Windows Performance and Monitoring: Sysinternals Process Explorer

Windows performance, monitoring, and troubleshooting don’t stop at Task Manager. Sysinternals Process Explorer is a powerful Task Manager complement (and optional replacement) that helps you drill into processes, handles, DLLs, threads, and stacks to find real root causes. If you want to move from guessing "something is slow" to proving "this is the exact thread causing it," this admin-focused deep dive is for you.

You’ll learn: 🧠🛠️
• Download Process Explorer (manual ZIP vs Microsoft Store/MSIX) and launch it elevated
• Customize columns, enable signature verification, and understand ProcExp’s color cues
• Use **System Information** to interpret CPU (user vs kernel), Memory, I/O, and GPU “Engines”
• Use the **Lower Pane**: Handles (locked files), DLLs (modules/strings), Threads (Stacks + Modules)
• Configure **symbols** (dbghelp.dll + Microsoft Symbol Server) so thread stacks resolve cleanly
• Create process dumps for deeper debugging (and understand the data/sensitivity implications)
• Find **locked files** using “Find Handle or DLL” and safely respond to results
• Reset Process Explorer settings back to defaults (HKCU registry key)
Target Audience: Prosumers / IT Pros / Sysadmins / Students / Cloud engineers
Skill Level: Intermediate / Advanced
Applies to:
✅ Windows 11
✅ Windows 10
✅ Windows Server 2025
✅ Windows Server 2022
✅ Windows Server 2019
✅ Windows Server 2016
Hashtags:
#ProcessExplorer #Sysinternals #WindowsPerformance #PerformanceMonitoring #WindowsTroubleshooting #TaskManager #WindowsServer #Windows11 #PowerShell #WPA #ETW #SysAdmin
Commands and Scripts GitHub:
https://github.com/DariensTips

Get-AppxPackage -Name Microsoft.SysinternalsSuite
Get-Command procexp.exe | Select-Object Name,Path

$taskmgrPath="C:\Windows\System32\Taskmgr.exe"
Get-ChildItem -Path $taskmgrPath
Get-FileHash -Path $taskmgrPath
Get-AuthenticodeSignature -FilePath $taskmgrPath | Select-Object *
Get-ItemProperty -Path $taskmgrPath | Select-Object *

Get-Item 'HKCU:\Software\Sysinternals\Process Explorer\'
Remove-Item 'HKCU:\Software\Sysinternals\Process Explorer\'
Chapters:
0:00 Introduction
00:47 Obtain Process Explorer
03:29 Launching Process Explorer
04:29 UI Tour
06:40 Replace Task Manager
08:57 System Information
10:45 Lower Pane + Symbols
14:12 Process
16:43 Process: Properties
18:38 Finding Locked Files
19:38 Reset Process Explorer
20:13 Links & Resources
20:41 Thank you for watching
Links & Resources:
https://learn.microsoft.com/en-us/answers/tags/435/sysinternals
https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
https://learn.microsoft.com/en-us/troubleshoot/windows-server/support-tools/troubleshoot-issues-process-explorer
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/advanced-symsrv-use
https://learn.microsoft.com/en-us/windows/msix/overview
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/
https://msdl.microsoft.com/download/symbols
Glossary:
PID = Process Identifier
IPC = Inter-Process Communication
DLL = Dynamic Link Library
IFEO = Image File Execution Options
Handle = Reference a process holds to a system object (file, registry key, event, mutex, etc.)
Thread = An execution path within a process; the unit Windows schedules on CPU cores
Symbols= Debug data that resolves raw addresses into readable function names/stack frames
PDB = Program Database
Related videos and Playlists:
https://www.youtube.com/playlist?list=PLLmyrX1SggDDcpBDqkEsf8iGh6RaPAyI0
https://www.youtube.com/playlist?list=PLLmyrX1SggDDbrk7v2lNZE7Um3bLlac-4
Disclaimer :
⚠️ Sysinternals Process Explorer is an advanced administrative diagnostic tool that exposes powerful actions—closing handles, terminating processes/threads, changing priority/affinity, and creating memory dumps—that can cause application crashes, data loss, data corruption, system instability, or expose sensitive, personally identifiable information if used improperly. Always test in a lab first, use least privilege where possible, and avoid making changes on production systems unless you fully understand the impact and have approvals/backups.
Attribution:
Creme Brulee - The Soundlings (YouTube Audio Library)

Видео Windows Performance and Monitoring: Sysinternals Process Explorer канала Darien's Tips