Sysinternals

https://learn.microsoft.com/en-us/sysinternals/
Admin
Sysinternals is a suite of advanced system utilities and technical resources designed to help IT...
Tokens:75,321
Snippets:1,299
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install Sysmon with a configuration file

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

Installs Sysmon using a specified XML configuration file.

```Windows Command Prompt
sysmon -accepteula -i c:\windows\config.xml
```

--------------------------------

### Install Sysmon with default settings

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

Installs Sysmon using default settings, which includes SHA1 hashing for process images and no network monitoring.

```Windows Command Prompt
sysmon -accepteula -i
```

--------------------------------

### Configure PsPing Server

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping

Command syntax to start the PsPing server for listening.

```Windows Command Prompt
psping [[-6]|[-4]] [-f] <-s source:sourceport>
```

--------------------------------

### Install Agent Skills via Command Line

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/debugview

Commands to install agent-specific skills into the current workspace or globally for various AI coding assistants.

```batch
REM Install skills for GitHub Copilot in the current workspace
dbgviewcli --install-skills copilot

REM Install skills globally for Claude (available in all projects)
dbgviewcli --install-skills claude --global

REM Install skills for Cursor (local only)
dbgviewcli --install-skills cursor

REM Install skills for Codex globally
dbgviewcli --install-skills codex --global
```

--------------------------------

### Coreinfo Output Example

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/coreinfo

A sample output showing CPU identification, microcode signatures, and supported processor features.

```text
Coreinfo v4.0 - Dump information on system CPU and memory topology
Copyright © 2008-2025 Mark Russinovich
Sysinternals - www.sysinternals.com

Intel(R) Core(TM) Ultra 7 165U
Intel64 Family 6 Model 170 Stepping 4, GenuineIntel

Microcode signature: 0000001E
Processor signature: 000A06A4

Maximum implemented CPUID leaves: 00000023 (Basic), 80000008 (Extended).
Maximum implemented address width: 48 bits (virtual), 46 bits (physical).

HTT             *       Hyperthreading enabled
CET             *       Supports Control Flow Enforcement Technology
Kernel CET      -       Kernel-mode CET Enabled
User CET        *       User-mode CET Allowed

X64             *       Supports 64-bit mode
SMX             -       Supports Intel trusted execution
SKINIT          -       Supports AMD SKINIT
SGX             -       Supports Intel SGX
NX              *       Supports no-execute page protection
SMEP            *       Supports Supervisor Mode Execution Prevention
SMAP            *       Supports Supervisor Mode Access Prevention
PAGE1GB         *       Supports 1 GB large pages
PAE             *       Supports > 32-bit physical addresses
PAT             *       Supports Page Attribute Table
PSE             *       Supports 4 MB pages
PSE36           *       Supports > 32-bit address 4 MB pages
PGE             *       Supports global bit in page tables
SS              *       Supports bus snooping for cache operations
VME             *       Supports Virtual-8086 mode
RDWRFSGSBASE    *       Supports direct GS/FS base access
FPU             *       Implements i387 floating point instructions
MMX             *       Supports MMX instruction set
MMXEXT          -       Implements AMD MMX extensions
3DNOW           -       Supports 3DNow! instructions
3DNOWEXT        -       Supports 3DNow! extension instructions
SSE             *       Supports Streaming SIMD Extensions
SSE2            *       Supports Streaming SIMD Extensions 2
SSE3            *       Supports Streaming SIMD Extensions 3
SSSE3           *       Supports Supplemental SIMD Extensions 3
SSE4a           -       Supports Streaming SIMDR Extensions 4a
SSE4.1          *       Supports Streaming SIMD Extensions 4.1
SSE4.2          *       Supports Streaming SIMD Extensions 4.2
AES             *       Supports AES extensions
AVX             *       Supports AVX instruction extensions
AVX2            *       Supports AVX2 instruction extensions
AVX-512-F       -       Supports AVX-512 Foundation instructions
AVX-512-DQ      -       Supports AVX-512 double and quadword instructions
AVX-512-IFAMA   -       Supports AVX-512 integer Fused multiply-add instructions
AVX-512-PF      -       Supports AVX-512 prefetch instructions
AVX-512-ER      -       Supports AVX-512 exponential and reciprocal instructions
AVX-512-CD      -       Supports AVX-512 conflict detection instructions
AVX-512-BW      -       Supports AVX-512 byte and word instructions
AVX-512-VL      -       Supports AVX-512 vector length instructions
FMA             *       Supports FMA extensions using YMM state
MSR             *       Implements RDMSR/WRMSR instructions
MTRR            *       Supports Memory Type Range Registers
XSAVE           *       Supports XSAVE/XRSTOR instructions
OSXSAVE         *       Supports XSETBV/XGETBV instructions
RDRAND          *       Supports RDRAND instruction
RDSEED          *       Supports RDSEED instruction
CMOV            *       Supports CMOVcc instruction
CLFSH           *       Supports CLFLUSH instruction
CX8             *       Supports compare and exchange 8-byte instructions
CX16            *       Supports CMPXCHG16B instruction
BMI1            *       Supports bit manipulation extensions 1
BMI2            *       Supports bit manipulation extensions 2
ADX             *       Supports ADCX/ADOX instructions
DCA             -       Supports prefetch from memory-mapped device
F16C            *       Supports half-precision instruction
FXSR            *       Supports FXSAVE/FXSTOR instructions
```

