New Sysinternals Utilities

[Markbnj]

Thought you guys would be interested in these releases. The following is from the Technet advisory:

Whether you're an IT pro or a developer, the Windows Sysinternals site provides utilities to help you manage, troubleshoot, and diagnose your Windows systems and applications. Here are some of the new or updated utilities available within the last month:

Process Monitor v1.1, an advanced monitoring tool for Windows that shows real-time file system, registry, and process/thread activity. It combines the features of two earlier Sysinternals utilities, Filemon and Regmon, and adds an extensive list of new enhancements.

AccessChk v3.0, a security utility that shows you the methods that users have to gain access to files, registry keys, and services. The update adds support for processes, including display of their Windows Vista object and running integrity levels.

PSExec v1.80, a lightweight Telnet replacement that lets you execute processes on other systems. This update enhances the -i option to allow process launch in a specific session; on Windows Vista, the -l switch runs a process with low integrity.

 

[DaiShan]

Nice post. I've used ProcMon to build a few security templates for applications that do not run under limited user accounts, and for which the Manufacturer will not or cannot provide file/registry access information. Very handy.

 

[gsellis]

We use all for development work and software integration. :thumbsup: Hope this new MS purchase has made Russ and company more opportunities to enjoy their off time.

BTW, if you have security software that watches for rootkit behavior such as hooking the Syscall table, Process Monitor, File Mon, and Reg Mon will all get tagged. Along the same lines, PSExec has been used to exploit systems, so if it is running unexpectedly, find out why.

 

[Genx87]

Heh this is kind of funny because I had a machine that had the Windows Update process going haywire yesterday and I used ProcMon to verify.

 

[Dari]

How come process monitor64 on my vista 64 shows nothing?

 

[bsobel]

Procmon including file and reg for quite some time, this is just an update.