"Given how many more 64-bit Windows installations are springing up, it would be a shame to have that be a barrier to using this program," said Serdar Yegulalp, a Windows expert and publisher of the Windows Insight newsletter.
Microsoft added destructive filtering, which allows users to apply different filters to designated data without affecting the excluded data. Also included in the latest version is a feature that lets users better see how each process is running during an activity trace by showing a graph for each one.
"You can think of this as a 'sniffer' for the internal operations of Windows, especially with the new filtering and logging capabilities," said Kevin Beaver, a consultant at Principle Logic LLC in Acworth, Ga. "Just like a sniffer on the network, it's amazing what you can find with it – the good, the bad, the ugly."
In April, Microsoft added features to its Process Monitor that helped users better diagnose lagging boot times and gave them the ability to cancel searches the tool is conducting.
The tool was initially released last fall and combines the two existing Sysinternals tools FileMon and RegMon, along with other features. Filemon monitors and shows system activity as it happens. RegMon monitors and shows specific applications that access the registry. Process Monitor includes these features but was completely rewritten from the ground up, the company said.
Microsoft acquired the tools when it bought Winternals Software LP, based in Austin, Texas, about a year ago. The acquisition included the Winternals Web site, called Sysinternals, which is now part of Microsoft's Web site. Microsoft has continued to make Sysinternals free tools available as it promised at the time of the acquisition.