1. How to use Sysinternals tools to troubleshoot SharePoint/Office
Chad Schultz
Premier Field Engineer, Microsoft

2. Sysinternals History Started in 1996
Microsoft acquired Sysinternals in July, 2006
Mark Russinovich working at Microsoft as Technical Fellow on Windows Azure
Sysinternals Forum

3. Sysinternals Tools Info/Download
Sysinternals on the “Net”
Download the tools
Drag and Drop newest tools
NET USE S:

4. Sysinternals Tools Continued…
Not loaded on Windows operating systems by default
Work in Windows 2000 SP4 and up
No installer/uninstall for these tools
Always right-click and ‘Run as administrator’ on Vista & up
The first time the programs are run, the EULA will display, after accepting the EULA the first time, this screen should not reappear
Tool command line switches
ToolName /?
ToolName /AcceptEULA

5. Sysinternals Tools
Process Explorer
Process Monitor
AccessEnum
VMMap

6. Process Explorer Task Manager on steroids!
Monitors running process in real time
No historical data
Graph data per machine and process
Show parent/child processes
Can view process DLLs, threads and handles
Change default columns

7. More Process Explorer
Lists environment and privileges for each process
Shows DEP, ASLR, 32/64 bit and virtualized processes
Memory dumps
Process Highlighting
Load Dbghelp.dll from Debugging Tools for Windows
Windows SDK
Configure symbols for thread stack information
SRV*c:\websymbols*
Find window
Real-time performance indicators per process

8. Process Explorer Excel
Screenshot of Excel bit without ad-ins or macros
Excel is only running native code. No .NET.
Excel is running .Net code; Excel Automation, add-in, etc.

9. Lab 1
Use Process Explorer to troubleshoot blank page error

10. Process Monitor Collects system event data while running
Monitors File, Registry, network and process activity
Runs on Windows 2000 SP4, XP SP2, Vista, 2003, 2008 and Windows 7 32 bit and 64 bit
Does not capture historical performance data
Can save events for later research 3 formats; PML, CSV and XML
Backed by page file; 199 million events max
Performance impact minimal

11. More Process Monitor Filters; Menu & right-click
Tools->Count Occurrences

12. Process Monitor Results Primer
Error results aren’t necessarily bad:
ACCESS DENIED Often the source of problems
DELETE PENDING
The file or folder is trying to delete, but an open handle may be stopping the delete
NOT FOUND, PATH NOT FOUND, NAME NOT FOUND Common in DLL PATH searches, queries for optional functionality or settings
BUFFER OVERFLOW, BUFFER TO SMALL Application is asking how much data there is
FAST IO DISALLOWED Internal indicator that optimized I/O path is not available
END OF FILE Application tried to access beyond the end of a file, normal operation
REPARSE Symbolic link traversal
For more information on these error codes see;

13. Lab 2
Use Process Monitor to Troubleshoot “Server Error in ‘/’ Application

14. AccessEnum Check permissions of a folder structure
Good to run after finding “Access Denied” events in Process Monitor
Common problem areas
ASP.Net temporary file location c:\windows\Microsoft.net\Framework(64)\v \Temorary ASPNET Files
%temp% file location

15. Process Monitor Excel
View Name Not Found event while loading Excel with .Net code
Demo

16. VMMap
Graphical representation of virtual memory allocations for a process
Live output
Task Manager and Process Explorer is just one side of checking memory in use

17. Lab 3
How much total memory does Excel use?

18. SharePoint Processes to Monitor
Windows SharePoint Services Timer (OWSTIMER.EXE) 
Internet Information Server application pools (w3wp.exe)
Office SharePoint Server Search parent process (mssearch.exe)
SharePoint Search crawl process (msdmn.exe)

19. SharePoint Issues to Monitor
Badly performing application pools
Security event login failures to local resources
Timer job errors
Crawling local file system content sources
Installation errors

20. SharePoint Issues not to Monitor
Crawling SharePoint Sites or external sources
SQL login failures
SQL connection issues
Performance issues where detailed historical performance information is needed

21. Labs Lab 1: Application Pool Process
Lab 2: Basic usage and SharePoint Installation Error
Lab 3: Application Pool Performance
Lab 4: SharePoint Server Error

22. Links/Questions? Most up to date tools: Sysinternals blog:
Sysinternals blog:
Chad’s Blog:
Mark’s Blog: