How to Use Process Monitor

Set up filters before capturing

ProcMon captures everything by default, which quickly becomes millions of rows. Filtering before you start makes the output usable.

1. 1Launch Procmon.exe as administrator.
2. 2Press Ctrl+L to open the Filter dialog.
3. 3Add a filter such as Process Name is yourapp.exe then Include, and click Apply.
4. 4Optionally add Result is not SUCCESS to focus on failures like NAME NOT FOUND or ACCESS DENIED.
5. 5Click OK to close the dialog and start watching filtered events live.

Capture a specific problem

1. 1Clear the current log with Ctrl+X (or Edit > Clear Display).
2. 2Reproduce the problem in the target application right away.
3. 3Press Ctrl+E to stop capturing once the problem has occurred, so you're not scrolling through unrelated noise.

Use boot logging for startup problems

When an issue happens before you can launch ProcMon manually — a slow boot, a driver failing to load, a service erroring early — boot logging captures activity from very early startup.

1. 1Open Procmon.exe, go to Options > Enable Boot Logging, and confirm.
2. 2Restart the computer; ProcMon logs activity to a system file automatically from early boot.
3. 3After Windows finishes starting and you relaunch Procmon, it will prompt to convert the captured boot log into a viewable .PML file — save it and open it for analysis.

Analyzing a capture

• Use the toolbar icons or Ctrl+L to toggle Registry, File System, Network, and Process/Thread event categories on or off quickly.
• Right-click any event and choose Include or Exclude to refine filters on the fly based on that row's values.
• Use Tools > Process Tree to see a hierarchical view of everything captured, useful for spotting an unexpected child process.
• Look for ACCESS DENIED and NAME NOT FOUND results near the point where the application misbehaves — these are the most common root causes.

Saving and sharing results

File > Save lets you export the filtered or full event set as a .PML (native format, reopenable in ProcMon), CSV, or XML. .PML is best when you want someone else to explore the same data with full filtering ability.