Neha Patil (Editor)

Process Monitor

Updated on
Edit
Like
Comment
Share on FacebookTweet on TwitterShare on LinkedInShare on Reddit
License
  
Freeware

Developer(s)
  
Sysinternals, Microsoft

Stable release
  
v3.31 / August 29, 2016; 6 months ago (2016-08-29)

Operating system
  
Windows XP SP2 and higher.

Website
  
File and Disk Utilities > Process Monitor

Process Monitor is a free tool from Windows Sysinternals, part of the Microsoft TechNet website. The tool monitors and displays in real-time all file system activity on a Microsoft Windows operating system. It combines two older tools, FileMon and RegMon and is used in system administration, computer forensics, and application debugging.

Contents

Process Monitor monitors and records all actions attempted against the Microsoft Windows Registry. Process Monitor can be used to detect failed attempts to read and write registry keys. It also allows for filtering on specific keys, processes, process IDs, and values. In addition it shows how applications use files and DLLs, detects some critical errors in system files and more.

History

RegMon and its sister application Filemon were primarily created by Mark Russinovich and Bryce Cogswell, employed by Nu-Mega Technologies and later SysInternals prior SysInternals being bought out by Microsoft in 2006.

The two tools were combined to create Process Monitor. Early versions of Process Monitor (up to version 2.8) ran on Windows 2000 SP4 with Update Rollup 1. The current version only runs on Windows XP with the latest service pack and above.

FileMon

FileMon (from a concatenation of "File" and "Monitor") — was a free utility for 32/64-bit Microsoft Windows operating systems which provided users with a powerful tool to monitor and display file system activity.

FileMon is no longer supported.

RegMon

The RegMon utility from Sysinternals provided forensics on Windows Registry usage.

RegMon is no longer supported.

References

Process Monitor Wikipedia