Windows Internals 5th Edition Released! The 5^th Edition of Windows Internals, the official book on the architecture and internals of the Windows operating system, is now available. This release is 25% larger than the 4^th Edition and is updated to cover Windows Vista and Windows Server 2008. Visit the official book page and watch Mark and David’s Channel 9 interview on the book

New Webcast: Case of the Unexplained 2009: Watch Mark’s top-10 rated TechEd session and third installment of the Case of the Unexplained, where he shows how to use the Sysinternals tools like Process Explorer, Process Monitor and Autoruns to solve problems with real-world cases as examples.

Autoruns v9.51: This fixes a bug with the Run As Administrator functionality on 64-bit Windows 7, a copy-to-clipboard bug where part of a line’s content was truncated, and is updated to show Windows 7 Sidebar Gadget configuration.

VMMap v2.1: VMMap now shows process private byte and working set usage in the process picker, shows the size of the displayed strings in the strings dialog, and fixes a bug with automatic .vmp file association and running the 32-bit version on 64-bit systems.

PsExec v1.96: This release fixes a bug where remote command-line output was not displayed when the target system was 64-bit Windows XP.

ProcDump v1.0: This new command-line utility is aimed at capturing process dumps of otherwise difficult to isolate and reproduce CPU spikes. It also serves as a general process dump creation utility and can also monitor and generate process dumps when a process has a hung window or unhandled exception.

Inside Windows 7 User Account Control 

Check out Mark’s latest TechNet Magazine article where he goes inside the changes in Windows 7’s implementation of UAC, including the two new UAC modes and how certain Windows images are automatically elevated to administrative rights in the default mode.

Sysinternals Customer Survey – We could use your help.  We're looking into who uses the Sysinternals tools and what other Microsoft tools you use. Please take this very short questionnaire (7 questions max. depending on how you answer). We won’t ask you who you are, your email or anything that can identify you. - Thanks

VMMap v2.0: VMMap now breaks out information on memory used by the .NET CLR, enabling detailed memory analysis of managed applications.

ClockRes v2.0: This update to Clockres, a system utility that reports the frequency of the system clock, now shows the upper and lower resolution of the system clock.

Autoruns v9.5: This update to Autoruns, a powerful autostart manager, adds display of audio and video codecs, which are gaining popularity as an extension mechanism used by malware to gain automatic execution.

VMMap v1.1

This update to VMMap, an advanced process memory analysis tool, makes it easy to view the changes between subsequent refreshes. Using the new “show changes” option enables you to measure the impact of specific application functionality by comparing memory usage before and after the functionality executes. The release also has a number of user interface improvements, such as always highlighting the currently selected listview items and making the total row’s position in the summary list sort-independent.

Active Directory Explorer v1.2

ADExplorer v1.2, an Active Directory object browser, adds the ability to copy the properties of an object to the clipboard, back and forward navigation shortcut keys, and an option to change the base used for integer display.

Channel 9, Microsoft’s direct connection to developers, turned five a few days ago. Mark frequently gives interviews on Channel 9, including his latest on Windows 7 kernel changes, which is Channel 9’s most viewed interview of all time at 550,000 views. Mark was one of the Niners to give Channel 9 a special birthday wish.

Autoruns v9.4: This Autoruns update shows manual start Windows services, fixes a bug that affected the display of autostart locations that could include multiple startup registrations, and fixes a bug in the Jump To functionality on 64-bit Windows.

BgInfo v4.15: Bginfo now supports access to 64-bit registry keys in custom fields, fixes a bug with oversized wallpaper on multiple monitor configurations, and sets its default output directory to %TEMP%.

ZoomIt v3.03: Fixes a GDI handle leak that could cause Zoomit’s drawing functionality to eventually stop working.

Mark’s Blog: Pushing the Limits of Windows: Paged and Nonpaged Pool - Check out Mark’s latest entry in his Pushing the Limits of Windows series, where he describes the role of the kernel’s paged and nonpaged pool resources, their limits, how the system behaves when they run out, and how to track down a driver that’s leaking pool.