The official Process Monitor download for Windows 11 and Windows 10 is a free 3.1 MB ZIP from Microsoft Sysinternals. Extract it, run the file that matches your processor as administrator, and it records every file, Registry and process event as it happens.
Process Monitor has no setup program. One ZIP holds separate builds for 64-bit Intel and AMD PCs, Windows on Arm laptops and 32-bit systems, and the same tool ships free inside the Sysinternals Suite on the Microsoft Store.
This guide covers the right file for your PC, the Store and winget routes, capturing and saving a trace, the command line for unattended and remote runs, the options for Mac users and fixes for common problems.
Check the Process Monitor system requirements before you download
Microsoft lists Windows 11 and Windows Server 2019 or later as the supported systems. Confirm the version, the source and the size in this table before you download.
| Field | Details |
|---|---|
| Software | Process Monitor (Procmon) |
| Developer | Microsoft Sysinternals (Mark Russinovich) |
| Latest version | 4.11, published 10 September 2026 |
| License / Price | Free (Sysinternals licence terms) |
| File size | 3.1 MB ZIP, as listed by Microsoft |
| Supported OS | Windows 11 and later; Windows Server 2019 and later |
| Architecture | x64, ARM64 and x86 in one ZIP |
| Installation | None. Extract the ZIP and run the program |
| Offline installer | Yes. The ZIP is the complete program |
| Official download source | Microsoft Learn (Sysinternals) |
| Also available from | Sysinternals Suite in the Microsoft Store |
| Last verified | 2026-09-22 |
Windows 10 is not on Microsoft’s supported list for Process Monitor. The Sysinternals Suite package in the Store still installs on Windows 10 version 1903 or later, so older PCs can run the tool without official support.
Which Process Monitor download do you need?
Every route below delivers the same program. Match your machine to a row and follow that link.
| Your situation | Get this | Size |
|---|---|---|
| Windows 11 or 10 on an Intel or AMD 64-bit PC (most PCs) | ProcessMonitor.zip, then run Procmon64.exe | 3.1 MB ZIP |
| Windows 11 on Arm, such as Snapdragon X laptops | ProcessMonitor.zip, then run Procmon64a.exe | 3.1 MB ZIP |
| 32-bit Windows | ProcessMonitor.zip, then run Procmon.exe | 3.1 MB ZIP |
| You want automatic updates for every Sysinternals tool | Sysinternals Suite in the Microsoft Store | Free |
| You want the whole toolset in one offline ZIP | Sysinternals Suite ZIP | 192.2 MB (21.3 MB for ARM64) |
| You need the same tracing on Ubuntu | Procmon for Linux on GitHub | Separate open-source tool |
To read your processor type, open Settings > System > About and check System type. An ARM-based processor needs Procmon64a.exe ; an x64-based processor needs Procmon64.exe .
Download Process Monitor from Microsoft official pages
Microsoft publishes Process Monitor on its Sysinternals pages at learn.microsoft.com. The Store listing is published by Microsoft Corporation.
- Process Monitor on Microsoft Learn — 3.1 MB · The Download Process Monitor link, plus a Run now link to Sysinternals Live
- Sysinternals Suite in the Microsoft Store — Free, published by Microsoft Corporation, covers x86, x64 and ARM64
- Sysinternals Suite download page — 192.2 MB · All troubleshooting tools, with separate ARM64 and Nano Server ZIPs
- Sysinternals Utilities index — Shows the current version and date for every tool, including Process Monitor
Sites that repackage Process Monitor add nothing to a 3.1 MB ZIP. The Microsoft copy is already portable, so a third-party mirror only adds a chance of tampering.
The same page also links Procmon for Linux, a separate Microsoft project with its own source code and command-line interface.
How to download and run Process Monitor on Windows 11 and 10
Process Monitor never installs. Extract the ZIP once, then start the program from that folder with administrator rights, which Microsoft requires for a capture.
- Open the Process Monitor page on Microsoft Learn.
- Select Download Process Monitor and save ProcessMonitor.zip .
- Open your Downloads folder, right-click the ZIP and select Extract All.
- Choose a permanent folder, such as C:\ProcessMonitor , and select Extract.
- Right-click Procmon64.exe on an Intel or AMD PC, or Procmon64a.exe on an Arm PC, and select Run as administrator.
- Select Yes in User Account Control, then Agree on the Sysinternals licence window.
- Select Reset in the Process Monitor Filter window so no earlier filter hides events.
- Watch the status bar count events, and press Ctrl + E to stop or restart the capture.
Install Process Monitor from the Microsoft Store or with winget
The Microsoft Store carries Process Monitor inside the free Sysinternals Suite app. Winget installs Process Monitor on its own and registers a procmon command.
- Open Sysinternals Suite in the Microsoft Store and select Get.
- Wait for the download to finish, then open Start and search for Process Monitor.
