SysInternals Archives

Winsage

May 7, 2026

Windows 11 still runs on code from the 1990s, Microsoft admits

Windows 11 relies on the Win32 API, a legacy system dating back to Windows 95, for core functionalities like right-clicking and launching applications. Microsoft’s Chief Technology Officer, Mark Russinovich, noted that the continued relevance of Win32 was unexpected, as few anticipated it would still be a primary interface in 2026. Despite attempts to modernize the Windows API with initiatives like WinRT, Win32 remains integral to many Windows operations. The separation between Win32 applications and web technologies has complicated the transition to a new API framework. Additionally, tools from Microsoft's past, such as Sysinternals, Sysmon, and ZoomIt, continue to play important roles in Windows management.

Winsage

May 7, 2026

Microsoft admits Windows 11 is still built on 90s-era Win32, and no one saw it coming

Users engage with the Win32 API when right-clicking files or launching desktop applications in Windows 11, a technology that has persisted since Windows 95. Microsoft’s Chief Technology Officer, Mark Russinovich, noted that the longevity of Win32 was unexpected, as it was not part of the company's original vision for the future. Despite attempts to replace Win32 over the past two decades, many users still have more Win32 applications than modern alternatives. Microsoft has introduced several frameworks to replace Win32, including MFC, WinForms, WPF, WinRT, and UWP, but none have fully succeeded. Developers have shown a preference for RAM-intensive web applications over native ones due to concerns about the stability of Microsoft's frameworks. Microsoft has introduced WebView2 to embed web technologies in desktop applications, leading to increased memory usage. In response to user needs, Microsoft is shifting back to native applications with WinUI 3, aiming to modernize Windows 11 while retaining access to Win32 infrastructure. The company is gradually replacing legacy Win32 UI elements with WinUI 3 components, improving performance and user experience.

Winsage

April 3, 2026

Windows 11 buries its best features for power-users deep behind the worst menus

Windows 11 features a modern interface but retains complex elements that challenge users. It combines the Settings app with the Control Panel, leading to navigation difficulties. The taskbar's right-click context menu has become more cumbersome, requiring additional clicks for essential options. Storage settings are modern but require access to legacy tools like Disk Management, which is less accessible. Sound settings are also split across different interfaces, complicating access to advanced configurations. Sysinternals, a suite of powerful utilities, is largely unknown to users. PowerToys and the "God Mode" folder offer valuable features but are not readily available and require manual activation. Overall, while Windows 11 is powerful, essential tools are often buried under outdated interfaces and inconsistent navigation.

Winsage

March 6, 2026

Windows 11’s March 2026 update is packing 9 new upgrades you’ll actually notice

On March 10, 2026, Microsoft will release a Patch Tuesday update for Windows 11, introducing several new features and enhancements. Key updates include a network speed test feature accessible from the Taskbar, updated camera controls for pan and tilt settings, a new settings page for Widgets, support for WebP images as wallpapers, Quick Machine Recovery for Windows 11 Pro, refreshed dialogs in the Settings app, and changes in File Explorer allowing "Extract All" for non-ZIP archives. Additional updates include the introduction of Emoji version 16, a magnifier icon in Task Manager for the Windows Search process, and expanded RSAT support for ARM64 devices. Users are advised to be cautious during installation due to potential errors.

Winsage

February 25, 2026

Microsoft Releases February Optional Updates for Windows 11

Microsoft has released optional February updates for Windows 11 versions 25H2 and 24H2, which include several enhancements: - A network speed test tool accessible from the taskbar for measuring Ethernet, Wi-Fi, and cellular connections. - Enhanced camera settings with new pan and tilt options for supported cameras. - A built-in version of the System Monitor (Sysmon) tool, available as an optional feature. - Improvements to Remote Server Administration Tools (RSAT) for Windows 11 Arm64 devices. - A new automatic recovery tool for Windows 11 Professional devices not domain-joined. - Support for .webp images as desktop backgrounds. - Introduction of new emojis in the Emoji 16.0 release. - BitLocker improvements to prevent devices from becoming unresponsive after entering a recovery key. Additionally, Microsoft has shared release notes for an upcoming optional update for Windows 11 version 26H1, which is currently only available to Insiders on the Canary Channel and is expected to debut on new devices with advanced silicon.

