So let's understand how to use something like the Microsoft Sysinternals.
So the Microsoft Sysinternals is a set of bundled utilities into a single
download or, actually, you can download them individually.
The download for the ZIP file will contain all of the troubleshooting
utilities you need and then the help files as well.
Now, of course,
you can download directly from Microsoft, you can then extract
the download file, and you can then execute each command
either directly or within a console.
So some of them will just execute. Just be careful
that as you're double‑clicking them,
some of them might just open and close because they need to be
run in the context of a command console.
Others are more executable, so when you double‑click them,
they have an interface. The initial execution
requires that you accept a usage banner.
So, often when you're scripting the process,
you need to cater for that too, and then commands will work
within a CMD and a PowerShell window as well.
So if you have a CMD window open or a PowerShell window,
a Windows terminal or something else,
as long as you have the path to the Sysinternals,
you can execute them along with PowerShell commands as well.
Now the Sysinternals tools themselves,
there is support for command line execution.
It supports various command line arguments and can support options
for exporting the results into different formats.
So as an example, let's say I wanted to review all of the auto running processes.
You can see I'm browsing to autorunsc, which is one of the executables,
and because I want to execute it as a command line,
I can do /accept the agreement, and then that will not prompt
me and obviously block me from executing,
it'll just run the command.
We can also then review them and obviously hide specific entries.
So if I wanted to hide any of the Microsoft entries,
I could say autorunsc, and I want to get everything, so you can see
the * there, and then I want to get rid of the Microsoft ones, and
then I accept the agreement again.
Now what about if I wanted to combine that with
PowerShell, because at the moment, I'm just executing the commands as they are.
So let's combine that together and say, well,
let's run, let's go and get me the running processes, and then select properties.
I also want to convert that to a CSV object so I can then do something with it.
And you can see I'm combining support tools directly with
PowerShell. So now I'm saying autorunsc,
get rid of the Microsoft ones, show me everything, accept the
agreement, and then you can see the pipe command and I'm
converting that into a CSV format,
which then allows me to do a Select statement, so Select Entry, Description,
Image Path, Enabled, etc. So we can combine these together.
Now hopefully, just by that one example,
you'll start to see where we go with this type of
triage when we're using external tools.