Sysinternals tools: Handle, Process Monitor, Autoruns and TCPView

Start DC01 and SRV01. Work as SAATLAB\adm.rahul in PowerShell as administrator on SRV01.

1Download the Sysinternals Suite

On SRV01:

New-Item C:\Tools -ItemType Directory -Force | Out-Null
Invoke-WebRequest https://download.sysinternals.com/files/SysinternalsSuite.zip -OutFile C:\Tools\SysinternalsSuite.zip
Expand-Archive C:\Tools\SysinternalsSuite.zip -DestinationPath C:\Tools\Sysinternals -Force
$env:Path += ';C:\Tools\Sysinternals'
Get-ChildItem C:\Tools\Sysinternals\*64.exe | Measure-Object | Select-Object Count

You’ll see something like this:

Count
-----
   74

The suite has 32-bit and 64-bit versions of most tools; on a 64-bit server use the ones ending in 64. Adding the folder to the path lets you run them by name in this session.

✅ Checkpoint: C:\Tools\Sysinternals holds the tools and you can run them by name.

2Find who has a file open

Open a file in Notepad, then search for it with Handle:

'test' | Set-Content C:\Lab\report.txt
Start-Process notepad.exe C:\Lab\report.txt
handle64.exe -accepteula -nobanner C:\Lab

You’ll see something like this:

powershell.exe     pid: 4120   type: File           44: C:\Lab
notepad.exe        pid: 5236   type: File           1C4: C:\Lab

Handle lists every process with a handle to anything under that path: here your PowerShell session (its current folder) and Notepad. On a file server, the same search tells you which process or service holds a file that users can’t replace. Close Notepad when you’re done.

✅ Checkpoint: Handle shows the process name and PID holding handles under C:\Lab.

3Trace a command with Process Monitor

Start a capture to a file, run a command, stop it, then export to CSV:

Procmon64.exe /AcceptEula /Quiet /Minimized /BackingFile C:\Lab\trace.pml
Start-Sleep -Seconds 5
cmd /c "type C:\Lab\missing-file.txt"
Procmon64.exe /Terminate
Procmon64.exe /OpenLog C:\Lab\trace.pml /SaveAs C:\Lab\trace.csv
Import-Csv C:\Lab\trace.csv |
    Where-Object { $_.'Process Name' -eq 'cmd.exe' -and $_.Path -like '*missing-file*' } |
    Select-Object 'Process Name', Operation, Path, Result -First 2 | Format-Table -Wrap

You’ll see something like this:

Process Name Operation  Path                    Result
------------ ---------  ----                    ------
cmd.exe      CreateFile C:\Lab\missing-file.txt NAME NOT FOUND

Every file and registry access is recorded with its result. NAME NOT FOUND means the file or key doesn’t exist, ACCESS DENIED means permissions, and SUCCESS means it worked. In the Procmon window you can do the same with Filter, then Process Name is cmd.exe. [Add your screenshot here]

✅ Checkpoint: C:\Lab\trace.csv shows cmd.exe getting NAME NOT FOUND for missing-file.txt.

4List non-Microsoft autostart entries

On SRV01:

autorunsc64.exe -accepteula -nobanner -a * -c -m -s > C:\Lab\autoruns.csv
Import-Csv C:\Lab\autoruns.csv | Where-Object Entry |
    Select-Object Category, Entry, Signer -First 5 | Format-Table

You’ll see something like this:

Category        Entry                        Signer
--------        -----                        ------
Services        VBoxService                  (Verified) Oracle America, Inc.
Drivers         VBoxGuest                    (Verified) Oracle America, Inc.
Drivers         VBoxSF                       (Verified) Oracle America, Inc.
Drivers         VBoxWddm                     (Verified) Oracle America, Inc.

With Microsoft entries hidden, only third-party software is left: here the VirtualBox Guest Additions and anything else you installed. On a real server, an unsigned entry or one from an unknown company is worth a closer look. Your list depends on what you installed.

✅ Checkpoint: C:\Lab\autoruns.csv lists non-Microsoft autostart entries with their signers.

5See network connections per process

On SRV01:

tcpvcon64.exe -accepteula -nobanner -c -n | ConvertFrom-Csv -Header Proto, Process, PID, State, Local, Remote |
    Where-Object State -eq 'ESTABLISHED' | Select-Object -First 4 | Format-Table

You’ll see something like this:

Proto Process      PID State       Local           Remote
----- -------      --- -----       -----           ------
TCP   lsass.exe    792 ESTABLISHED 10.0.0.20:49702 10.0.0.10:389
TCP   svchost.exe 1436 ESTABLISHED 10.0.0.20:49688 10.0.0.10:135
TCP   System         4 ESTABLISHED 10.0.0.20:445   10.0.0.150:50214
TCP   dfsrs.exe   2980 ESTABLISHED 10.0.0.20:49711 10.0.0.11:49673

Each connection shows the process behind it: lsass talking LDAP to DC01, SMB from CL01, DFS Replication to DC02. When a firewall team asks “what is this server talking to on port X?”, this answers it in one command.

✅ Checkpoint: tcpvcon lists established connections with the owning process.