Registry: It covers events happening with the Windows Registry.

Here are some key capabilities/functions of this utility: For instance, it won’t capture keystrokes or mouse movement. However, it doesn’t capture everything happening either. It captures most of the processes and events happening inside your computer.

Windows Process Monitor has very useful and powerful functions. The Windows Process Monitor is a utility that shows the file system, threads, and Registry of a process in real-time. This also makes it safe as only the system admin can use the utility. Process Monitor can only run in admin mode as it uses a kernel driver to get all that internal information. With stuff like session IDs, thread stacks, and user names, you get the full behind-the-scenes picture of any application that you want to monitor. When the two legacy utilities were combined, the functionalities of Process Monitor were improved further. Think of it as a huge, continuously updating database with lots of rows and columns. A successor to Windows utilities Filemon and Regemon, it combines the functionalities of both these utilities.

It’s a utility that has been part of the Windows ecosystem since the days of Windows XP. Not just that, it can also help fix problems by giving a detailed analysis of the process at hand. Have you ever wondered about looking under the hood and seeing how computer applications really run? Windows Process Monitor can help with that.

Process monitor boot logging