Sysinternals tools receive major updates

Microsoft updates Sysinternals tools with packaged app support, process tree dumping, webcam overlays, and broader Linux distro compatibility.

A toolchest icon with a Windows wallpaper on the background

The Sysinternals Suite is a collection of a bunch of Windows troubleshooting tools and utilities that can be useful for both power users and IT admins. Examples include Process Explorer, Process Monitor, Sysmon, Autoruns, ProcDump, the PsTools collection, and many others. Now, some individuals tools present in this suite have received significant updates.

Autoruns is typically used to monitor startup items, and its latest v14.2 update adds support for Windows packaged apps. ProcDump, which can be leveraged to generate memory dumps of running processes has netted process tree support through the -pt argument in v12.0. Meanwhile, ZoomIt, also present in Microsoft PowerToys, has received support for webcam overlay for video captures, and also allows appending clips in the video trim editor with v12.0.

Other updates to Sysinternal components are listed below:

DebugView v5.01: This update to DebugView, a tool for displaying both kernel-mode and Win32 debug output, reinstates Windows 10 support, enables highlighting on PID, and fixes a series of bugs.
NotMyFault v4.5: This update to NotMyFault, a tool that can crash, hang, and cause kernel memory leaks on the Windows system, adds a new type of crash for Level-0 Hyper-V virtualized machines, and adds a SecureKernel crash.
Process Explorer v17.12: This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds a "parent PID" column to the main view and fixes a crash on exit.
Process Monitor v4.02: This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, adds Ctrl + PgUp/PgDn for longer scrolling (10 page) in the main list view, shows milliseconds for the times in the Process Tree dialog, and fixes a series of API mismatches.

Finally, it's also worth highlighting that Sysinternals EBPF, Sysmon for Linux, Procmon for Linux, ProcDump for Linux, jcd (on Linux), now offer official support for RHEL10, Debian 13, and Fedora 43. You can grab the download link for these tools through our dedicated Software stories section here.