Winsage

February 17, 2026

I’m stuck with Windows for gaming in 2026, but here’s how I’m optimizing it

In early 2026, Windows 11 posed challenges for users, leading to multiple reinstallations. To optimize gaming performance, users can create a restore point, activate Game Mode, adjust power settings to High Performance or Ultimate Performance, enable "Optimizations for windowed games," and activate Hardware-accelerated GPU scheduling. Managing startup apps through Windows Settings or Task Manager, disabling the Virtual Machine Platform and Hyper-V, and using the Win11Debloat PowerShell script can improve system performance. Adjustments in the NVIDIA Control Panel, such as setting the Shader Cache Size to 10 GB and Power management mode to "Prefer maximum performance," enhance gaming experience. Registry edits like changing Scheduling Category to High and modifying NetworkThrottlingIndex can further optimize performance.

Winsage

November 19, 2025

Microsoft Integrates System Monitor (Sysmon) into Windows 11

Microsoft will integrate its forensic tool, System Monitor (Sysmon), into the Windows kernel with the upcoming releases of Windows 11 and Server 2025. This integration will transform Sysmon from a standalone utility into a native “Optional Feature” that will be serviced automatically through Windows Update. Administrators will no longer need to manually distribute Sysmon; instead, it can be activated through the “Turn Windows features on or off” dialog or command-line instructions. The integration will ensure that updates flow through the standard Windows Update pipeline, providing official support and Service Level Agreements (SLAs) for Sysmon. Microsoft plans to utilize local computing capabilities for AI inferencing to enhance security measures, focusing on detecting credential theft and lateral movement patterns. Sysmon will maintain backward compatibility with existing workflows, allowing the use of custom configuration files and adhering to the XML schema while continuing to log events to the Windows event log. Community-driven configuration repositories will remain operational, preserving established community knowledge.

Winsage

November 18, 2025

Microsoft is bringing native Sysmon support to Windows 11, Server 2025

Microsoft is integrating Sysmon into Windows 11 and Windows Server 2025, eliminating the need for separate deployments of Sysinternals tools. This integration will allow users to utilize custom configuration files for filtering captured events, which will be logged in the Windows event log. Sysmon is a free tool that monitors and blocks suspicious activities while logging events such as process creation, DNS queries, and executable file creation. It will be easily installable via the "Optional features" settings in Windows 11, with updates delivered through Windows Update. Sysmon will retain its standard features, including support for custom configuration files and advanced event filtering. Key events logged by Sysmon include process creation, network connections, process access, file creation, process tampering, and WMI events. Comprehensive documentation and new enterprise management features will be released next year.

Winsage

November 18, 2025

Microsoft to integrate Sysmon directly into Windows 11, Server 2025

Microsoft will integrate Sysmon into Windows 11 and Windows Server 2025, eliminating the need for standalone deployment. Sysmon will allow users to utilize custom configuration files for event filtering, logging events in the Windows event log. It tracks events such as process creation, DNS queries, executable file creation, changes to the clipboard, and auto-backup of deleted files. Users can access Sysmon through "Optional features" in Windows 11 and receive updates via Windows Update. Key events logged by Sysmon include process creation, network connections, process access, file creation, process tampering, and WMI events. Comprehensive documentation and new enterprise management features will be released next year.

Winsage

November 18, 2025

Microsoft Finally Makes Sysmon Native To Windows

Sysmon is a system monitoring tool that traditionally requires users to download and install it from Microsoft's Sysinternals page, often leading to its deployment only after issues arise. Pre-installing Sysmon can enhance proactive monitoring and issue diagnosis. Its effectiveness can be improved through tailored configurations, with resources available from Bleeping Computer for specific use cases like monitoring DNS queries. Additionally, Sysmon can now be installed on Linux systems via the Windows Subsystem for Linux (WSL), increasing its accessibility and versatility for users familiar with Sysmon.