166 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
2
votes
0
answers
80
views
Sysinternals-Sysmon Configuration File (RuleGroup, Rules) [closed]
AIM:
Log a file creation event if Notepad creates a file in location whose directory path contains either Downloads or Documents
After going through the Sysmon's documentation, what I was able to ...
4
votes
0
answers
128
views
Sysinternals Process Monitor: capturing file system events on a Windows Dev Drive (ReFS)
It seems that Sysinternals Process Monitor (version 4.01) does not capture any file system access events (like QueryOpen) on Windows Dev Drives (or more generally on ReFS drives?) by default. Is there ...
0
votes
1
answer
215
views
Can't find a filter of a program in Procmon
I was given a task to put 2 filters in Procmon. 1) Process name is "test.exe" (a WinAPI createFile, readFile, closeHandle project written in Visual Studio in C) 2)Operation is read file. ...
0
votes
1
answer
49
views
Execute multiple commands in remote machines at once
My execution on multiple remote computers as follows.
Kill Java process
Copy files to specific location
Run application specific batch
Below script works as expected. How can I run it in parallel. ...
1
vote
1
answer
214
views
Powershell generating output in the error stream instead of output stream
I have a C# application that creates a remote runspace, creates a powershell instance inside the runspace and executes a perl script using
ps.AddScript($"perl.exe {perlScriptPath} {perlScriptArgs}...
0
votes
1
answer
354
views
Why can't I run accesschk using a PowerShell remote session to check system permissions?
I'm trying to get the system security permission for a specific user on a remote system using SysInternals AccessChk.
If I login to a computer as adminstrator, copy SysInternals tools to my ...
0
votes
0
answers
313
views
What does Windows IOCTL code 0x83350048 do?
I can find:
#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
in winioctl.h. ...
1
vote
0
answers
103
views
What does the "QueryDeviceInformationVolume" operation in Process Monitor mean?
Seeing an operation called "QueryDeviceInformationVolume" in a SysInternals Process Monitor log when I start a desktop application. Simply trying to get some details about this operation and ...
1
vote
0
answers
144
views
Cancel movefile operation
I tried to schedule a movefile (using the sysinternals tool movefile) operation to delete "C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup" but I forgot the quotes and ...
1
vote
0
answers
753
views
Shrink Disk and NTFS MetaFile Defragmentation ($BITMAP)
Shrink Disk and Defragmentation
I'm trying to shrink a disk. The volume is about 1 To large, and only 200 Go are curretly used.
It is a virtual disk.
When i ask to the disk management tool to shrink ...
3
votes
1
answer
307
views
How does pskill work across the UAC/elevation boundary?
Disclaimer: I'm asking specifically on Stackoverflow because I want to know how to re-implement this feature.
We recently noticed that the Sysinternals tool pskill can kill an elevated process from a ...
0
votes
1
answer
1k
views
How to view a device driver stack?
There is a picture on the Microsoft site which represent a USB device driver stack (in other word, the list of all drivers which applys for the device work).
What software shall I use to get this ...
0
votes
1
answer
361
views
Why does Systinternals du64.exe unexpectedly output in UTF-16LE with a BOM (noticed it parsing output in perl)?
On a fresh install of Windows 11, running Strawberry perl, I'm debugging a script that parses the output of du64 (disk usage). It worked on Win 10 with ActiveState perl.
To debug, I first checked du, ...
0
votes
0
answers
288
views
Active-Passive IIS Infrastructure
We are trying to create an IIS infrastructure. Because of the application's infrastructures (they are many types of applications from old school to SPA) we thought that Active-Passive infrastructure ...
0
votes
2
answers
190
views
Process stdout capture for Autoruns
Hey guys I am working on a project currently where I am trying to run Autorunsc64.exe from the sysinternals suite and, unlike other executables I have tried, I can't get it to give me the output in a ...