If you don’t want procmon to automatically begin capturing events, you can start it from the command line by running procmon.exe /NoConnect.

The moment you run procmon, it begins capturing many different kinds of Windows events.

Procmon has other command-line switches customizing behavior but you’ll learn about this in the coming sections. Although less likely in this day and age, whenever you launch procmon, it detects whether you’re running a 64-bit or 32-bit OS. By default, procmon launches prompting you to accept an end-user license agreement (EULA) and also open up a window. You’ll then see a folder like any ol’ network share containing all of the Sysinternals files including procmon. Below is a PowerShell code snippet if you’ve saved it to your home folder. Once you’ve got it downloaded, extract the ZIP file with your favorite tool. In this Ultimate Guide, you’re going to learn everything there is to know about using the procmon utility from installing, basic usage all the way to various use cases that will help you track down all kinds of activity. If you need to inspect Windows registry, file system, process, or network activity and have decided to use procmon, this article is for you.

Process monitor filter or