SysInternals Archives

Winsage

July 25, 2026

It’s impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free

Many utility suites for Windows maintenance require a yearly subscription but often only aggregate basic tools. Users can achieve similar results without costs, as Windows manages routine maintenance effectively. Microsoft's Sysinternals suite offers advanced tools like Autoruns, which provides a comprehensive view of startup entries, and Process Explorer, which offers detailed process monitoring. SDelete securely deletes files beyond recovery, while RAMMap provides insights into memory usage without the risks of third-party applications. Although Sysinternals tools may lack polished interfaces, they deliver substantial functionality for users willing to learn how to use them.

Winsage

July 25, 2026

It’s impossible to recommend paid Windows cleanup utilities when Windows Sysinternals does everything for free

Windows utility suites often charge a yearly subscription fee but frequently provide only basic functionalities like startup managers and process monitors. Many features can be accessed for free through Windows' built-in capabilities. Microsoft's Sysinternals suite offers powerful alternatives, such as Autoruns, which provides a comprehensive view of all startup locations, including registry keys and scheduled tasks. Process Explorer offers detailed insights into running processes, surpassing the standard Task Manager by displaying process trees and resource usage. SDelete securely deletes files by overwriting data multiple times, making recovery nearly impossible. While Sysinternals tools are powerful, they require a learning curve and deeper engagement compared to the polished interfaces of paid utilities. Sysinternals emphasizes functionality over marketing, proving that free tools can deliver exceptional performance without compromising quality.

Winsage

June 30, 2026

Microsoft reveals why Windows 11 keeps saying a file is in use after you close the app, plus the fix

The 'file in use' error in Windows indicates that a file is currently being accessed by a program, preventing deletion or renaming to avoid data corruption. This error can persist even after closing an application due to reasons such as antivirus software scanning the file, network references from other devices, or files loaded as Dynamic Link Libraries (DLLs) that remain in memory. To identify the process causing the error, Mark Russinovich developed the command-line tool Handle, which shows all open file handles, and Process Explorer, which provides a graphical interface to find and manage these handles. Microsoft is integrating Sysinternals tools into PowerToys for easier access, including the File Locksmith tool that allows users to unlock files directly. A recommended workaround for the error is to rename the file instead of deleting it, as Windows permits renaming even when a file is open.

Winsage

June 8, 2026

Meet the hidden Windows 11 tool that reveals what Task Manager misses

Microsoft has integrated Sysmon into Windows 11 through a system update, allowing it to operate in the background and log activities in the Windows Event Log. Indicators of suspicious processes include the absence of icons or descriptions, incorrect parent processes, spelling errors in names, unsigned executable files, packed executables, suspicious DLLs or services, open TCP/IP endpoints, and unusual URLs or character strings. To install Sysmon, users must access the Control Panel, enable Sysmon, and restart their PC. Activation requires running a command in the Command Prompt. Sysmon logs can be viewed in the Event Viewer under Microsoft > Windows > Sysmon > Operational. Users can filter events using an XML configuration file. After analysis, suspicious processes should be scanned with antivirus software, and files can be uploaded to VirusTotal for further examination. Sysmon continuously logs events, while Process Monitor captures snapshots of running processes, and both tools are available for free from Microsoft.

Winsage

May 25, 2026

How I Changed the SID on My Windows Server Without Reinstalling (And Why You Should Care)

Cloning a Windows Server machine can lead to issues with duplicate Security Identifiers (SIDs). A Security Identifier (SID) is a unique string assigned to every machine, user, and group in Windows, functioning like a fingerprint. Duplicate SIDs can cause problems such as domain join failures, incorrect WSUS reporting, inconsistent Group Policy application, and licensing issues. The author initially attempted to use sysprep to change the SID after cloning, which resulted in stripping the domain join and causing SQL Server to fail. The author then discovered Wittytool Disk Clone, which includes a SID changer that successfully generated a new SID and updated all necessary references without disrupting the server's configuration or applications. The process took only six minutes and worked similarly on Windows Server 2019. It is more efficient to generate a new SID during the cloning process rather than afterward. Important precautions include taking a snapshot or backup before making changes and being aware that changing the SID on domain controllers is more complex. Reactivation of Windows may also be required after the SID change.

