Our verdict: Process Monitor is the standard tool for answering "what is this program actually doing?" It shows every file and registry access with the process behind it. The flood of events takes practice to filter, and the current version targets Windows 11.
About Process Monitor
Process Monitor is a Sysinternals tool by Mark Russinovich, published by Microsoft. It combines the old Filemon and Regmon utilities and shows real-time file system, registry and process/thread activity, including the command line, user and session of each process.
Filters are non-destructive, so you can change them without losing captured data, and each event can include a full thread stack with symbol support. Logs can hold tens of millions of events and be saved in a native format for analysis on another PC. Boot-time logging captures what happens while Windows starts.
What it does well
- Live file and registry log. Records every file system and registry operation with its result.
- Non-destructive filters. Filter on any field without losing captured events.
- Thread stacks. Shows the call stack of each operation to find the root cause.
- Process tree. Displays the parent-child relationships of all traced processes.
- Boot logging. Captures activity during Windows startup.
Who it is for
Good fit
IT staff, developers and malware analysts tracking down access-denied errors, missing files or settings.
Look elsewhere
Casual users; the raw event stream is overwhelming without knowing what to look for.
Pros and cons
Pros
- Shows exactly which files and registry keys an app uses
- Powerful non-destructive filtering
- Official Microsoft tool, no ads
- Portable
Cons
- Current version lists only Windows 11 as supported client
- Captures millions of events and uses a lot of memory if left running
- Closed source
How to install Process Monitor
Download the ZIP from Microsoft Learn, extract it and run Procmon64.exe as administrator. Accept the Sysinternals license on first launch. Set a filter, for example Process Name is app.exe, before capturing, and stop capture (Ctrl+E) when done to save memory.
Questions about Process Monitor
Is Process Monitor free?
Yes. Process Monitor is a free Sysinternals tool from Microsoft.
Does Process Monitor run on Windows 10?
Microsoft lists Windows 11 and Windows Server 2019 or later as supported for the current version.
What is the difference from Process Explorer?
Process Explorer shows the current state of processes, handles and DLLs. Process Monitor records activity over time, such as each file and registry access.
