Linux finally gets one of Microsoft's most useful Windows utilities

Credit: Tony Phillips/How-To Geek Published Nov 6, 2026, 9:34 AM EST Jefferson Mangubat is an experienced technology journalist who has reported on consumer electronics, software updates and big stories in the industry. He's now a Reporter at How-To Geek, and has built a solid reputation for delivering accurate, accessible, and insightful tech journalism. Prior to that, he was a tech reporter for Neowin, where he extensively covered hardware developments from Apple and Google, in addition to digital trends and application updates. Sign in to your How-To Geek account Microsoft is making its long-running Sysinternals troubleshooting toolkit more useful outside of Windows, and the latest releases are a good reason to pay attention. After bringing tools like Sysmon, ProcDump, and Process Monitor to Linux, the company is now adding Autoruns to Linux, giving users access to more of the diagnostic tools Windows administrators have relied on for years. Sysinternals has been the definitive Windows Swiss Army knife for decades. These lightweight utilities, created by Mark Russinovich and Bryce Cogswell before Microsoft acquired the toolkit in 2006, give admins granular control over process management, startup items, and deep system telemetry. Autoruns finally arrives on Linux A familiar Windows utility arrives on another platform Autoruns is especially useful for digging into what happens when a system boots or a user logs in. It provides administrators with a detailed view of automatically started applications and background components, enabling them to pinpoint unwanted startup entries or investigate suspicious activity. For years, it has been a joy of Windows users, whereas before, Linux users had to use other utilities to get the same result. Microsoft didn’t specify how close the Linux release is to its Windows counterpart, so questions about its interface and feature set remain unanswered. There was also a small launch day hiccup, as a commenter on Microsoft’s announcement noticed that the GitHub release link returned a 404 error. A corrected release address was subsequently pointed out in the comments. Process Explorer brings deeper diagnostics to macOS Mac users get another way to inspect running processes Mac users get the other major release. Process Explorer 1.0 is now available for macOS, and it provides a more powerful way to examine running processes than the standard Activity Monitor. It provides you with a live process tree, detailed process properties, performance graphs, and controls to manage running processes. Microsoft has also included Apple Silicon-specific information, so users can see how workloads play with performance and efficiency cores. That's a welcome addition for developers and power users who are keen to learn more about resource-intensive applications without having to switch over to a Windows machine. The macOS version is already available on Microsoft's public GitHub repo. The two releases aren't the only changes in Microsoft's latest Sysinternals update. For Linux users, there are also bug-fix updates to ProcDump 3.6, Process Monitor 2.3, Sysmon 1.6, and SysinternalsEBPF 2.3. Meanwhile, macOS picks up Listent 1.1 and ZoomIt 12.3.2, with the latter adding dictation support for screen capture captions. Windows has not been excluded from the equation. Process Explorer 17.21 speeds startup and adds CSV export to the search dialog, plus updates for Process Monitor, PsExec, and other utilities. Source: Microsoft