We’re very happy to announce that Windows Sysinternals Administrator's Reference, by Mark Russinovich and Aaron Margosis (Microsoft Press, 2011; ISBN: 9780735656727; 496 pages), shipped to the printer today! Hard copies should begin being shipped from our distributor to customers on June 27.
You can order the book here as well as here.
Today’s post shares the book’s Introduction and its Contents at a Glance.
Introduction
The Sysinternals Suite is a set of over 70 advanced diagnostic and troubleshooting utilities for the Microsoft Windows platform written by me—Mark Russinovich—and Bryce Cogswell. Since Microsoft’s acquisition of Sysinternals in 2006, these utilities have been available for free download from Microsoft’s Windows Sysinternals Web site (part of Microsoft TechNet).
The goal of this book is to familiarize you with the Sysinternals utilities and help you understand how to use them to their fullest. The book will also show you examples of how I and other Sysinternals users have leveraged the utilities to solve real problems on Windows systems.
Although I coauthored this book with Aaron Margosis, the book is written as if I am speaking. This is not at all a comment on Aaron’s contribution to the book; without his hard work, this book would not exist.
Tools the Book Covers
This book describes all of the Sysinternals utilities that are available on the Windows Sysinternals Web site (http://technet.microsoft.com/en-us/sysinternals/default.aspx) and all of their features as of the time of this writing (summer, 2011). However, Sysinternals is highly dynamic: existing utilities regularly gain new capabilities, and new utilities are introduced from time to time. (To keep up, follow the RSS feed of the “Sysinternals Site Discussion” blog: http://blogs.technet.com/b/sysinternals/.) So, by the time you read this book, some parts of it may already be out of date. That said, you should always keep the Sysinternals utilities updated to take advantage of new features and bug fixes.
This book does not cover Sysinternals utilities that have been deprecated and are no longer available on the Sysinternals site. If you are still using RegMon (Registry Monitor) or FileMon (File Monitor), you should replace them with Process Monitor, described in Chapter 4. Rootkit Revealer, one of the computer industry’s first rootkit detectors (and the tool that discovered the “Sony rootkit”), has served its purpose and has been retired. Similarly, a few other utilities (such as Newsid and EfsDump) that used to provide unique value have been retired be- cause either they were no longer needed or equivalent functionality was eventually added to Windows.
The History of Sysinternals
The first Sysinternals utility I wrote, Ctrl2cap, was born of necessity. Before I started using Windows NT in 1995, I mostly used UNIX systems, which have keyboards that place the Ctrl key where the Caps Lock key is on standard PC keyboards. Rather than adapt to the new layout, I set out to learn about Windows NT device driver development and to write a driver that converts Caps Lock key presses into Ctrl key presses as they make their way from the keyboard into the Windows NT input system. Ctrl2cap is still posted on the Sysinternals site today, and I still use it on all my systems.
Ctrl2cap was the first of many tools I wrote to learn about the way Windows NT works under the hood while at the same providing some useful functionality. The next tool I wrote, NTFSDOS, I developed with Bryce Cogswell. I had met Bryce in graduate school at Carnegie Mellon University, and we had written several academic papers together and worked on a startup project where we developed software for Windows 3.1. I pitched the idea of a tool that would allow users to retrieve data from an NTFS-formatted partition by using the ubiquitous DOS floppy. Bryce thought it would be a fun programming challenge, and we divided up the work and released the first version about a month later.
I also wrote the next two tools, Filemon and Regmon, with Bryce. These three utilities— NTFSDOS, Filemon, and Regmon—became the foundation for Sysinternals. Filemon and Regmon, both of which we released for Windows 95 and Windows NT, showed file sys- tem and registry activity, becoming the first tools anywhere to do so and making them indispensible troubleshooting aids.