- For winget, right-click Start and select Terminal (Admin).
- Run winget install Microsoft.Sysinternals.ProcessMonitor and accept the source agreement if asked.
- Close and reopen Terminal, then type procmon and press Enter to launch it.
The Store package needs Windows 10 version 1903 or later and updates itself. Winget picks the x86, x64 or ARM64 program for your PC from the same ZIP.
Run Process Monitor without downloading it from Sysinternals Live
Sysinternals Live serves every tool over the network, so Process Monitor can start on a machine where you would rather leave no files behind.
- Press Windows + R to open Run.
- Type \\live.sysinternals.com\tools\Procmon.exe and press Enter.
- Select Run if Windows shows a security warning for the file.
- Or paste live.sysinternals.com/Procmon.exe into the File Explorer address bar.
- Use the ZIP from the Microsoft Learn page instead on a PC with no internet access.
Sysinternals Live always serves the current release, so the Run now route never needs an update step.
How to check that your Process Monitor download is genuine
Microsoft’s winget-pkgs repository records the SHA256 hash of the current ZIP. Compare it with your file before you extract anything.
- Open Terminal in your Downloads folder.
- Run Get-FileHash .\ProcessMonitor.zip -Algorithm SHA256 .
- Compare the result with 80A6442B46AF762ED1432F6FEC3F7E20366BED62A2522B3486503398A40A1128 .
- Delete the file and download it again from Microsoft Learn if the two strings differ.
- Right-click Procmon64.exe , select Properties and check Digital Signatures for Microsoft Corporation.
That hash matches version 4.11 only. Each new release carries a new hash, published in the winget manifest folder.
How to run Process Monitor unattended or on a remote PC
Microsoft documents a command-line capture for servers and remote sessions with no usable desktop. The trace writes straight to a backing file, so nothing has to be saved by hand.
procmon64.exe -accepteula -backingfile C:\ProcessMonitor\Recording.pml -quiet -minimized -accepteula skips the licence window, -backingfile writes events to Recording.pml , and -quiet -minimized keeps the window out of the way. Stop the trace with procmon64.exe -terminate -quiet , or start it on another machine with PsExec using psexec.exe -sd \\
Set a maximum file size for long captures. A backing file with no limit can fill the system drive, and a virtual-memory capture can exhaust system memory.
What Process Monitor records and how it stores a trace
Events go either into virtual memory or into a file on disk, chosen under File > Backing files. Save with All events and Native Process Monitor Format (PML), or a partial trace is all that survives.
| What you capture or save | How it works | Watch out for |
|---|---|---|
| File system, Registry, process and thread activity | Recorded live, with full thread stacks and symbol support | Traces fill fast, so reproduce the problem and stop |
| Backed by virtual memory | Events stay in memory until you save them | A long run can consume all system virtual memory |
| Backed by a named file | Events stream to a .PML file, saved without extra steps | Set a maximum file size or the disk can fill |
| Native Process Monitor Format (PML) | Keeps every field for reloading in Process Monitor later | Choose All events, not only displayed events |
| Boot time logging | Records operations from the next startup onwards | Only the next boot is captured, not every boot |
A saved trace can contain usernames, passwords and the paths of files and Registry keys that were touched. Treat a .PML file like a log with personal data before sending it to anyone.
How to check your Process Monitor version and update it
The ZIP copy never updates itself. Read the version on the file, then replace the folder with the current release.
- Right-click Procmon64.exe in its folder and select Properties.
- Open the Details tab and read File version.
- Compare it with the version on the Sysinternals Utilities index.
- Close Process Monitor, download the new ZIP and extract it over the old folder.
- For a winget copy, run winget upgrade Microsoft.Sysinternals.ProcessMonitor .
- For the Store copy, open Microsoft Store > Library and select Get updates.
Is there a Process Monitor download for Mac?
Process Monitor runs on Windows only. Sysinternals publishes ZoomIt and listent for macOS, and a separate Procmon for Ubuntu, so Mac users take one of these routes instead.
| You want to | Use this | Where |
|---|---|---|
| See which processes use CPU and memory on a Mac | Activity Monitor | Built into macOS |
| Trace file and process activity on Linux | Procmon for Linux | Microsoft open-source build for Ubuntu |
| Trace a Windows PC while working on a Mac | Process Monitor on the Windows machine | Run it on Windows, then read the .PML there |
Activity Monitor covers processes, apps and background tasks with their CPU and memory use. It does not record per-operation file and Registry events the way Procmon does.
Is Process Monitor free?
Yes. Process Monitor is free from Microsoft, with no paid edition, trial or licence key. The Sysinternals licence lets you install and use any number of copies on your devices, and the Sysinternals Suite Store app is free as well. That licence also forbids republishing the software for others to copy, so any site selling a “Procmon Pro” is not Microsoft.