Winsage

May 7, 2026

Windows 11 still runs on code from the 1990s, Microsoft admits

Windows 11 relies on the Win32 API, a legacy system dating back to Windows 95, for core functionalities like right-clicking and launching applications. Microsoft’s Chief Technology Officer, Mark Russinovich, noted that the continued relevance of Win32 was unexpected, as few anticipated it would still be a primary interface in 2026. Despite attempts to modernize the Windows API with initiatives like WinRT, Win32 remains integral to many Windows operations. The separation between Win32 applications and web technologies has complicated the transition to a new API framework. Additionally, tools from Microsoft's past, such as Sysinternals, Sysmon, and ZoomIt, continue to play important roles in Windows management.

Winsage

May 7, 2026

Microsoft admits Windows 11 is still built on 90s-era Win32, and no one saw it coming

Users engage with the Win32 API when right-clicking files or launching desktop applications in Windows 11, a technology that has persisted since Windows 95. Microsoft’s Chief Technology Officer, Mark Russinovich, noted that the longevity of Win32 was unexpected, as it was not part of the company's original vision for the future. Despite attempts to replace Win32 over the past two decades, many users still have more Win32 applications than modern alternatives. Microsoft has introduced several frameworks to replace Win32, including MFC, WinForms, WPF, WinRT, and UWP, but none have fully succeeded. Developers have shown a preference for RAM-intensive web applications over native ones due to concerns about the stability of Microsoft's frameworks. Microsoft has introduced WebView2 to embed web technologies in desktop applications, leading to increased memory usage. In response to user needs, Microsoft is shifting back to native applications with WinUI 3, aiming to modernize Windows 11 while retaining access to Win32 infrastructure. The company is gradually replacing legacy Win32 UI elements with WinUI 3 components, improving performance and user experience.

Winsage

April 3, 2026

Windows 11 buries its best features for power-users deep behind the worst menus

Windows 11 features a modern interface but retains complex elements that challenge users. It combines the Settings app with the Control Panel, leading to navigation difficulties. The taskbar's right-click context menu has become more cumbersome, requiring additional clicks for essential options. Storage settings are modern but require access to legacy tools like Disk Management, which is less accessible. Sound settings are also split across different interfaces, complicating access to advanced configurations. Sysinternals, a suite of powerful utilities, is largely unknown to users. PowerToys and the "God Mode" folder offer valuable features but are not readily available and require manual activation. Overall, while Windows 11 is powerful, essential tools are often buried under outdated interfaces and inconsistent navigation.

Winsage

March 6, 2026

Windows 11’s March 2026 update is packing 9 new upgrades you’ll actually notice

On March 10, 2026, Microsoft will release a Patch Tuesday update for Windows 11, introducing several new features and enhancements. Key updates include a network speed test feature accessible from the Taskbar, updated camera controls for pan and tilt settings, a new settings page for Widgets, support for WebP images as wallpapers, Quick Machine Recovery for Windows 11 Pro, refreshed dialogs in the Settings app, and changes in File Explorer allowing "Extract All" for non-ZIP archives. Additional updates include the introduction of Emoji version 16, a magnifier icon in Task Manager for the Windows Search process, and expanded RSAT support for ARM64 devices. Users are advised to be cautious during installation due to potential errors.

Winsage

February 25, 2026

Microsoft Releases February Optional Updates for Windows 11

Microsoft has released optional February updates for Windows 11 versions 25H2 and 24H2, which include several enhancements: - A network speed test tool accessible from the taskbar for measuring Ethernet, Wi-Fi, and cellular connections. - Enhanced camera settings with new pan and tilt options for supported cameras. - A built-in version of the System Monitor (Sysmon) tool, available as an optional feature. - Improvements to Remote Server Administration Tools (RSAT) for Windows 11 Arm64 devices. - A new automatic recovery tool for Windows 11 Professional devices not domain-joined. - Support for .webp images as desktop backgrounds. - Introduction of new emojis in the Emoji 16.0 release. - BitLocker improvements to prevent devices from becoming unresponsive after entering a recovery key. Additionally, Microsoft has shared release notes for an upcoming optional update for Windows 11 version 26H1, which is currently only available to Insiders on the Canary Channel and is expected to debut on new devices with advanced silicon.