More tips for the adventurous - or those who plan to be one ;-)



Well, as in subject i'd like to introduce some more tools
that will help you guys find out problems in your environments.

I use the following tools in my everyday env and i don't want to miss 'em.

Have a nice weekend,
greetings from germany, where it is quite hot a the moment ;-)
Markus

Process Explorer (my favourite !!!)
Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.
The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you’ll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.
The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.
Process Explorer works on Windows 9x/Me, Windows NT 4.0, Windows 2000, Windows XP, Server 2003, and 64-bit versions of Windows for x64 processors.
http://www.sysinternals.com/Utilities/ProcessExplorer.html


Regmon for Windows NT/9x:
Regmon is a Registry monitoring utility that will show you which applications are accessing your Registry, which keys they are accessing, and the Registry data that they are reading and writing - all in real-time. This advanced utility takes you one step beyond what static Registry tools can do, to let you see and understand exactly how programs use the Registry. With static tools you might be able to see what Registry values and keys changed. With Regmon you'll see how the values and keys changed..
Regmon works on Windows NT/2000/XP/2003, Windows 95/98/Me and Windows 64-bit for Itanium and x64.
http://www.sysinternals.com/Utilities/Regmon.html


Filemon for Windows:
FileMon monitors and displays file system activity on a system in real-time. Its advanced capabilities make it a powerful tool for exploring the way Windows works, seeing how applications use the files and DLLs, or tracking down problems in system or application file configurations. Filemon's timestamping feature will show you precisely when every open, read, write or delete, happens, and its status column tells you the outcome. FileMon is so easy to use that you'll be an expert within minutes. It begins monitoring when you start it, and its output window can be saved to a file for off-line viewing. It has full search capability, and if you find that you're getting information overload, simply set up one or more filters.
FileMon works on NT 4.0, Windows 2000, Windows XP, Windows XP and Windows Server 2003 64-bit Edition, Windows 2003 Server, Windows 95, Windows 98 and Windows ME.
http://www.sysinternals.com/Utilities/Filemon.html


PsFile:
The "net file" command shows you a list of the files that other computers have opened on the system upon which you execute the command, however it truncates long path names and doesn't let you see that information for remote systems. PsFile is a command-line utility that shows a list of files on a system that are opened remotely, and it also allows you to close opened files either by name or by a file identifier.
Installation: Just copy PsFile onto your executable path, and type "psfile".
PsFile works on NT 4.0, Win2K, Windows XP and Server 2003.
http://www.sysinternals.com/Utilities/PsFile.html


Sync:
UNIX provides a standard utility called Sync, which can be used to direct the operating system to flush all file system data to disk in order to insure that it is stable and won't be lost in case of a system failure. Otherwise, any modified data present in the cache would be lost. Here is a an equivalent that Mark wrote, called Sync, that works on all versions of Windows. Use it whenever you want to know that modified file data is safely stored on your hard drives. Unfortunately, Sync requires administrative privileges to run. This version also lets you flush removable drives such as ZIP drives.
http://www.sysinternals.com/Utilities/Sync.html


PsLoggedOn:
You can determine who is using resources on your local computer with the "net" command ("net session"), however, there is no built-in way to determine who is using the resources of a remote computer. In addition, NT comes with no tools to see who is logged onto a computer, either locally or remotely. PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer, or a remote one. If you specify a user name instead of a computer, PsLoggedOn searches the computers in the network neighborhood and tells you if the user is currently logged on. Full source code is included.
PsLoggedOn's definition of a locally logged on user is one that has their profile loaded into the Registry, so PsLoggedOn determines who is logged on by scanning the keys under the HKEY_USERS key. For each key that has a name that is a user SID (security Identifier), PsLoggedOn looks up the corresponding user name and displays it. To determine who is logged onto a computer via resource shares, PsLoggedOn uses the NetSessionEnum API. Note that PsLoggedOn will show you as logged on via resource share to remote computers that you query because a logon is required for PsLoggedOn to access the Registry of a remote system.
Installation: Just copy PsLoggedOn onto your executable path, and type "psloggedon".
PsLoggedOn works on NT 4.0, Win2K, Windows XP and Server 2003.
http://www.sysinternals.com/Utilities/PsLoggedOn.html


Handle:
Ever wondered which program has a particular file or directory open? Now you can find out. Handle is a utility that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program.
http://www.sysinternals.com/Utilities/Handle.html


Portmon:
Portmon is a utility that monitors and displays all serial and parallel port activity on a system. It has advanced filtering and search capabilities that make it a powerful tool for exploring the way Windows works, seeing how applications use ports, or tracking down problems in system or application configurations.
Portmon works on NT 4.0, Win2K, XP and Server 2003, Windows 95 and Windows 98.
http://www.sysinternals.com/Utilities/Portmon.html


PsExec:
Utilities like Telnet and remote control programs like Symantec's PC Anywhere let you execute programs on remote systems, but they can be a pain to set up and require that you install client software on the remote systems that you wish to access. PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.
http://www.sysinternals.com/Utilities/PsExec.html
.




Relevant Pages

  • Re: CPU useage
    ... This is indicated in Windows Task Manager, ... A better tool for investigating CPU usage ... is Process Explorer. ... You can access Event Viewer by selecting Start, Control Panel, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: CPU useage
    ... This is indicated in Windows Task Manager, ... A better tool for investigating CPU usage ... Download Process Explorer. ... You can access Event Viewer by selecting Start, Control Panel, ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Loading windows xp...
    ... explanations of aplicattions, as process explorer have, as you mentioned. ... not to put server side on my laptop?Why? ... obviously it's a part of windows files. ... msconfig.exe or AutoRuns to find a startup entry for this. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Computer too slow
    ... It happened over night and the startup takes about 20 minutes (Even when I just turn on my computer and the Windows XP logo is shown with the progression bar running, ... When previously I went to the service center for the same problem, the engineer mentioned to me that this is caused by one of the registry entries corrupted and the coordination between the drives, cd drives and all other internal components are not running properly thats why things are so slow and he also mentioned that fixing it is pretty easy and that all we have to do is delete the registry entry and restart the computer and Windows XP will automatically reinstall the registry entry by itself and all would be fine - he did it and proved to me that it worked and well, it DID work. ... To find and display what could be the problem try Process Explorer: ... In the column on the left named 'CPU', look for any high CPU usage. ...
    (microsoft.public.windowsxp.perform_maintain)
  • Re: Remotely check login status
    ... There are a number of ways you can do this in Windows. ... Sysinternals' ... Psloggedon ... this tool can be run to query a remote system for current ...
    (Security-Basics)