Troubleshooting With the Windows Sysinternals Tools

by Mark E. Russinovich, Aaron Margosis

2nd edition of paperback issue with ISBN 978-0-7356-8444-7.

Optimize Windows system reliability and performance with Sysinternals
IT pros and power users consider the free Windows Sysinternals tools indispensable for diagnosing, troubleshooting, and deeply understanding the Windows platform. In this extensively updated guide, Sysinternals creator Mark Russinovich and Windows expert Aaron Margosis help you use these powerful tools to optimize any Windows system’s reliability, efficiency, performance, and security. The authors first explain Sysinternals’ capabilities and help you get started fast. Next, they offer in-depth coverage of each major tool, from Process Explorer and Process Monitor to Sysinternals’ security and file utilities. Then, building on this knowledge, they show the tools being used to solve real-world cases involving error messages, hangs, sluggishness, malware infections, and much more.

Windows Sysinternals creator Mark Russinovich and Aaron Margosis show you how to:
* Use Process Explorer to display detailed process and system information
* Use Process Monitor to capture low-level system events, and quickly filter the output to narrow down root causes
* List, categorize, and manage software that starts when you start or sign in to your computer, or when you run Microsoft Office or Internet Explorer
* Verify digital signatures of files, of running programs, and of the modules loaded in those programs
* Use Autoruns, Process Explorer, Sigcheck, and Process Monitor features that can identify and clean malware infestations
* Inspect permissions on files, keys, services, shares, and other objects
* Use Sysmon to monitor security-relevant events across your network
* Generate memory dumps when a process meets specified criteria
* Execute processes remotely, and close files that were opened remotely
* Manage Active Directory objects and trace LDAP API calls
* Capture detailed data about processors, memory, and clocks
* Troubleshoot unbootable devices, file-in-use errors, unexplained communication, and many other problems
* Understand Windows core concepts that aren’t well-documented elsewhere

Genres: Technology, Computers, Computer Science, Technical, Reference, Software

655 pages, Paperback

First published January 1, 2009

About the author

Mark Russinovich is a Technical Fellow in Windows Azure, Microsoft's cloud operating system group. Russinovich is a widely recognized expert in Windows operating system internals as well as operating system architecture and design.

Russinovich joined Microsoft when Microsoft acquired Winternals software, the company he cofounded in 1996 and where he worked as Chief Software Architect. He is also cofounder of Sysinternals.com, where he wrote and published dozens of popular Windows administration and diagnostic utilities including Autoruns, Process Explorer and Tcpview.

Russinovich coauthored "Windows Internals" and "The Sysinternals Administrator's Reference," both from Microsoft Press, authored the cyberthriller Zero Day, is a Contributing Editor for TechNet Magazine and Senior Contributing Editor for Windows IT Pro Magazine, and has written many articles on Windows internals. He has been a featured speaker at major industry conferences around the world, including Microsoft's TechEd, IT Forum, and Professional Developer's Conference, as well as Windows Connections, Windev, and TechMentor, and has taught Windows internals, troubleshooting and file system and device driver development to companies worldwide, including Microsoft, the CIA and the FBI. Russinovich earned his Ph.D. in computer engineering from Carnegie Mellon University.

Reviews

[Chris]

Too much time covering command line flags and menu items, not enough time covering case studies of how to use the tools. The final section that does this is really good, but unfortunately rather short compared to the reference portion.

[Juan]

This book focuses on explaining how to use Sysinternals tools (options available, command line parameters, etc).
It's not technically hard to understand for a Windows admin. It's good for a begginer and intermediate, but not enough for a pro.
Final chapters are the best ones because deepens into real case scenarios. Unfortunatelly, that section is extremely short. I would appreciate more examples like these.

[Billy]

This is a great companion if you’ve got use cases for SysInternals that really require leveraging all the advanced features and everything SysInternals has to offer. If you just want to learn how these tools work, you can get by with searching for blog posts or simply experimenting with them on a test system. So it can be hard to really get a good return on your time and money reading this book cover to cover. I found it much more valuable when I had specific projects that required, for example, diving deep into Autoruns.exe. In which case it was an excellent resource that covers things I was not able to find anywhere on the internet.

[Ivan Vagunin]

2/3 of the book is like reading boring user manual, last part is good though.

[Tamahome]

I wish stores would stock it.

This is the shiznit. Although the Administrator account certainly isn't 'unrestricted'. You need the System user for that.

[Joel Tone]

It needs more examples and fewer pages just listing off each switch.