Sysinternals tools: A must-have for every Windows security toolbox

Originally a standalone toolset, written and hosted by Mark Russinovich and Bryce Cogswell, Sysinternals was acquired by Microsoft nearly three years ago. I shuddered at the thought of the acquisition. I even hurried to do a quick download of the tools in case they were suddenly unavailable. Fortunately, Microsoft has mostly left things alone, and in many cases, they have made them better.

Protect your Windows environment, check out the Windows security tools roundup special report.

The Sysinternals tools are broken down into four major categories: File and disk, networking, security and miscellaneous. There's hardly anything you can't do with these programs to manage, hack or otherwise probe a Windows-based PC. Having worked on assembly language programming early in my career to control PCs in every way imaginable, I have an innate need to delve into the system innards of Windows quite often. These tools allow the user to do things that Microsoft doesn't build into the operating system by default, and you can't really get their functionality anywhere else.

A note of warning: With the power Sysinternals tools bring to the table, they're not for everyone. In fact, used incorrectly, these tools can really jam up a system -- so proceed with confidence and caution.

The specific Sysinternals tools that have helped me over the years are:

• AccessChk and AccessEnum: Used to enumerate Windows user rights and privileges
• Process Explorer (the most popular of them all): Used for probing Windows processes and killing hung ones that Windows Task Manager can't seem to handle
• Process Monitor: For monitoring real-time file, registry, etc. activity
• PsTools: To control remote Windows systems
• RootkitRevealer: For finding Windows-based rootkits
• ShareEnum: For enumerating Windows shares on the network
• TCPView: To determine what's using specific TCP connections

And here are a couple of other gadgety-type tools that may help you:

• DiskMon: A hard disk activity light which comes in handy for troubleshooting things on computers that don't have one
• ZoomIt: For zooming in and marking up presentations

Don't want to mess with downloading and unzipping the entire Sysinternals suite to your system? Visit live.sysinternals.com where you can download individual tools quickly and easily. I especially like the Sysinternals Utilities Index that describes the purpose of each tool (which I sometimes forget) as well as provides a link to the download and usage page for each tool.

If you take Windows administration and security seriously, you must familiarize yourself with the Sysinternals tools. I'm still amazed at how many IT professionals haven't heard of or use them in their daily work. So go ahead, download these tools and explore what they have to offer. Once you see what they can do for your day-to-day management and troubleshooting duties in Windows, you'll realize you can't function without them.

ABOUT THE AUTHOR:

Kevin Beaver Kevin Beaver is an information security consultant, keynote speaker, and expert witness with Atlanta-based Principle Logic, LLC. Kevin specializes in performing independent security assessments. Kevin has authored/co-authored seven books on information security including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley). He's also the creator of the Security On Wheels information security audio books and blog providing security learning for IT professionals on the go. Kevin can be reached at kbeaver /at/ principlelogic.com.

Rate this Tip To rate tips, you must be a member of SearchEnterpriseDesktop.com. Register now to start rating these tips. Log in if you are already a member. Digg This!     StumbleUpon     Del.icio.us    RELATED CONTENT Windows desktop security tips 20 days to a more secure enterprise Improvements to offline file synchronization in Windows 7 How to get -- and keep -- user support with security Structuring patch management in seven steps Underlying causes of inconsistent patch management Monitoring user activity with network analyzers Microsoft's Patch Tuesday brings a bumper crop of security fixes Using third-party technologies with Microsoft's NAP Understanding Microsoft's NAP's internal and external components Microsoft's NAP can ensure security compliance Endpoint security management tools 20 days to a more secure enterprise How to get -- and keep -- user support with security MDOP for Windows 7 available now Microsoft's Online Desktop Manager caters to small IT shops Monitoring user activity with network analyzers Using third-party technologies with Microsoft's NAP Understanding Microsoft's NAP's internal and external components Microsoft's NAP can ensure security compliance Top 5 registry keys for Windows XP Microsoft releases WSUS 3 SP2 with Win 7, R2 support RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary system tray  (SearchEnterpriseDesktop.com) RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.