Bryce and I decided to make the tools available for others to use, but we didn’t have a Web site of our own, so we initially published them on the site of a friend, Andrew Schulman, who I’d met in conjunction with his own work uncovering the internal operation of DOS and Windows 95. Going through an intermediary didn’t allow us to update the tools with enhancements and bug fixes as quickly as we wanted, so in September 1996 Bryce and I created NTInternals.com to host the tools and articles we wrote about the internal operation of Windows 95 and Windows NT. Bryce and I had also developed tools that we decided we could sell for some side income, so the same month, we also founded Winternals Software, a commercial software company that we bootstrapped by driving traffic with a single banner ad on NTInternals.com. The first utility we released as Winternals Software was NTRecover, a utility that enabled users to mount the disks of unbootable Windows NT systems from a working system and access them as if they were locally attached disks.
The mission of NTInternals.com was to distribute freeware tools that leveraged our deep understanding of the Windows operating system in order to deliver powerful diagnostic, monitoring, and management capabilities. Within a few months, the site, shown below as it looked in December 1996 (thanks to the Internet Archive’s Wayback Machine), drew 1,500 visitors per day, making it one of the most popular utility sites for Windows in the early days of the Internet revolution. In 1998, at the “encouragement” of Microsoft lawyers, we changed the site’s name to Sysinternals.com.
Over the next several years, the utilities continued to evolve. We added more utilities as we needed them, as our early power users suggested enhancements, or when we thought of a new way to show information about Windows.
The Sysinternals utilities fell into three basic categories: those used to help programmers, those for system troubleshooting, and those for systems management. DebugView, a utility that captures and displays program debug statements, was one of the early developer- oriented tools that I wrote to aid my own development of device drivers. DLLView, a tool for displaying the DLLs that processes have loaded, and HandleEx, a process-listing GUI utility that showed open handles, were two of the early troubleshooting tools. (I merged DLLView and HandleEx to create Process Explorer in 2001.) The PsTools, discussed in Chapter 6, are some of the most popular management utilities, bundled into a suite for easy download. PsList, the first PsTool, was inspired initially by the UNIX “ps” command, which provides a process listing. The utilities grew in number and functionality, becoming a software suite of utilities that allowed you to easily perform many tasks on a remote system without requiring installation of special software on the remote system beforehand.
Also in 1996, I began writing for Windows IT Pro magazine, highlighting Windows internals and the Sysinternals utilities and contributing additional feature articles, including a controversial article in 1996 that established my name within Microsoft itself, though not necessarily in a positive way. The article, “Inside the Difference Between Windows NT Workstation and Windows NT Server,” pointed out the limited differences between Windows NT Workstation and Windows NT Server, which contradicted Microsoft’s marketing message. As the utilities continued to evolve and grow, I began to contemplate writing a book on Windows internals. Such a book already existed, Inside Windows NT (Microsoft Press, 1992), the first edition of which was written by Helen Custer alongside the original release of Windows NT 3.1. The second edition was rewritten and enhanced for Windows NT 4.0 by David Solomon, a well-established operating system expert, trainer, and writer who had worked at DEC. Instead of writing a book from scratch, I contacted him and suggested that I coauthor the third edition, which would cover Windows 2000. My relationship with Microsoft had been on the mend since the 1996 article as the result of my sending Windows bug reports directly to Windows developers, but David still had to obtain permission, which Microsoft granted.
As a result, David Solomon and I coauthored the third, fourth, and fifth editions of the book, which we renamed Windows Internals at the fourth edition. (The fifth edition of Windows Internals was published in 2009.) Not long after we finished Inside Windows 2000 (Microsoft Press, 2000), I joined David to teach his Windows internals seminars, adding my own content. Offered around the world, even at Microsoft to the developers of Windows, these classes have long used the Sysinternals utilities to show students how to peer deep into Windows internals and learn more when they returned to their developer and IT professional roles at home. David still offers Windows internals classes at http://www.solsem.com/.
By 2006, my relationship with Microsoft had been strong for several years, Winternals had a full line of enterprise management software and had grown to about 100 employees, and Sysinternals had two million downloads per day. On July 18, 2006, Microsoft acquired Winternals and Sysinternals. Not long after, Bryce and I (there we are below in 2006) moved to Redmond to become a part of the Windows team. Today, I serve as one of Microsoft’s small group of Technical Fellows, providing technical leadership to help drive the direction of the company. I’m now in the Windows Azure group, working on the “kernel” of Microsoft’s cloud operating system.
