Laura A. Robinson July 10, 1968 - June 30, 2017 11/9/2018 10:45 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

The Sysinternals tools make you better at your job 11/9/2018 10:45 AM BRK3148 The Sysinternals tools make you better at your job Aaron Margosis Principal Consultant Dark Lord https://blogs.msdn.microsoft.com/aaron_margosis @AaronMargosis © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Windows Sysinternals - www.sysinternals.com 11/9/2018 Windows Sysinternals - www.sysinternals.com Suite of around 70 systems diagnostics, troubleshooting and management tools Started in 1996 by Mark Russinovich and Bryce Cogswell Freeware, lightweight, single-image, xcopy-deployed Can also execute from Web: \\live.sysinternals.com\tools\toolname 3.5 million downloads/month Most popular tools: Process Explorer, Autoruns, Process Monitor Authored and maintained by Mark Russinovich (CTO, Microsoft Azure) Many co-authored by Bryce Cogswell (retired in 2010) Three tools have key contributors: ProcDump – Andrew Richards LiveKd – Ken Johnson (a.k.a., Skywing) Sysmon – Thomas Garnier, David Magnotti, and others © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2011: The Sysinternals Administrator’s Reference 11/9/2018 2011: The Sysinternals Administrator’s Reference The official guide to the Sysinternals tools Covers every tool, every feature, with tips Written by Mark Russinovich and Aaron Margosis Full chapters on the major tools Process Explorer Process Monitor Autoruns Other chapters by tool group Security, Process, AD, Desktop, … Case of the Unexplained © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Late 2016: Second edition – even more better! 11/9/2018 10:45 AM Late 2016: Second edition – even more better! 40% more book! ProcDump now a whole chapter New tools, including Sysmon and PsPing New and updated features for all tools Deeper detail Over 2.5x more cases Makes a great gift! © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/9/2018 10:45 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Let’s just do stuff… 11/9/2018 10:45 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Case of the Reverting Office Theme 11/9/2018 10:45 AM Case of the Reverting Office Theme “Colorful” (???) theme “White” theme © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/9/2018 10:45 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

https://aka.ms/tshirt/keepcalm Proceeds to Seattle Humane Society 11/9/2018 10:45 AM https://aka.ms/tshirt/keepcalm Proceeds to Seattle Humane Society © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session Tech Ready 15 11/9/2018 Please evaluate this session From your Please expand notes window at bottom of slide and read. Then Delete this text box. PC or tablet: visit MyIgnite https://myignite.microsoft.com/evaluations Phone: download and use the Microsoft Ignite mobile app https://aka.ms/ignite.mobileapp Your input is important! © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/9/2018 10:45 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.