Complete guide to Sysinternals Suite: all the tools explained

Sysinternals Suite is one of those utility packages that, while not widely known, contains incredibly powerful tools for maintaining, analyzing, troubleshooting, and optimizing the Windows operating system. Created in 1996 by Mark Russinovich and Bryce Cogswell, and later acquired by Microsoft, this collection has been widely adopted by IT professionals, system administrators, and developers for advanced diagnostic and troubleshooting tasks.

In this comprehensive article, we'll explain exactly what Sysinternals Suite is, how you can use it, and what each of its main tools does. If you've ever encountered mysterious processes slowing down your PC, locked files you can't delete, or needed to audit network connections, you'll find a veritable arsenal of solutions here.

What is Sysinternals Suite?

Sysinternals Suite is a bundled set of tools designed to provide analysis, control, and management capabilities for the Windows operating system beyond what is available by default. While the suite includes over 70 utilities, many are also available separately from the official Microsoft website.

This package does not include non-troubleshooting tools, such as the BSOD screen saver . The tools it does include are designed to investigate processes, services, registry keys, network connections, disk files, and more . The good news is that many of them are portable, so they don't require installation.

In addition, Microsoft offers an online version called Sysinternals Live , which allows you to run any tool directly from a URL, as if it were a cloud-based application. You can access and run the entire suite without downloading anything at https://live.sysinternals.com/.

Main tools of Sysinternals Suite

The tools are divided into functional categories: process analysis, disk, network, security, system, and many others. Here's a detailed look at the most used and popular utilities:

Process Explorer

If you've ever thought Windows Task Manager falls short, Process Explorer is what you've been looking for. This tool offers an in-depth view of all active system processes , displaying process trees with parent-child relationships, loaded DLL files, open handlers, and the user running each one. You can find more information on how this tool works in a tutorial.

One of its key features is the ability to identify which process is blocking a specific file . It also allows you to verify the digital signature of executables to identify suspicious or malicious software.

Process Monitor

Process Monitor, also known as Procmon, complements Process Explorer by offering a detailed, real-time view of file system, registry, and process or thread activity . It is useful for tracking background events and recognizing suspicious behavior patterns.

It helps you understand which application is accessing which resource, displaying thousands of events per second, which you can filter by process name, event type, file path, and much more. Ideal for detecting compatibility issues, software errors, or malware.

Autoruns

Autoruns lets you see everything that runs automatically on your computer when the system starts . This includes programs, drivers , services, scheduled tasks, and browser components. Unlike MSConfig, Autoruns offers much broader and more detailed coverage. You can learn more about how it works with a [link/tool ​​name].

It includes an option to hide Microsoft processes, making it easier to detect potentially unwanted third-party software . It also integrates with VirusTotal, allowing you to check for potential threats using dozens of antivirus engines.

ProcDump

ProcDump is a command -line utility designed to create memory dumps when a process crashes or behaves abnormally. This is essential for analyzing critical errors or application crashes.

ProcDump can be configured to generate a dump based on triggers such as CPU usage spikes, memory access errors, or unhandled exceptions . It is also available for Linux and Mac , extending its usefulness beyond Windows.

PsTools and PsExec

PsTools is a suite of command-line utilities primarily intended for corporate environments. It includes tools such as PsPing, PsKill, PsInfo, and PsLoggedOn. One of its most well-known tools is PsExec , which allows programs to be executed remotely without the need to install agents on the target computers.

For example, you can remotely force a group policy update on another computer using PsExec \\nombreDeEquipo gpupdate. His behavior is quite reminiscent of SSH in *nix environments.

Sysmon (System Monitor)

Sysmon is an advanced tool that installs as a system service and remains active even after the computer is restarted. Its purpose is to log key security-related system events , such as process creation, network connections, and file changes, to the Windows Event Log.

Ideal for business environments and cybersecurity- focused administrators , Sysmon detects suspicious activity patterns that may be indicative of malware or anomalous behavior.

BGInfo

BGInfo is a small utility that displays technical information directly on the desktop background : computer IP address, free disk space, hostname, operating system version, etc.

Very useful for environments where multiple computers are managed and quick access to technical details is needed without opening menus or executing commands.

Desktops

Although Windows 10 and later versions include built-in virtual desktops, Desktops enables this functionality in earlier versions of the system . You can create up to four virtual desktops and easily switch between them.

Disk2vhd

Disk2vhd converts a physical disk into a .VHD (virtual disk image) file that can be used directly in virtual machines such as Hyper-V or Microsoft Virtual PC. It's ideal for easily converting a physical Windows installation into a virtual machine.

tcpview

TCPView provides a real-time representation of all TCP and UDP connections on the system , displaying the associated process, source and destination IP addresses, and connection status. It is an essential tool for detecting suspicious connections or malicious traffic.

Zoomin

ZoomIt allows you to dynamically zoom on the screen and draw on it using keyboard shortcuts. It is especially suited for technical presentations in front of a projector or during classes and webinars.

It has features such as a timer for breaks or simulation of specific activities, and since 2025 it has been integrated into Microsoft's PowerToys as an open source tool.

Other useful tools included

In addition to those mentioned above, the Sysinternals Suite includes many other interesting utilities:

• AccessEnum: Identifies permission inconsistencies in files and registry keys.
• Contig: Defragments individual files instead of entire disks.
• DiskMon: Monitors the active sectors of the disk in real time.
• RAMMap: Shows how RAM usage is distributed.
• SigCheck: Verifies digital signatures of executable files or DLLs.
• RegJump: Directly opens a given registry key.
• SDelete: Securely delete files and free space, preventing recovery.

How to download Sysinternals Suite

The suite can be downloaded in ZIP format from the Microsoft Learn portal and includes all executables and help files. Specific versions for ARM64 and Nano Server are also available, tailored to their specific needs.

If you don't want to download everything, you can access each tool from the internet using Sysinternals Live . Just type an address like this into your File Explorer:

\\live.sysinternals.com\tools\autoruns.exe

Or navigate directly to to see all available utilities.

Sysinternals Suite is one of the most comprehensive collections of utilities for Windows maintenance, analysis, and troubleshooting . Its combination of graphical and command-line tools, along with coverage ranging from process management to advanced security, makes it an indispensable resource for both professional and personal use. Despite its initial complexity, its tools are thoroughly explained in the official documentation, forums, and online tutorials. Exploring and mastering Sysinternals can make all the difference in keeping your operating system optimized and trouble-free.