System monitoring with Sysinternals

Health Check

Article from ADMIN 01/2010

By Thomas Joos

Administrators don't need a massive arsenal of tools just to monitor a couple of systems. With Microsoft's free Sysinternals suite, admins can handle all sorts of tasks.

The Sysinternal tools are free tools from Microsoft that can help Windows administrators handle many tasks. This article introduces the Sysinternal tools that are useful for system monitoring. All of the tools described here can be downloaded free of charge from the Microsoft site [1], either as individual downloads or as part of the Sysinternals suite.

One advantage of the Sysinternals utilities is that you don't need to install them, so they can be launched conveniently from a USB stick. When launched for the first time, the programs display a license dialog; you can suppress this dialog with the /accepteula option, which can be useful in scripting. Unfortunately, this option does not work for all of the Sysinternal tools.

The programs only run on a Windows system as of Windows 2000 Server. For this article, I used Windows Server 2008 R2 and Windows 7. Windows Server 2008 R2, Windows Server 2008, Windows Vista, and Windows 7 do not support access to the hidden System $ shares such as C$, or admin$ as easily as Windows XP or Windows Server 2003; the computers do not belong to a Windows domain because the new operating systems block access to administrative shares by authentication of local user accounts.

Some Sysinternal tools, such as PSInfo.exe, require access to the admin share and thus will not work at first. To allow access, you must enable local logins to administrative shares in the Registry of standalone computers. To do so, launch the Registry Editor by typing regedit, then navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Create a new Dword entry with the label LocalAccountTokenFilterPolicy, set the value to 1, then restart the computer.

...

Use Express-Checkout link below to read the full article (PDF).