4 Free Sysinternals Tools for Deeper Windows Troubleshooting

A short history of Sysinternals​

Sysinternals is shorthand for a toolbox with a long pedigree. Microsoft's 2006 announcement said it was acquiring Winternals Software, which also ran the freeware Sysinternals website. Microsoft's release also said Winternals was established in 1996 by Mark Russinovich and Bryce Cogswell. So "Microsoft acquired Sysinternals" is a fair summary, but the deal formally covered Winternals and its tools site.

The tools remain free and Microsoft-hosted. Microsoft's index lists current releases, with Process Explorer v17.21 and Process Monitor v4.13 both dated November 5, 2026. Many of these downloads can also be run directly from Sysinternals Live, which skips the manual download.

Process Explorer instead of Task Manager​

Task Manager is good for a quick look at CPU, memory and frozen apps. Process Explorer answers harder questions.

Microsoft describes it this way:

• It shows which handles and DLLs processes have opened or loaded.
• The top pane lists active processes with their owning accounts.
• The bottom pane shows either handles or DLLs and memory-mapped files, depending on the mode.
• Its search can quickly show which processes have particular handles open or DLLs loaded.

That makes it the right tool for the classic "file in use" problem, where Windows won't let you delete or move something. The MakeUseOf piece also credits it with a parent-child process tree, separate rows for services hosted inside svchost.exe, and VirusTotal checks for suspicious processes.

Requirements: Microsoft lists Windows 11 and higher for clients and Windows Server 2019 and higher for servers. If you're still on Windows 10, check this before you assume it will run.

The "Replace Task Manager" option​

The Options menu includes a Replace Task Manager setting. The article says it also redirects Ctrl+Shift+Esc to Process Explorer. A few cautions apply:

• It changes which program opens. It doesn't delete Task Manager.
• A Microsoft Q&A post from a Store-version user reported a problem after updates. The Store install lives in a versioned folder, and that path gets written to the registry under Image File Execution Options for taskmgr.exe.
• After each automatic Store update, the old path no longer exists, and Ctrl+Shift+Esc stops working.
• That user's fix was to open Process Explorer from the Start menu, then clear and re-tick Replace Task Manager.

That is one user's report, not a confirmed universal bug. If you use the Store version, though, it's worth knowing in advance. The zip download installs to a fixed location, so it may avoid this particular problem. That is my inference, not something Microsoft documents.

Autoruns instead of the Startup tab​

Task Manager's Startup tab lists the obvious logon apps. Autoruns covers much more. Microsoft calls it the tool with the most comprehensive knowledge of auto-starting locations of any startup monitor. The locations it shows include:

• logon entries, Explorer add-ons, Browser Helper Objects, AppInit DLLs and image hijacks
• boot execute images, Winlogon notification DLLs, Windows services, Winsock Layered Service Providers and media codecs

The command-line tool Autorunsc is bundled in the same download, and it can output CSV.

How to use it safely:

1. Run Autoruns and switch tabs to view the different categories.
2. Select an entry and open its properties, or use Jump to Entry to go to its registry or file location.
3. To disable an entry, uncheck its box. Deleting it is a separate Delete action. Prefer unchecking, because it is easy to undo.
4. Use the Hide Signed Microsoft Entries option to focus on third-party items.
5. The scan options let you turn on signature verification and VirusTotal submission.

The article's own caveat is the important one. Don't disable something just because you don't recognise its name. A hidden Microsoft filter narrows the view, but it doesn't tell you which remaining entries are safe.

Process Monitor instead of Resource Monitor​

Resource Monitor shows how much a process is using. Process Monitor shows what it is doing. Microsoft describes it as an advanced monitoring tool that shows real-time file system, Registry and process/thread activity. It also records process details including image path, command line, user and session ID, and its process tree shows how the processes in a trace relate.

A sensible workflow for an app that won't start:

1. Start a capture. Capture begins immediately and can produce a huge amount of data, so set filters early.
2. Open Filter (Ctrl+L) and limit the view to the affected process.
3. Reproduce the failure, then stop the capture.
4. Look for failed file reads, missing configuration files or ACCESS DENIED results near the moment of failure.
5. Open the event properties and the thread stack for more context.

Treat these results as clues, not verdicts. Many healthy applications generate failed-looking lookups as part of normal operation. Also be aware of version drift. The Process Monitor page has moved quickly, with v4.12 published October 15, 2026 and v4.13 out since. Older tutorials may not match the current interface exactly.

TCPView instead of netstat​

netstat gives you connection data, but you then have to look up the process ID separately. TCPView combines the two. Microsoft says it shows all TCP and UDP endpoints, including local and remote addresses, TCP connection states and the owning process name.

Key details from Microsoft's documentation:

• It updates every second by default, and the refresh rate can be changed.
• New endpoints show in green, changed ones in yellow and deleted ones in red.
• Only connections in the ESTABLISHED state can be closed, using File > Close Connections or the right-click menu.
• The download includes Tcpvcon, a command-line version. Its syntax is tcpvcon [-a] [-c] [-n] [process name or PID].
• Microsoft calls it a more informative and conveniently presented subset of netstat. It does not replace netstat entirely.

Compatibility differs here. The documented requirement is Windows 8.1 and higher for clients and Windows Server 2012 and higher for servers. The page's version, v4.19, dates from April 11, 2023. That is older than the other tools but not necessarily a problem.

Which tool for which question​

The verdict​

"Replaced" overstates it. These tools complement Windows' own utilities rather than retire them. Use the built-in tools for quick, safe checks. Reach for Sysinternals when you need a handle, a full autostart inventory, an event trace or a live connection map.

These are powerful tools, and the power cuts both ways. Autoruns can disable something your system depends on, TCPView can drop a live connection, and Process Monitor can bury you in data. Go slowly, filter early, change one thing at a time, and keep Task Manager around, since it's still there.