Sign in

Private company

Sysinternals

Logo: learn.microsoft.com3

Microsoft website offering diagnostic tools for Windows

Windows Sysinternals is a website that offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment. Originally, the Sysinternals website (formerly known as ntinternals) was created in 1996 and was operated by the company Winternals Software LP, which was located in Austin, Texas. It was started by software developers Bryce Cogswell and Mark Russinovich.2 Wikipedia text CC BY-SA 4.0

Last updated Oct 21, 2026.

Overview

1996Founded1

See how the biggest companies compare on our leaderboards

Windows Sysinternals is a website that offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment. Originally, the Sysinternals website (formerly known as ntinternals) was created in 1996 and was operated by the company Winternals Software LP, which was located in Austin, Texas. It was started by software developers Bryce Cogswell and Mark Russinovich. Microsoft acquired Winternals and its assets on July 18, 2006.2

Corporate structure

Sysinternals is part of a group headed by Microsoft. 191 entities, 29 countries on record. Switch between the flow chart and the network, and select any entity to see its details.

Built from parent and subsidiary links from GLEIF, the Global Legal Entity Identifier Foundation (CC0); subsidiaries listed in Exhibit 21 of annual reports filed with the SEC; subsidiaries, stakes and holdings from Wikidata (CC0). Each entity in the chart links to its source.

The story

Founded by Mark Russinovich in 1996.1

Leadership

Who has led Sysinternals, and when. Pick a name to see everywhere that person has worked.

Products and brands

  • software

Listed on Wikidata.1

Winternals Software LP

Winternals Software LP was founded by Cogswell and Russinovich, who sparked the 2005 Sony BMG CD copy protection scandal in an October 2005 posting to the Sysinternals blog.

On July 18, 2006, Microsoft Corporation acquired the company and its assets. Russinovich explained that Sysinternals will remain active until Microsoft agrees on a method of distributing the tools provided there. However, NT Locksmith, a Windows password recovery utility, was immediately removed. Most of the source that Sysinternals provided was also removed. Currently, the Sysinternals website is moved to the Windows Sysinternals website and is a part of Microsoft Docs.

In late 2010, Cogswell retired from Sysinternals.

Products

Windows Sysinternals supplies users with numerous free utilities, most of which are being actively developed by Mark Russinovich and Bryce Cogswell, such as Process Explorer, an advanced version of Windows Task Manager, Autoruns, which Windows Sysinternals claims is the most advanced manager of startup applications, RootkitRevealer, a rootkit detection utility, Contig, PageDefrag and a total of 65 other utilities. NTFSDOS, which allowed NTFS volumes to be read by Microsoft's MS-DOS operating system, is now discontinued and is no longer available for download. A larger number of these utilities are nowadays bundled by the publishers for the sake of simpler downloading of all, or most, current versions in the so-called Sysinternals Suite.

Read the full text

Previously available for download was the Winternals Administrator Pak which contained ERD Commander 2005, Remote Recover 3.0, NTFSDOS Professional 5.0, Crash Analyzer Wizard, FileRestore 1.0, Filemon Enterprise Edition 2.0, Regmon Enterprise Edition 2.0, AD Explorer Insight for Active Directory 2.0, and TCP Tools.

On May 18, 2010, Sysinternals released its first new utility since its acquisition by Microsoft. Named RAMMap, it is a diagnostic utility similar to the memory tab of Windows Resource monitor, but more advanced. RAMMap runs only on Windows Vista and later. A system event monitoring tool, Sysmon, was released in 2014, which can collect and publish system events that are helpful for security analysis into the Windows Event Log.

In November 2018, Microsoft confirmed it is porting Sysinternals tools, including ProcDump and ProcMon, to Linux.

From Wikipedia’s article on Sysinternals, shared under CC BY-SA 4.0.4

Subsidiaries and ownership

Parent company

From Wikidata.1

Timeline

  1. 1996Founded Founded1

Sources

The numbers on this page point here. Each one links to the record it came from.

  1. 1
  2. 2
  3. 3
    Company websiteSysinternals logo
  4. 4