This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
AccessChk
This tool shows you the level of access the user or group you specify has to
files, Registry keys or Windows services.
AccessEnum
This simple yet powerful security tool shows you who has what access to
directories, files and Registry keys on your systems. Use it to find
holes in your permissions.
Autologon
Bypass password screen during logon.
Autoruns
See what programs are configured to startup automatically when your
system boots and you log in. Autoruns also shows you the full list of
Registry and file locations where applications can configure auto-start
settings.
LogonSessions
List active logon sessions
Process Explorer
Find out what files, registry keys and other objects processes have
open, which DLLs they have loaded, and more. This uniquely powerful
utility will even show you who owns each process.
PsExec
Execute processes with limited-user rights.
PsLoggedOn
Show users logged on to a system.
PsLogList
Dump event log records.
PsTools
The PsTools suite includes command-line utilities for listing the
processes running on local or remote computers, running processes
remotely, rebooting computers, dumping event logs, and more.
Rootkit Revealer
RootkitRevealer is an advanced rootkit detection utility.
SDelete
Securely overwrite your sensitive files and cleanse your free space of
previously deleted files using this DoD-compliant secure delete program.
ShareEnum
Scan file shares on your network and view their security settings to
close security holes.
ShellRunas
Launch programs as a different user via a convenient shell context-menu
entry.
Sigcheck
Dump file version information and verify that images on your system are
digitally signed.
Sysmon
Monitors and reports key system activity via the Windows event log.
Documentation
RootkitRevealer - Sysinternals
Scan your system for rootkit-based malware.
Sysinternals System Information Utilities - Sysinternals
Windows Sysinternals system information utilities
List the active logon sessions on a system.
Training
Module
Explore advanced protection methods - Training
This module explores additional tools used to provide additional layers of security within an organization.
Certification
Microsoft Certified: Information Security Administrator Associate (beta) - Certifications
As an Information Security Administrator, you plan and implement information security of sensitive data by using Microsoft Purview and related services. You’re responsible for mitigating risks by protecting data inside collaboration environments that are managed by Microsoft 365 from internal and external threats and protecting data used by AI services. You also implement information protection, data loss prevention, retention, insider risk management, and manage information security alerts and activities.