Windows · Windows Utilities
Process Monitor for Windows
Sysinternals real-time monitoring tool from Microsoft that logs file system, registry, and process/thread activity for deep Windows troubleshooting.
Updated August 9, 2026 · Reviewed by SoftNexi Editorial Team, Software research and documentation
Overview
Process Monitor (often shortened to ProcMon) is a Sysinternals utility, published by Microsoft on Microsoft Learn, that captures a real-time log of file system, registry, and process/thread activity across the system. Where Process Explorer shows a snapshot of running processes, Process Monitor records the ongoing stream of low-level operations those processes perform.
It is built for deep troubleshooting: finding which process is repeatedly hitting a missing registry key, tracing exactly which files an installer touches, or diagnosing why an application fails by watching its file and registry calls as they happen. Powerful filtering lets you narrow the typically enormous event stream down to a specific process, path, or operation type.
Like the other Sysinternals tools, it is a portable, no-install utility distributed as a ZIP file, with no setup wizard and nothing installed permanently on the system.
It is a specialist tool aimed at developers, IT professionals, and advanced troubleshooters. The volume of data it captures and its filtering-heavy workflow make it overkill for anyone who just wants to see what programs are running.
Key features
- Real-time logging of file system, registry, and process/thread activity
- Powerful filtering by process, path, operation type, or result
- Portable, no-install executable distributed as a ZIP
- Stack trace capture for individual events to see the calling code path
- Save and reload captured logs for later analysis
- Boot logging mode to capture activity from early startup
System requirements
- Operating system
- Windows 11 and Windows 10 (also supports older Windows releases)
- Distribution
- Portable, no-install ZIP download from Microsoft Learn's Sysinternals pages
- Permissions
- Administrator rights required to capture system-wide activity
How to install Process Monitor
1. Download from Microsoft Learn
Open the Process Monitor page on learn.microsoft.com/sysinternals and download the ZIP archive.
2. Extract the ZIP
Unzip to a folder of your choice; no installer runs.
3. Run as administrator
Run Procmon.exe as administrator so it can capture system-wide file, registry, and process activity.
How to use it
1. Set a filter before capturing
Use Filter > Filter to narrow the capture to a specific process name or path before starting, since unfiltered logs grow very large very fast.
2. Find a missing file or registry key
Filter results by Result equals NAME NOT FOUND to spot exactly which file or registry path a struggling application is looking for and failing to find.
3. Trace an installer
Start a capture, run an installer, then stop and filter by that process name to see every file and registry key it touched.
4. Save a log for later
Use File > Save to export a captured session so you or a colleague can review it without re-running the capture.
Safety and privacy
- We link only to Microsoft Learn's official Sysinternals page, the authoritative source for this tool.
- As a portable, no-install tool, it leaves no persistent installation once you delete the extracted files.
- Bundled software
- None; distributed directly by Microsoft with no third-party bundling.
- Privacy
- Runs entirely locally; captured logs stay on your machine unless you choose to save and share them.
Known risks
- Unfiltered captures generate very large volumes of data quickly and can affect system performance briefly during heavy logging — apply filters before starting a capture where possible.
What's new
Current Sysinternals release
Microsoft updates Sysinternals tools periodically. Check the Process Monitor page on Microsoft Learn for the current version and release history.
Pros and cons
Pros
- Unmatched depth for diagnosing file/registry-level problems
- Free, official, and maintained by Microsoft
- Portable — no installation required
- Powerful filtering keeps large captures manageable
Cons
- Steep learning curve and a genuinely technical tool
- Unfiltered captures produce overwhelming amounts of data
- Requires administrator rights for full system visibility
Verdict
Process Monitor is the tool to reach for when you need to see exactly what a program is doing at the file and registry level, not just that it is running. It is technical by design, but unmatched for that specific job, and it costs nothing.
Frequently asked questions
Is Process Monitor free?
Yes, it is a free Microsoft Sysinternals tool.
Do I need to install Process Monitor?
No, it is distributed as a portable ZIP file; extract and run the executable directly.
What is the difference between Process Monitor and Process Explorer?
Process Explorer shows a live view and tree of running processes, handles, and DLLs. Process Monitor logs the ongoing stream of file system, registry, and process/thread events over time, and is used for deeper activity tracing.