

The Case of the Process-Killing Malware

The Case of the Fake System Component

The Case of the Mysterious ASEP

About The Authors

Table of Contents provided by Publisher. All Rights Reserved.