What was reported
Neowin says Microsoft is bringing two of its best-known Sysinternals tools to new platforms: a native Autoruns for Linux, and a native Process Explorer port for macOS. The outlet adds that Microsoft also shipped updates to existing non-Windows Sysinternals tools, including Sysmon, Procmon, ProcDump for Linux and ZoomIt for macOS.
I couldn't match that roundup to a specific Microsoft blog post. I'm therefore not going to itemize those updates. What I can confirm is the background: Microsoft's Sysinternals blog already carries a long run of non-Windows releases, for example ProcDump 3.5.2 for Linux, which added .NET counters and a custom core dumper.
Process Explorer for Mac: what's verifiable
Microsoft's public GitHub repository, now named Procexp-Mac, describes the project as a native macOS implementation of the core Process Explorer experience. Its README (the source for everything in this section) says it is built with Swift, SwiftUI and AppKit. It samples data through public macOS APIs such as libproc, sysctl, Mach host statistics, Security.framework, IOKit and Metal.
Documented features include:
- A live process tree, color-coded for services, new and deleted processes, suspended processes, sandboxed processes and packed images.
- Lower-pane modes for DLLs/images, handles/file descriptors and threads.
- A per-process Properties window with Image, Performance, Performance Graph, Threads, TCP/IP, Security, Environment and Strings tabs.
- Code-signing detail: signer, certificate chain, Team ID, notarization status and a SHA-256 hash. VirusTotal integration is also listed.
- A System Information window with CPU, memory, I/O, network and GPU pages.
- Process actions: kill, kill tree, suspend/resume, set priority, restart, and sample process.
- Apple Silicon support: performance and efficiency cores are labeled and colored.
The caveats that matter
macOS is not Windows, and the README says so plainly. Not every Process Explorer data source is exposed through public APIs. Where access is denied, the UI leaves values blank rather than inventing them. Some details appear only for same-user processes, or when the optional privileged helper is running.
That helper is a launchd daemon reached over XPC. The app registers it through Apple's SMAppService. Registration requires a stable, non-ad-hoc code signature. You then approve the daemon once in System Settings > General > Login Items & Extensions. If registration is refused, the app reports the failure and keeps running in unprivileged mode. Once the helper is approved, the process list shows previously hidden cross-user and system processes.
Requirements and availability
The README lists:
- macOS 14 or later for the GUI app
- Xcode 26.6 or later recommended
- A Swift 5.9 toolchain or later
- xcodegen, for regenerating the project
Those are build-oriented requirements. The README also documents scripts for DMG creation, signing and notarization. In the repository view I had, I saw no listed GitHub release. Neowin says you can download the app from the repo. What I can confirm is that the source is public and the release tooling exists. I can't confirm a polished installer. If you want to try it today, expect to build it yourself.
Two other details are worth knowing. Local builds are named "ProcExp (Dev)" with separate bundle and helper IDs, so they won't collide with an official install. And the repo is young, with only a few dozen commits and stars at the time of the snapshot.
Autoruns for Linux: unconfirmed
Neowin says Microsoft hasn't explained what the Linux version looks like or how it differs from the Windows one. It also says the Autoruns for Linux GitHub page was returning a 404. My own checks agree with that gap:
- Microsoft's Sysinternals blog describes Autoruns as a utility for monitoring startup items. The v14.3 entry mentions bug fixes and aligning the autorunsc command-line tool with the GUI, including packaged-app support. It says nothing about Linux.
- The Sysinternals blog items I found list Linux releases for Sysmon, Procmon and ProcDump, but no Autoruns for Linux.
- A third-party writeup from September 2026 states flatly that there is no Linux Autoruns or Process Explorer. That was written before this week's news, so it shows the prior state of play. It doesn't contradict the new report.
So the honest status is that this is reported, not documented. I can't tell you which Linux startup mechanisms it would cover, which distributions it supports, or whether it ships as a GUI or a CLI. A reasonable guess is that it would look at systemd units, cron jobs and XDG autostart entries. That is my speculation from general Linux knowledge, not anything Microsoft has said.
Why it matters to Windows admins
- Familiar tools in mixed fleets. Many shops run Macs and Linux boxes next to Windows. Security teams in particular get one mental model for "what is running, and what starts automatically?"
- Part of a pattern. Sysmon, Procmon and ProcDump already have Linux versions, and ZoomIt already has a macOS version. The Sysinternals blog also lists listent for macOS. Process Explorer on Mac continues that cross-platform trend.
- Don't expect parity. The Windows build of Process Explorer is a deep kernel-and-handle inspector. Microsoft's own Windows documentation describes it as showing which handles and DLLs processes have open or loaded. The Mac port works inside Apple's public-API limits, and blanks will appear.
- A fair skeptic's view. A port that leans on public APIs and an approval-gated helper may feel less powerful to veterans. On the other hand, that is the safer design, and it is more likely to survive macOS updates.
What to do now
- If you manage Macs, treat Procexp-Mac as a source-available project to evaluate in a test environment, not as a supported production tool.
- Plan for the privileged helper. It needs proper signing and user approval, which matters on managed devices.
- Don't build Linux workflows around Autoruns until Microsoft publishes a working repository and documentation.
- Check Microsoft's Sysinternals blog for the official announcement and release notes.
Bottom line
One half of this story is real and inspectable: Process Explorer has a native macOS implementation with sensible, honestly documented limits. The other half, Autoruns for Linux, is so far a claim awaiting a working page. Microsoft is clearly keen to take Sysinternals beyond Windows, but I'd hold the confetti until the 404 turns into a README.