Process Monitor is an advanced monitoring tool that shows real-time file system, registry, and process activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds a number of other enhancements. When analyzing a Process Monitor log, it is recommended to filter out entries.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

Yes, it is safe.

1. Run Procmon.exe.
2. Select Options -> Enable Boot Logging.
3. Click OK.
4. Restart the operating system.
5. Wait until the system starts (it may take up to 15 minutes) and run Procmon.exe again.
6. Click Yes and save the log file.

Process Explorer can be used to track down problems. For example, it provides a means to list or search for named resources that are held by a process or all processes. This can be used to track down what is holding a file open and preventing its use by another program.

Process Explorer is a freeware task manager and system monitor for Microsoft Windows created by SysInternals, which has been acquired by Microsoft and re-branded as Windows Sysinternals. For example, it provides a means to list or search for named resources that are held by a process or all processes.

Each process running in Windows is assigned a unique decimal number called the process ID (PID). This number is used in a number of ways, for example to specify the process when attaching a debugger to it.

Create a boot log

1. Download Process Monitor, then extract the file ProcessMonitor.
2. To start logging, double-click Procmon.exe to run the tool.
3. Select Options > Enable Boot Logging.
4. Click OK.
5. Restart the computer.
6. Once Windows has finished loading, double-click Procmon.exe.
7. To save the log file, click Yes.

Maximize Process Monitor and uncheck the option File -> Capture Events. Event logging will stop….

1. Run Procmon.exe.
2. Select Options -> Enable Boot Logging.
3. Click OK.
4. Restart the operating system.
5. Wait until the system starts (it may take up to 15 minutes) and run Procmon.exe again.
6. Click Yes and save the log file.

Process Monitor is a monitoring software for Windows that displays real-time system, process/thread and Registry activity. It puts together the functionalities of two powerful Sysinternal utilities- Filemon and Regmon.

Process Monitor monitors and records all actions attempted against the Microsoft Windows Registry. Process Monitor can be used to detect failed attempts to read and write registry keys. It also allows for filtering on specific keys, processes, process IDs, and values.

Boot logging lists the files that successfully and unsuccessfully processed during startup. You use boot logging to log the Windows features that are processed when you start your computer in safe mode and also in normal mode. By comparing the differences between the two logs, you can determine which features are not required to start.