--------------------------------

### Daemon Configuration File Format

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent

Example TOML configuration for the listent daemon.

```toml
[daemon]
polling_interval = 1.0
auto_start = true

[monitoring]
path_filters = []
entitlement_filters = ["com.apple.security.*", "*network*"]

[logging]
level = "info"
subsystem = "com.microsoft.sysinternals.listent"
category = "daemon"
```

--------------------------------

### Manage Background Daemon Service

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent

Install, monitor, and manage the persistent listent background service using launchd.

```bash
# Install and start daemon
sudo listent daemon install

# Check daemon status
listent daemon status

# View daemon logs
listent daemon logs
listent daemon logs --since 1h
listent daemon logs --since 30m
listent daemon logs --since "2025-01-15 10:00"
listent daemon logs --format json
listent daemon logs -f                    # Follow logs in real-time

# Stop daemon process
listent daemon stop

# Uninstall service
sudo listent daemon uninstall
```

--------------------------------

### Install ProcDump

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/procdump

Registers ProcDump as the post-mortem debugger for Windows.

```Windows Command Prompt
procdump.exe -i [Dump_Folder]
            [-mm] [-ma] [-mt] [-mp] [-mc <Mask>] [-md <Callback_DLL>] [-mk]
            [-r]
            [-at <Timeout>]
            [-k]
            [-wer]
```

--------------------------------

### Manage Listent Daemon

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent

Commands to install, monitor, and control the background daemon process.

```bash
# Install daemon with default monitoring (requires sudo)
sudo listent daemon install

# Install with custom configuration file
sudo listent daemon install --config /path/to/config.toml

# View recent daemon activity
listent daemon logs --since 1h

# Check if daemon is running
listent daemon status

# Stop and remove daemon
listent daemon stop
sudo listent daemon uninstall
```

--------------------------------

### Azure Load Balance Configuration

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman

Example string for configuring load balance settings in the Connection Settings tab.

```text
Cookie: mstshash=MyServiceWebRole#MyServiceWebRole_IN_0#Microsoft.WindowsAzure.Plugins.RemoteAccess.Rdp
```

--------------------------------

### Monitor and Launch Processes

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/procdump

Commands to wait for a process to start or launch a new process for monitoring.

```Windows Command Prompt
C:\>procdump -e -w notepad
```

```Windows Command Prompt
C:\>procdump -e -x c:\dumps notepad
```

```Windows Command Prompt
C:\>procdump -e -x c:\dumps Microsoft.BingMaps_8wekyb3d8bbwe!AppexMaps
```

```Windows Command Prompt
C:\>procdump -e -x c:\dumps Microsoft.BingMaps_1.2.0.136_x64__8wekyb3d8bbwe
```

--------------------------------

### Display LoggedOn utility output

Source: https://learn.microsoft.com/en-us/sysinternals/resources/archive/v01n03

Example output showing interactive and resource-based user sessions on a remote system.

```text
C:\>loggedon main

LoggedOn v1.0 - Logon Session Displayer
Copyright (C) 1999 Mark Russinovich
Systems Internals - http://www.sysinternals.com

Users logged on locally:
MAIN\Administrator

Users logged on via resource shares:
MAINDOM\MARK
```

--------------------------------

### Run Internet Explorer with limited privileges

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

Starts Internet Explorer with restricted user permissions.

```bash
psexec -l -d "c:\program files\internet explorer\iexplore.exe"
```

--------------------------------

### Check for Unsigned Files

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck

Example command to identify unsigned executable files within the Windows System32 directory.

```text
sigcheck -u -e c:\windows\system32
```

