Process Monitor (Sysinternals)

What Process Monitor does

Where Process Explorer shows a snapshot of running processes, Process Monitor shows a timeline of every operation those processes perform: which registry keys they read, which files they open or write, and which threads they create, all captured live and filterable.

It's most useful for answering 'why did this fail' questions — a missing file, a denied registry key, a config value being read from the wrong location.

Key features

• Live capture of File System, Registry, Process/Thread, and Network operations with full detail (path, result code, duration).
• Powerful include/exclude filters so you can narrow millions of events down to the handful relevant to your issue.
• Boot logging, which captures activity from very early in the boot process for diagnosing startup problems.
• Process tree view and the ability to save/load captured event sets (.PML files) for later analysis or sharing.
• Highlighting and bookmarking to mark interesting events while scrolling a large capture.

Download and requirements

Process Monitor runs on supported Windows 10/11 (32-bit and 64-bit) as a portable executable — no install needed. Get it from the official Sysinternals downloads page, either standalone or bundled in the full Sysinternals Suite.

Typical use cases

• Finding why an application can't find or write a config/log file.
• Diagnosing 'Access Denied' errors by seeing exactly which registry key or file triggered the failure.
• Confirming which process is spamming disk or registry I/O.
• Tracing what a slow-starting application does before it becomes responsive.

Safety notes

Only download Process Monitor from learn.microsoft.com/sysinternals or the official live share. It doesn't modify the system on its own, but large captures can consume significant disk space and memory, so stop capturing once you have what you need.