Last Updated: March 8, 2004
CPUMon v2.0
Use this advanced tool to read the performance counters of Pentium, Pentium Pro and Pentium II processors. Not for the faint of heart, CPUMon is intended for those with a good familiarity of processor architecture. Version 2.0 is integrated with Perfmon.
Use this advanced tool to read the performance counters of Pentium, Pentium Pro and Pentium II processors. Not for the faint of heart, CPUMon is intended for those with a good familiarity of processor architecture. Version 2.0 is integrated with Perfmon.
DebugView v4.21
Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.
Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.
Diskmon v2.01
This utility captures all hard disk activity or acts like a software disk activity light in your system tray.
This utility captures all hard disk activity or acts like a software disk activity light in your system tray.
Filemon v6.07
This monitoring tool lets you see all file system activity in real-time. It works on all versions of WinNT/2K/XP, Windows 9x/Me, Windows XP 64-bit Edition, and Linux.
This monitoring tool lets you see all file system activity in real-time. It works on all versions of WinNT/2K/XP, Windows 9x/Me, Windows XP 64-bit Edition, and Linux.
Handle v2.20
This handy command-line utility will show you what files are open by which processes, and much more.
This handy command-line utility will show you what files are open by which processes, and much more.
ListDLLs v2.23
List all the DLLs that are currently loaded, including where they are loaded and their version numbers. Version 2.0 prints the full path names of loaded modules.
List all the DLLs that are currently loaded, including where they are loaded and their version numbers. Version 2.0 prints the full path names of loaded modules.
NTFSInfo v1.0
Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.
Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.
PMon v1.0
This is an NT Gui/device driver program that watches process and thread creation and deletion, as well as context swaps if running on a multiprocessing or checked kernel.
This is an NT Gui/device driver program that watches process and thread creation and deletion, as well as context swaps if running on a multiprocessing or checked kernel.
Portmon v3.02
Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.
Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.
Process Explorer v8.33
Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
PsTools v2.0
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
Regmon v6.06
This monitoring tool lets you see all Registry activity in real-time. It works on all versions of WinNT/2K, Windows 9x/Me and Windows 64-bit.
This monitoring tool lets you see all Registry activity in real-time. It works on all versions of WinNT/2K, Windows 9x/Me and Windows 64-bit.
TCPView v2.34
See all open TCP and UDP endpoints. On Windows NT, 2000 and XP TCPView even displays the name of the process that owns each endpoint. Full source to the command-line version of this tool, netstatp, is included.
See all open TCP and UDP endpoints. On Windows NT, 2000 and XP TCPView even displays the name of the process that owns each endpoint. Full source to the command-line version of this tool, netstatp, is included.
Tokenmon v1.01
Watch security-related activity, including logon, logoff, privilege usage, and impersonation with this monitoring tool. Full source code included.
Watch security-related activity, including logon, logoff, privilege usage, and impersonation with this monitoring tool. Full source code included.
Winobj v2.13
The ultimate Object Manager namespace viewer is here. Version 2.0 has significant UI enhancements, knows about more object types, and is integrated with NT's native security editors.
The ultimate Object Manager namespace viewer is here. Version 2.0 has significant UI enhancements, knows about more object types, and is integrated with NT's native security editors.
CacheSet v1.0
CacheSet is a program that allows you to control the Cache Manager's working set size using functions provided by NT. It's compatible with all versions of NT and full source code is provided.
CacheSet is a program that allows you to control the Cache Manager's working set size using functions provided by NT. It's compatible with all versions of NT and full source code is provided.
Contig v1.41
Wish you could quickly defragment your frequently used files? Use Contig to optimize individual files, or to create new files that are contiguous.
Wish you could quickly defragment your frequently used files? Use Contig to optimize individual files, or to create new files that are contiguous.
Frob v1.6a
NT doesn't allow access to internal performance settings like execution quanta, which have different values on Workstation and Server. Here's an applet that will let you "frob" the foreground and background quanta on a system for experimentation, or for your liking. This update works on NT 4.0 SP 6a.
NT doesn't allow access to internal performance settings like execution quanta, which have different values on Workstation and Server. Here's an applet that will let you "frob" the foreground and background quanta on a system for experimentation, or for your liking. This update works on NT 4.0 SP 6a.
AccessEnum v1.2
This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.
This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.
Autoruns v3.04
See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.
See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.
BgInfo v4.05
This fully-configurable program automatically generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.
This fully-configurable program automatically generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.
Ctrl2cap v2.0
This is a kernel-mode driver that demonstrates keyboard input filtering just above the keyboard class driver in order to turn caps-locks into control keys. Filtering at this level allows conversion and hiding of keys before NT even "sees" them. Full source is included. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue-screen.
This is a kernel-mode driver that demonstrates keyboard input filtering just above the keyboard class driver in order to turn caps-locks into control keys. Filtering at this level allows conversion and hiding of keys before NT even "sees" them. Full source is included. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue-screen.
Diskview v2.0
Use this graphical volume analyzer to determine what clusters are occupied by a particular file or to determine to which file a cluster is allocated.
FAT32 for Windows NT 4.0 v1.01Use this graphical volume analyzer to determine what clusters are occupied by a particular file or to determine to which file a cluster is allocated.