--------------------------------

### Drive Letter Specification

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete

Example of how to specify a drive letter when using SDelete.

```text
D:
```

--------------------------------

### Configure PsPing Server

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping

Sets up a server instance to listen for latency and bandwidth tests on a specific address and port.

```batch
psping -s 192.168.2.2:5000
```

--------------------------------

### Display PsPing usage help

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping

Displays the available command-line options for different test types.

```text
psping -? [i|t|l|b]
```

--------------------------------

### RawAccessRead event XML schema

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

Example of the XML schema definition for the RawAccessRead event type.

```xml
<event name="SYSMON_RAWACCESS_READ" value="9" level="Informational "template="RawAccessRead detected" rulename="RawAccessRead" version="2">  
  <data name="UtcTime" inType="win:UnicodeString" outType="xs:string"/>  
  <data name="ProcessGuid" inType="win:GUID"/>  
  <data name="ProcessId" inType="win:UInt32" outType="win:PID"/>  
  <data name="Image" inType="win:UnicodeString" outType="xs:string"/>  
  <data name="Device" inType="win:UnicodeString" outType="xs:string"/>  
</event>
```

--------------------------------

### Define Entitlement Patterns

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/listent

Examples of using the -e flag with exact matches and glob patterns.

```bash
# Exact match
-e "com.apple.security.network.client"

# Wildcard patterns
-e "com.apple.security.*"        # All Apple security entitlements
-e "*network*"                   # Any entitlement containing "network"
-e "*.debug.*"                   # Debug-related entitlements

# Multiple patterns (OR logic)
-e "com.apple.private.*" -e "*.debug.*"
```

--------------------------------

### Configure PsPing Client

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psping

Command syntax to initiate a PsPing client test.

```Windows Command Prompt
psping [-b] [[-6]|[-4]] [-f] [-u] [-h [buckets | <val1>,<val2>,...]] [-r] <-l requestsize>[k|m]] <-n count> [-i <outstanding>] [-w <count>] <destination:destport>
```

--------------------------------

### Bulk Add Server Patterns

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman

Patterns for adding multiple servers using iteration and range syntax.

```text
server1{a,b,c}
```

```text
server[001-15]
```

```text
{dca,dcb}rack[1-5]sql[1-2]
```

--------------------------------

### Display ProcDump help and exception options

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/procdump

Use this command to view the help menu and exception monitoring options for ProcDump.

```batch
C:\>procdump -? -e
```

--------------------------------

### Import Server Text File Format

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/rdcman

Format for importing servers from a text file, requiring one server name per line.

```text
Server1
SecondServer
YANS
```

--------------------------------

### View PnP Manager Debug Output

Source: https://learn.microsoft.com/en-us/sysinternals/resources/archive/v03n01

Example of the debug log output generated by the PnP Manager when PnpEnumDebugLevel is set to 2.

```text
.
IopCallDriverAddDevice: Processing devnode 0xfe503208
IopCallDriverAddDevice: DevNode flags going in = 0x000019
IopCallDriverAddDevice: Will load driver
IopCallDriverAddDevice: Opening registry key Root\SYSTEM\0000
IopCallDriverAddDevice:         Class GUID is {4D36E97D-E325-11CE-BFC1-08002BE10318}
IopCallDriverAddDevice: Unable to open GUID\Properties key {4D36E97D-E325-11CE-BFC1-08002BE10318} - 0xc0000034
IopCallDriverAddDevice:         Value Service [Type 1, Len 14] @ 0xe14ee82c
IopCallDriverAddDevice:                 Service Name swenum
IopCallDriverAddDevice:                 DriverName is \Driver\swenum
IopCallDriverAddDevice:                 Driver Reference 0xff3a8af0
IopCallDriverAddDevice: Adding Services (type 0)
IopCallDriverAddDevice: Adding Services (type 1)
IopCallDriverAddDevice: Adding Services (type 2)
IopCallDriverAddDevice: Adding driver 0xff3a8af0
IopCallDriverAddDevice:         Routine returned 00000000
.
```

--------------------------------

### Coreinfo Command-Line Usage

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/coreinfo

The basic syntax for executing Coreinfo with optional flags to filter the output.

```text
coreinfo [-c][-f][-g][-l][-n][-s][-m][-v]
```

--------------------------------

### Show Sysmon configuration schema

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

Displays the XML schema used for Sysmon configuration files.

```Windows Command Prompt
sysmon -s
```

--------------------------------

### Launch an interactive command prompt on a remote system

Source: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec

Starts an interactive command prompt session on the specified remote computer.

```bash
psexec -i \\marklap cmd
```
Tokens:
Raw