The 2026 Sysinternals Toolkit for Windows Troubleshooting
Autoruns, Process Explorer and RAMMap remain the evidence-first alternative to anonymous optimizer suites.
Three tools, three questions
Autoruns answers “what is configured to launch?” across logon entries, services, scheduled tasks, shell extensions, drivers and more. Process Explorer answers “what is running and what did it open?” with process trees, handles, DLLs and signatures. RAMMap answers “how is physical memory actually allocated?”
Microsoft continues to publish and update the Sysinternals suite. The official download pages and Sysinternals Live are the correct sources; repackaged downloads are unnecessary.
A practical workflow
- Start with Task Manager and reproduce the issue.
- Use Process Explorer to inspect the process tree, verified signer, command line, handles or loaded modules.
- Use Autoruns with Microsoft entries hidden to find the parent product’s persistence, unchecking before deletion.
- Use RAMMap only when the memory composition—not merely a high percentage—needs explanation.
- Update, reconfigure or uninstall the responsible product through its supported path.
Primary sources & further reading
Source pages can change after this guide’s verification date. Check release notes before a high-risk change.
Take the safe path in order.
Your checklist saves progress in this browser—no account required.