Another first from Sysinternals: a FAT32 file system driver for NT 4.0. Dual booting with Windows 95OSR2 and Windows98 just got more efficient!
Fundelete v2.02
This utility expands the NT 4.0 Recycle Bin to catch file deleted from command prompts and within programs, and it comes with full source code. Several powerful device driver techniques, including getting a user's SID within a driver, enumerating a directory's contents, and generating IRPs, are demonstrated in source code available for download.
This utility expands the NT 4.0 Recycle Bin to catch file deleted from command prompts and within programs, and it comes with full source code. Several powerful device driver techniques, including getting a user's SID within a driver, enumerating a directory's contents, and generating IRPs, are demonstrated in source code available for download.
LDMDump v1.02
Dump the contents of the Logical Disk Manager's on-disk database, which desribes the partitioning of Windows 2000 Dynamic disks.
Dump the contents of the Logical Disk Manager's on-disk database, which desribes the partitioning of Windows 2000 Dynamic disks.
NewSID v4.03
Learn about the computer SID problem everybody has been talking about and get a free computer SID changer, NewSID, complete with full source code.
Learn about the computer SID problem everybody has been talking about and get a free computer SID changer, NewSID, complete with full source code.
NTRecover v1.0
Finally, the utility that NT system administrators have been waiting for. With NTRecover you can access a dead x86 NT system's disks from a good system over a serial connection. You can then salvage data off of the drives using native NT commands and utilities. With the write-version you can even run chkdsk on the dead system's drives! The read-only version is freeware.
Finally, the utility that NT system administrators have been waiting for. With NTRecover you can access a dead x86 NT system's disks from a good system over a serial connection. You can then salvage data off of the drives using native NT commands and utilities. With the write-version you can even run chkdsk on the dead system's drives! The read-only version is freeware.
NTFSCHK v1.0
If you dual boot between NT 4 and Windows 2000 then your NTFS drives were upgraded to NTFS v5 and you have had to boot into Windows 2000 to check them. With NTFSCHK you can check your NTFS v5 drives from NT 4.
If you dual boot between NT 4 and Windows 2000 then your NTFS drives were upgraded to NTFS v5 and you have had to boot into Windows 2000 to check them. With NTFSCHK you can check your NTFS v5 drives from NT 4.
NTFSDOS Professional v4.01
Full read/write access to NTFS drives from DOS! Download this free read-only version.
Full read/write access to NTFS drives from DOS! Download this free read-only version.
NTFSFlp v1.0
Ever wondered why you can't put NTFS on a floppy disk? Find out how and why NT stops you from doing it, and use NTFSFlp to bypass NT's preventative measures and create and access NTFS floppy disks.
Ever wondered why you can't put NTFS on a floppy disk? Find out how and why NT stops you from doing it, and use NTFSFlp to bypass NT's preventative measures and create and access NTFS floppy disks.
NTFS for Windows 98 v2.0 Ready-Only
Yet another first from Sysinternals: a full-blown NTFS file system driver for Windows 95/98!
Yet another first from Sysinternals: a full-blown NTFS file system driver for Windows 95/98!
PsTools v2.0
The PsTools suite includes utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
The PsTools suite includes utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
Remote Recover v2.0
Access unbootable systems from across a LAN or WAN. With Remote Recover you can access a dead x86 NT system's disks from a good system over a TCP/IP connection. You can then salvage data off of the drives using native NT commands and utilities. With the write-version you can even chkdsk, format or partition the dead system's drives! The read-only version is freeware.
Access unbootable systems from across a LAN or WAN. With Remote Recover you can access a dead x86 NT system's disks from a good system over a TCP/IP connection. You can then salvage data off of the drives using native NT commands and utilities. With the write-version you can even chkdsk, format or partition the dead system's drives! The read-only version is freeware.
SDelete v1.2
Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program. Complete source code is included.
Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program. Complete source code is included.
ShareEnum v1.51
Scan file shares on your network and view their security settings to close security holes.
Scan file shares on your network and view their security settings to close security holes.
Sync v2.1
Force NT to flush all modified file system data to disk, insuring that it will be safe in the face of a crash.
Force NT to flush all modified file system data to disk, insuring that it will be safe in the face of a crash.
VolumeID v2.0
Set volume ids on FAT and NTFS hard drives and floppy disks using this little utility.
Set volume ids on FAT and NTFS hard drives and floppy disks using this little utility.
Bluescreen v3.0
This screen saver not only accurately simulates Blue Screens, but simulated reboots as well (complete with CHKDSK), and works on Windows NT 4, Windows 2000, Windows XP, and Windows 9x.
This screen saver not only accurately simulates Blue Screens, but simulated reboots as well (complete with CHKDSK), and works on Windows NT 4, Windows 2000, Windows XP, and Windows 9x.
Miscellaneous
An ever-growing collection of small utilities, many with complete source code: AdRestore, Junction, DiskExt, EFSDump, Streams, UpTime, VolumeId, Sync, AutoLogon, HostName, Strings.
An ever-growing collection of small utilities, many with complete source code: AdRestore, Junction, DiskExt, EFSDump, Streams, UpTime, VolumeId, Sync, AutoLogon, HostName, Strings.
PsTools v2.0
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.