260 likes | 365 Views
INDIA │ 18-20 august 2010. v irtual techdays. Windows Sysinternals Primer: Process Explorer, Process Monitor & More Tools. Aviraj Ajgekar │ Regional Site Manager │ Microsoft Corporation http://blogs.technet.com/aviraj │ Email i-aviraj@microsoft.com. INDIA │ 18-20 august 2010.
E N D
INDIA │ 18-20 august2010 virtual techdays Windows Sysinternals Primer: Process Explorer, Process Monitor & More Tools Aviraj Ajgekar │ Regional Site Manager │ Microsoft Corporation http://blogs.technet.com/aviraj│ Email i-aviraj@microsoft.com
INDIA │ 18-20 august2010 virtual techdays • Introduction to Sysinternals • Process Explorer • Process Monitor • PsExec • Additional Sysinternals Utilities - Demo S E S S I O N A G E N D A
INDIA │ 18-20 august2010 virtual techdays • High quality, advanced diagnostic and troubleshooting tools • Single executable package, no install needed • Free! • Authored by Mark Russinovich and/or Bryce Cogswell • Quick turnaround/update cycle • Limited support Introduction To Sysinternals
INDIA │ 18-20 august2010 virtual techdays • http://www.Sysinternals.com • Redirects to technet.microsoft.com • Sysinternals Suite contains all the tools in one zip file • Site blog announces all updates • http://blogs.technet.com/Sysinternals • Run directly from the web: Sysinternals Live • http://live.sysinternals.com/procmon.exe, or • \\live.sysinternals.com\tools\procmon.exe • UNC syntax requires WebClient service • Videos on troubleshooting with the tools Sysinternals Website Features
Ever See This? INDIA │ 18-20 august2010 virtual techdays Or this? • Cause: Security Zone info attached to file
INDIA │ 18-20 august2010 virtual techdays Tip: Unblock before extracting (Remote Zone Information)
INDIA │ 18-20 august2010 virtual techdays • What is a process? • Task Manager – The Good, The Bad, The Ugly • Demo’s Processor Explorer
What is a Process? • A process is a container for a set of resources, including one or more threads. • Threads – not processes – do the work and consume CPU, memory, etc • Every process has at least one thread Virtual Memory Address space One or More threads Security Tokens Open handles
INDIA │ 18-20 august2010 virtual techdays • The good • Great for users of limited technical knowledge. • High level flat list of processes, services, users and system performance. • The bad • Doesn’t show path to executable. • Doesn’t show fractional CPU. • The ugly • Doesn’t show multi purpose processes. • Example: svchost.exe • Doesn’t show what might be causing a process to misbehave. • Doesn’t distinguish the different types of processes. • Doesn’t show threads Task Manager The good, the bad, the ugly
INDIA │ 18-20 august2010 virtual techdays • The Good • Parent/Child Relationships • “Peer” into processes • The Better • Options galore • Process Highlighting • The Best • Customized Columns • Threads • CPU, Context Switch Delta, Cycles Delta • Determine which thread is consuming CPU Process Explorer The good, the better, the best
INDIA │ 18-20 august2010 virtual techdays DEMO: Process Explorer Aviraj Ajgekar│ Microsoft Corporation
INDIA │ 18-20 august2010 virtual techdays • Process Explorer shows a moving snapshot • Process Monitor is a logging utility • Captures detailed info about: • All registry activity • All file system activity • Process and thread events, including DLL load • Network activity • Periodic process profiling data Process Monitor
INDIA │ 18-20 august2010 virtual techdays • Save results for viewing elsewhere • Can log boot activity • Advanced filtering capabilities • Filters can be saved and exported • Analysis tools for data mining • Command-line scriptable • Highly scalable Process Monitor Features
INDIA │ 18-20 august2010 virtual techdays DEMO: Process Monitor Aviraj Ajgekar│ Microsoft Corporation
INDIA │ 18-20 august2010 virtual techdays • Execute processes on remote computers • Redirected console I/O Remote-enable console apps • Execute processes as System PsExec
PsExec Syntax • psexec [Computers] [Options] command [arguments] • Computers = • \\computer[,computer2[,...]] or • \\* or • @file • Alternate credentials (optional): • -u username [-p password]
PsExec Alternate Credentials[-uusername [-ppassword]] • Can omit -p: it prompts you, doesn’t echo • Used twice: • To authenticate to the remote computer • To create a new logon on the remote computer • #2 puts the credentials on the wire in the clear • Required for remote access when: • Current account is not admin on the remote, or • Remote process needs to access network, or • Remote process needs to run interactive
INDIA │ 18-20 august2010 virtual techdays DEMO: PsExec Aviraj Ajgekar│ Microsoft Corporation
PsExec Tips • Don’t forget /accepteula • RemotedSysinternals utilities will hang • Things you can’t do in a redirected console: • CLS • MORE • Text coloring • Tab completion • PowerShell v1
Run Procmon Past LogoffNon-interactively, with PsExec -s Must specify a backing file Must not have user interaction Procmon must exit cleanly To start: PsExec -s -d Procmon.exe /AcceptEula /Quiet /BackingFile C:\Procmon.pml To stop: PsExec -s -d Procmon.exe /AcceptEula /Terminate
INDIA │ 18-20 august2010 virtual techdays DEMO: Sysinternals Utilities such as Disk2VHD & More Aviraj Ajgekar│ Microsoft Corporation
Additional Resources • Mark Russinovich’s blog: • http://blogs.technet.com/b/MarkRussinovich • Blog posts and utilities by Aaron Margosis • http://blogs.msdn.com/b/aaron_margosis • http://blogs.technet.com/b/fdcc • Aviraj Ajgekar’s Blog • http://blogs.technet.com/b/aviraj
THANKS│18-20 august2010 virtual techdays Email i-aviraj@microsoft.com│Blog:http://blogs.technet.com/aviraj Thank You