Two of the goals of the acquisition were to make sure that the tools Bryce and I developed would continue to be freely available and that the community we built would thrive, and they have. Today, the Windows Sysinternals site on technet.microsoft.com is one of the most frequently visited sites on TechNet, averaging 50,000 visitors per day and three mil- lion downloads per month. Sysinternals power users come back time and again for the latest versions of the utilities and for new utilities, such as the recently released RAMMap and VMMap, as well as to participate in the Sysinternals community, a growing forum with over 30,000 registered users at the time of this writing. I remain dedicated to continuing to enhance the existing tools and to add new tools, including ones focused on Windows Azure.
Many people suggested that a book on the tools would be valuable, but it wasn’t until David Solomon suggested that one was way overdue that I started the project. My responsibilities at Microsoft did not permit me to devote the time necessary to write another book, but David pointed out that I could find someone to help. I was pleased that Aaron Margosis agreed to partner with me. Aaron is a Principal Consultant with Microsoft Public Sector Services who is known for his deep understanding of Windows security and application compatibility. I have known Aaron for many years and his excellent writing skills, familiarity with Windows internals, and proficiency with the Sysinternals tools made him an ideal coauthor.
Who Should Read This Book
This book exists for Windows IT professionals and power users who want to make the most of the Sysinternals tools. Regardless of your experience with the tools, and whether you manage the systems of a large enterprise, a small business, or the PCs of your family and friends, you’re sure to discover new tools, pick up tips, and learn techniques that will help you more effectively troubleshoot the toughest Windows problems and simplify your system- management operations and monitoring.
Assumptions
This book expects that you have familiarity with the Windows operating system. Basic familiarity with concepts such as processes, threads, virtual memory, and the Windows command prompt, is helpful, though some of these concepts are discussed in Chapter 2, “Windows Core Concepts”.
Organization of This Book
The book is divided into three parts. Part I, “Getting Started,” provides an overview of the Sysinternals utilities and the Sysinternals Web site, describes features common to all of the utilities, tells you where to go for help, and discusses some Windows core concepts that will help you better understand the platform and the information reported by the utilities. Part II, “Usage Guide,” is a detailed reference guide covering all of the Sysinternals utilities’ features, command-line options, system requirements, and caveats. With plentiful screen shots and usage examples, this section should answer just about any question you have about the utilities. Major utilities such as Process Explorer and Process Monitor each get their own chapter; subsequent chapters cover utilities by category, such as security utilities, Active Directory utilities, and file utilities.
Part III, “Troubleshooting—‘The Case of the Unexplained…’,” contains stories of real-world problem solving using the Sysinternals utilities from Aaron and me, as well as from administrators and power users from around the world.
Contents at a Glance
Part I Getting Started 1 Getting Started with the Sysinternals Utilities . . . . . . . . . . . . . . . . 3 2 Windows Core Concepts . . . . . . . . . . . . . . . . . . . . . . . . . .15
Part II Usage Guide 3 Process Explorer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 4 Process Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .101 5 Autoruns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145 6 PsTools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 7 Process and Diagnostic Utilities . . . . . . . . . . . . . . . . . . . . . 211 8 Security Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261 9 Active Directory Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . 287 10 Desktop Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .309 11 File Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 12 Disk Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .335 13 Network and Communication Utilities . . . . . . . . . . . . . . . . . . 351 14 System Information Utilities . . . . . . . . . . . . . . . . . . . . . . . 359 15 Miscellaneous Utilities . . . . . . . . . . . . . . . . . . . . . . . . . . 377
Part III Troubleshooting—”The Case of the Unexplained...” 16 Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 17 Hangs and Sluggish Performance . . . . . . . . . . . . . . . . . . . . 405 18 Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427
We hope that you will enjoy the book as much as you enjoy the Sysinternals tools.
I'm excited to see this book finally coming out soon! When will it be released as an ebook?
Well, guess I'll answer my question myself: I see the O'Reilly webpage has now been updated to indicate an estimated ebook release date of June 22.