Process Monitor

You will investigate which files, registry keys and processes a Windows program uses.

Developer Microsoft

Version 4.11 · Free to use · Windows

Looking for an alternative to Process Monitor?Compare Process Explorer, ESET SysInspector, ProcessKO.Compare alternatives

Process Monitor of Microsoft Sysinternals records system activity in detail. You will see file and registry access and events around processes and threads. With filters, you limit the overview to for example one program or an error message about a missing file.

The amount of events is rising rapidly. Start with a clear research question, start the recording briefly and then reproduce the problem. The log is a tool to understand behavior; a failed file request is not automatically a security problem.

Which software suits you?

Compare Process Monitor with alternatives

For problems on Windows, it makes a difference whether you want to see what's going on right now or capture events over time. A process list can be seen more quickly; a trace contains more detail but requires filters. Don't just force system processes to stop when you're doing research alone.

Differences between Process Monitor and Process Explorer, ESET SysInspector, ProcessKO
SoftwareWhat can it do?Platform and licence
Process MonitorYou are viewing this app You record file, registry and process events with filters. You choose this if you want to find out what concrete actions a program performs. WindowsFree to use
Process ExplorerView this alternative You will investigate processes, loaded parts and the relationship between processes in an extended task manager. This helps to find out which program uses a file or source. WindowsFreeware
ESET SysInspectorView this alternative You collect Windows system information about processes, drivers and connections for diagnosis. You thus evaluate an overview of the system state. WindowsFree to use
ProcessKOView this alternative You end selected processes with a small Windows tool. That is a targeted stop action and not an extensive process analysis. WindowsFree to use

Choose an alternative to explore its features, system requirements and download options.

Who is it for?

You want to investigate a recurring Windows problem and can interpret technical log rules.

Getting started

Download Process Monitor via Microsoft Sysinternals and start it with the necessary admin permissions. Set a filter immediately for the process to be examined.

Privacy

A log may contain usernames, file paths and other sensitive data. Check and limit the contents before sharing a recording with someone.

Good to know

The current release asks Windows 11 or newer, or Windows Server 2019 or newer.

Please note

Don't let a recording run unnecessarily long. Use filters and save only the events you need.

Advantages

  • Detailed file and registry activity Strong Filters Official Microsoft Sysinternals Tool

Things to consider

  • Technical log rules ask for interpretation A lot of data in a short time Doesn't automatically resolve problems

Download Process Monitor

The download page opens in a new tab.

Version history

4.11

You get Process Monitor 4.11 for current supported Windows systems.

The download page mentions version 4.11. There is no separate user-oriented change list included in this build; the current system requirements are Windows 11 and Windows Server 2019 or newer.
Report a new version

Is there a newer version of Process Monitor? Send the version number and a link to the official announcement. Our editors will check it. No login is required.

More from Microsoft

Autoruns 14.3

With Autoruns you can see which programs, services and extensions start automatically on your Windows PC.

View all software from Microsoft →

Our verdict

Process Monitor is valuable when a program gives an error without making it clear which file or setting is the cause. A short, filtered recording can then show where the process tries to read or write. That gives you clues that miss a regular error message.

The program is not a general cleaning tool. Use it with a specific question and do not just change registry keys because you see an error code. Many programs try multiple locations before they find the right one. Especially for targeted error investigations Process Monitor offers added value; for normal system maintenance it is unnecessarily technical.

Ratings

No ratings yet. Share your experience.

Log in to rate this software.

Comments

Share your experience. Comments appear after approval.

No comments yet.