You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-av-performance-issues-with-procmon.md
+43-45Lines changed: 43 additions & 45 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.reviewer: yonghree
7
7
manager: deniseb
8
8
ms.service: defender-endpoint
9
9
ms.topic: troubleshooting-general
10
-
ms.date: 01/10/2025
10
+
ms.date: 03/20/2025
11
11
ms.subservice: ngp
12
12
ms.localizationpriority: medium
13
13
ms.collection:
@@ -31,99 +31,97 @@ ai-usage: human-only
31
31
32
32
Process Monitor (ProcMon) is an advanced monitoring tool that provides real-time data on processes. It can be used to capture performance issues, such as high CPU usage, and to monitor application compatibility scenarios as they occur.
33
33
34
-
There are two ways to capture a Process Monitor (ProcMon) trace:
35
-
36
-
1. Using the MDE Client Analyzer
37
-
38
-
1. Manually
34
+
You can capture a Process Monitor (ProcMon) trace by using the MDE Client Analyzer or by using a manual process.
39
35
40
36
### Using the MDE Client Analyzer
41
37
42
38
1. Download the [MDE Client Analyzer](/defender-endpoint/overview-client-analyzer).
43
39
44
-
1. Run the MDE Client Analyzer using [Live Response or locally](/defender-endpoint/run-analyzer-windows).
40
+
2. Run the MDE Client Analyzer using [Live Response or locally](/defender-endpoint/run-analyzer-windows).
45
41
46
42
> [!TIP]
47
43
> Before starting the trace, please make sure that the issue is reproducible. Additionally, close any applications that do not contribute to the reproduction of the issue.
48
44
49
-
1. Run the MDE Client Analyzer with the -c and -v switches
45
+
3. Run the MDE Client Analyzer with the `-c` and `-v` switches:
1. Download [Process Monitor v4.01](/sysinternals/downloads/procmon) to a folder like `C:\temp`.
58
54
59
-
1. To remove the file's mark of the web:
55
+
2. To remove the file's mark of the web:
60
56
61
57
1. Right-click **ProcessMonitor.zip** and select **Properties**.
62
58
63
-
1. Under the *General* tab, look for *Security*.
59
+
2. Under the *General* tab, look for *Security*.
64
60
65
-
1. Check the box beside **Unblock**.
61
+
3. Check the box beside **Unblock**.
66
62
67
-
1. Select **Apply**.
63
+
4. Select **Apply**.
68
64
69
65
70
66
71
-
1. Unzip the file in `C:\temp` so that the folder path is `C:\temp\ProcessMonitor`.
67
+
3. Unzip the file in `C:\temp` so that the folder path is `C:\temp\ProcessMonitor`.
72
68
73
-
1. Copy **Procmon.exe** to the Windows client or Windows server you're troubleshooting.
69
+
4. Copy **Procmon.exe** to the Windows client or Windows server you're troubleshooting.
74
70
75
71
> [!TIP]
76
72
> Before running ProcMon, make sure all other applications not related to the high CPU usage issue are closed. Taking this step helps to minimize the number of processes to check.
77
73
78
-
1. You can launch ProcMon in two ways.
79
-
1. Right-click **Procmon.exe** and select **Run as administrator**.
80
-
81
-
- If this is your first time using ProcMon, click **Agree** to accept the Process Monitor License Agreement.
82
-
83
-
84
-
85
-
- Since logging starts automatically, stop the capture by selecting the **Capture** button or pressing **Ctrl+E**.
86
-
87
-
.jpg)
88
-
89
-
- To confirm the capture has stopped, look for a pause icon on the **Capture** button, then delete the logged entries by selecting the **Clear** button or pressing **Ctrl+X**.
90
-
91
-
.jpg)
92
-
93
-
74
+
5. You can launch ProcMon in two ways: using Procmon.exe or command line.
75
+
76
+
- To use [Procmon.exe](/sysinternals/downloads/procmon), download it, and open it as an administrator.
77
+
78
+
1. If this is your first time using ProcMon, click **Agree** to accept the Process Monitor License Agreement.
79
+
80
+
81
+
82
+
2. Since logging starts automatically, stop the capture by selecting the **Capture** button or pressing **Ctrl+E**.
83
+
84
+
.jpg)
85
+
86
+
3. To confirm the capture has stopped, look for a pause icon on the **Capture** button, then delete the logged entries by selecting the **Clear** button or pressing **Ctrl+X**.
87
+
88
+
.jpg)
89
+
90
+
94
91
95
-
1. Run the **command line** as admin, then from the Process Monitor path, run:
96
-
92
+
- To use command line, open Command Prompt as an administrator. Then, run the following command:
93
+
97
94
98
95
99
96
> [!TIP]
100
97
> Make the ProcMon window as small as possible when capturing data so you can easily start and stop the trace
101
98
102
-
1. After completing step 5, set filters by selecting the **Filter** icon. Standard filters are set by default. You can also filter the results after the capture is complete. If you applied any filters, click **Apply** and then **OK**.
99
+
6. Set filters by selecting the **Filter** icon. Standard filters are set by default. You can also filter the results after the capture is complete. If you applied any filters, click **Apply** and then **OK**.
103
100
104
101
102
+
105
103
106
104
107
-
1. To start the capture, select the **Capture** button again.
105
+
7. To start the capture, select the **Capture** button again.
108
106
109
-
1. Reproduce the problem.
107
+
8. Reproduce the problem.
110
108
111
109
> [!TIP]
112
110
> Wait for the problem to be reproduced, then note the timestamp when the trace begins.
113
111
114
-
1. After capturing two to four minutes of process activity during high CPU usage, stop the capture by clicking the **Capture** button.
112
+
9. After capturing two to four minutes of process activity during high CPU usage, stop the capture by clicking the **Capture** button.
115
113
116
-
1. To save the capture with a unique name in the `.pml` format, go to **File** then click **Save...**. Ensure you select the radio buttons **All events** and **Native Process Monitor Format (PML)**.
114
+
10. To save the capture with a unique name in the `.pml` format, go to **File** then click **Save...**. Ensure you select the radio buttons **All events** and **Native Process Monitor Format (PML)**.
117
115
118
116
119
117
120
-
1. For better tracking, change the default path from `C:\temp\ProcessMonitor\LogFile.PML` to `C:\temp\ProcessMonitor\%ComputerName%_LogFile_MMDDYEAR_Repro_of_issue.PML` where:
118
+
11. For better tracking, change the default path from `C:\temp\ProcessMonitor\LogFile.PML` to `C:\temp\ProcessMonitor\%ComputerName%_LogFile_MMDDYEAR_Repro_of_issue.PML` where:
121
119
122
-
-`%ComputerName%` is the device name
123
-
-`MMDDYEAR` is the month, day, and year
124
-
-`Repro_of_issue` is the name of the issue you're trying to reproduce
120
+
-`%ComputerName%` is the device name
121
+
-`MMDDYEAR` is the month, day, and year
122
+
-`Repro_of_issue` is the name of the issue you're trying to reproduce
125
123
126
-
> [!TIP]
127
-
> If you have a working system, you might want to get a sample log to compare.
124
+
> [!TIP]
125
+
> If you have a working system, you might want to get a sample log to compare.
128
126
129
-
1. Zip the `.pml` file and submit it to Microsoft Support.
127
+
12. Zip the `.pml` file and submit it to Microsoft Support.
0 commit comments