Wingetlywingetly
← All apps

Process Monitor

by Sysinternalsv4.11

Last updated

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

Visit homepage

Install with winget

$ winget install --id Microsoft.Sysinternals.ProcessMonitor --exact --version 4.11

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

About

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

Process Monitor includes powerful monitoring and filtering capabilities, including:

- More data captured for operation input and output parameters

- Non-destructive filters allow you to set filters without losing data

- Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation

- Reliable capture of process details, including image path, command line, user and session ID

- Configurable and moveable columns for any event property

- Filters can be set for any data field, including fields not configured as columns

- Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data

- Process tree tool shows relationship of all processes referenced in a trace

- Native log format preserves all data for loading in a different Process Monitor instance

- Process tooltip for easy viewing of process image information

- Detail tooltip allows convenient access to formatted data that doesn't fit in the column

- Cancellable search

- Boot time logging of all operations

Installers · v4.11

ArchitectureTypeScopeInstallDownload
x86ZIP
archive
-Direct
x64ZIP
archive
-Direct
arm64ZIP
archive
-Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

1 known CVE via NVD

Source: NVD, updated 1h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr.

Related apps

  • SDeleteSysinternals
    Microsoft.Sysinternals.SDeletev2.06

    Securely overwrite sensitive files and cleanse free space.

  • HandleSysinternals
    Microsoft.Sysinternals.Handlev5.0

    Handle is a utility that displays information about open handles for any process in the system.

  • Sysinternals SuiteSysinternals
    Microsoft.Sysinternals.Suitev2026-07-09

    Sysinternals Suite is a bundle of the Sysinternals utilities including Process Explorer, Process Monitor, Sysmon, Autoruns, ProcDump, all of the PsTools, and many more.

  • SysmonSysinternals
    Microsoft.Sysinternals.Sysmonv15.22

    System activity monitor

  • StringsSysinternals
    Microsoft.Sysinternals.Stringsv2.54

    Strings scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters.

  • Remote Desktop Connection ManagerSysinternals
    Microsoft.Sysinternals.RDCManv3.12

    RDCMan manages multiple remote desktop connections. It is useful for managing server labs where you need regular access to each machine such as automated checkin systems and data centers.

More from Sysinternals or browse file-system, filemon, process.

Frequently asked questions

How do I install Process Monitor on Windows?
Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id Microsoft.Sysinternals.ProcessMonitor --exact --version 4.11. winget downloads the installer from Sysinternals and runs it. Requires Windows 10 (1809+) or Windows 11.
How do I install Process Monitor silently for unattended deployment?
Add --silent and accept the agreements upfront: winget install --id Microsoft.Sysinternals.ProcessMonitor --exact 4.11 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.
How do I uninstall Process Monitor via winget?
Run: winget uninstall --id Microsoft.Sysinternals.ProcessMonitor --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from Process Monitor's Apps & Features entry.
Is Process Monitor free?
Process Monitor is distributed under Proprietary. Refer to the publisher (https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) for the full license terms - Wingetly itself does not charge for installation.
Does Process Monitor work on Windows 10?
Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls Process Monitor directly from the publisher.
How do I keep Process Monitor up to date?
Run winget upgrade --id Microsoft.Sysinternals.ProcessMonitor --exact, or winget upgrade --all to update everything winget tracks. We index 1 version of Process Monitor from microsoft/winget-pkgs.