Sysinternals Live is a service that enables you to execute Sysinternals tools directly from the Web without hunting for and manually downloading them. I just learned about this option while putting together this article. Here's the command to install the entire Sysinternals suite (this is what I use): choco install sysinternals Sysinternals Live Here's the command to install the standalone Process Monitor utility: choco install procmon I mentioned the chocolatey Windows package manager in a previous article. The official download site for the Sysinternals utilities is here: Chocolatey All three options support downloading the entire Sysinternals suite of utilities or a standalone copy of Process Monitor. There are at least three ways to install Process Monitor. Everything you need is packed into a tiny little. One nice thing about the Sysinternals Utilities is that they do not need to be installed. The section on Process Monitor starts at the 31:30 mark. To get the best bang for your buck, I recommend you watch Mark's 2015 talk. I scanned through the Process Monitor portion of each talk to save you from having to watch seven and a half hours of video. The structure of all six talks is the same, but the examples he uses are different each time. Mark's Webcasts are a series of 75-minute presentations from 2010 through 2015. To get started, I recommend watching one or more videos from Mark Russinovich himself. If you've never used Process Monitor before, it can be very overwhelming at first. It's a part of the Sysinternals Utilities suite written by Mark Russinovich. My favorite low-level debugging tool is Process Monitor (aka, procmon).

Process monitor sysinternals windows 7