Troubleshooting processes with Process Explorer and Process Monitor 6/19/2018 7:18 PM BRK3268 Troubleshooting processes with Process Explorer and Process Monitor Sami Laiho, MVP—Windows OS Senior Technical Fellow—Adminize Senior Advisor—Intility/Applixure Member of Names.fi © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Sami Laiho Senior Technical Fellow adminize.com Twitter: @samilaiho IT Admin since 1996 MCT since 2001 MVP in Windows OS since 2011 Specializes in and trains: Troubleshooting Security Hacking Penetration testing Social Engineering Trophies: NIC 2016, 2017 - Best Speaker Ignite 2015 – Best male presenter ;) (#2 out of 1000 speakers) TechEd Europe 2014 – Best session TechEd North America 2014 - Best session, Best speaker TechEd Australia 2013 - Best session, Best speaker

I got certs

2,6 pounds of them

“JÄRJESTELMÄNVALVOJA” SWAG

Finnish is so easy! The feeling when you are going to get drunk home alone in your underwear – with no intention of going out. We have a word for it!! NO WAIT, THAT’S NOT ENOUGH… We actually have an official EMOJI for it!

6/19/2018 7:18 PM KALSARIKÄNNIT © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demos or Slides?

Process Explorer

Starting Sami Laiho

Registry

Views Sami Laiho

Threads and Stacks Sami Laiho

Service Host grouping in Windows 10 1703 To see the refactoring behavior, create a Windows 10 version 1703 VM and configure the memory settings as follows: To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. https://docs.microsoft.com/en-us/windows/application-management/svchost-service-refactoring

Case – Hanged virtual machine 6/19/2018 Case – Hanged virtual machine VM totally stuck… Task manager looks like this © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Case – Hanged virtual machine 6/19/2018 Case – Hanged virtual machine Task Manager shows that SYSTEM is causing the problem… © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Case – Hanged virtual machine 6/19/2018 Case – Hanged virtual machine Process Explorer shows Threads! © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Case – Hanged virtual machine 6/19/2018 Case – Hanged virtual machine Removed the virtual floppy because it was pointing to a nonexistent file  © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Virus Hunting Sami Laiho

Resource Usage Sami Laiho

Saving Data Sami Laiho

Process Monitor

Launching Sami Laiho

Log Files Sami Laiho

Views Sami Laiho

Advanced Filtering Sami Laiho

Tips and Tricks for finding Sami Laiho

Logoff/Logon and Boot Sami Laiho

Profiling Sami Laiho

Remote Procmon Sami Laiho

Want more? Sessions to come: Today: THR3087, Tomorrow: BRK3286 Check out my videos at PluralSight! Check out my personal video library at https://win-fu.com/dojo Follow me on Twitter: @samilaiho Blog, Slack: https://win-fu.com/ Consulting? Email me at sami@adminize.com

Please evaluate this session Tech Ready 15 6/19/2018 Please evaluate this session From your Please expand notes window at bottom of slide and read. Then Delete this text box. PC or tablet: visit MyIgnite https://myignite.microsoft.com/evaluations Phone: download and use the Microsoft Ignite mobile app https://aka.ms/ignite.mobileapp Your input is important! © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6/19/2018 7:18 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.