Fix Process Monitor not running or not showing events
Windows says this app cannot run on your PC
The program you started does not match your processor.
- Open Settings > System > About and read System type.
- Run Procmon64.exe on x64 PCs, Procmon64a.exe on Arm PCs or Procmon.exe on 32-bit Windows.
The event list stays empty or shows far too little
A filter saved from an earlier session is still hiding events.
- Open Filter > Reset Filter, or select Reset when the filter window appears at startup.
- Press Ctrl + E to confirm capture is running and watch the event count in the status bar.
- Add your process back with a right-click and Add process to Include filter once events appear.
Process Monitor refuses to start or shows no system activity
The capture driver needs administrator rights.
- Close Process Monitor completely.
- Right-click the program file and select Run as administrator.
- Select Yes in User Account Control.
The PC slows down or runs out of space during a capture
An unbounded trace keeps growing in memory or on disk.
- Open File > Backing files and select Use file named with a path on a spare drive.
- Set a maximum file size, then reproduce the problem and stop the capture straight away.
- Save with All events and Native Process Monitor Format (PML) before closing.
Windows blocks the file or warns it came from another computer
Files extracted from a downloaded ZIP keep the mark of the web.
- Right-click ProcessMonitor.zip and select Properties.
- Tick Unblock on the General tab and select OK.
- Extract the ZIP again and run the program from the new folder.
How to uninstall Process Monitor
The ZIP copy has no uninstaller because it never installs. One delete removes it, once the boot logging option is off.
- Open Process Monitor and check that Options > Enable Boot Logging is not ticked.
- Close the program, including any capture still running.
- Open File Explorer, go to the folder you extracted it to and delete that folder.
- For the winget copy, run winget uninstall Microsoft.Sysinternals.ProcessMonitor .
- For the Store copy, open Settings > Apps > Installed apps, find Sysinternals Suite and select Uninstall.
- Delete any leftover .PML traces, which can be large and hold sensitive paths.
Choose a Process Monitor alternative for your task
Reach for another tool when the job is a live snapshot rather than a recording of events.
| Tool | Best for | Limits |
|---|---|---|
| Process Explorer | Seeing open handles, loaded DLLs and a live process tree | Shows current state, not a timeline of events |
| Task Manager | Ending a frozen app and checking CPU or memory use | No file or Registry activity at all |
| Sysinternals Suite | Getting Procmon plus every other Sysinternals tool in one download | 192.2 MB for tools you may never open |
| Sysmon | Logging process and network activity to the event log long term | A service to configure, not an interactive tracer |
| Handle | Finding which process holds one file open, from a script | Text output only |
Keep Process Monitor for the questions only a timeline answers: which access was denied, which file was missing, which Registry key was read just before the failure.
Frequently asked questions
Is Process Monitor free?
Yes. Process Monitor is free from Microsoft Sysinternals. The licence lets you install and use any number of copies on your devices, and the Sysinternals Suite in the Microsoft Store is free too.
Where do I download Process Monitor?
Download it from the Process Monitor page on Microsoft Learn, under learn.microsoft.com/sysinternals. That page carries the official ZIP link and a Run now link to Sysinternals Live. It is also in the free Sysinternals Suite.
Does Process Monitor work on Windows 11?
Yes. Microsoft lists Windows 11 and later, plus Windows Server 2019 and later, as the supported systems. The ZIP includes separate programs for x64, ARM64 and 32-bit Windows.
Does Process Monitor work on Windows 10?
Windows 10 is not on Microsoft’s supported list for Process Monitor. The Sysinternals Suite package in the Microsoft Store, which includes Procmon, still installs on Windows 10 version 1903 or later.
How big is the Process Monitor download?
Microsoft lists the Process Monitor ZIP at 3.1 MB. The full Sysinternals Suite ZIP is 192.2 MB, and the ARM64 edition of the suite is 21.3 MB.
Is there an offline installer for Process Monitor?
Yes. The ZIP from Microsoft Learn is the complete program, so it runs on a PC with no internet connection. Extract it and start the file for your processor. There is no separate setup program.
What is the difference between Procmon64 and Procmon64a?
Procmon64.exe is the build for 64-bit Intel and AMD processors. Procmon64a.exe is the build for ARM64 processors, such as Windows on Arm laptops. Procmon.exe is the 32-bit build.
Is Process Monitor safe?
Yes, when it comes from Microsoft. Download it only from learn.microsoft.com or the Microsoft Store, and compare the ZIP hash with the one in Microsoft’s winget manifest. The Sysinternals licence states the tools collect no data.
Is there a Process Monitor for Mac?
No. Process Monitor is a Windows tool. On a Mac, use Activity Monitor, which is built into macOS. Microsoft does publish Procmon for Linux on GitHub, but there is no macOS build.
What is the latest version of Process Monitor?
The latest version is Process Monitor 4.11, published on 10 September 2026. Winget installs the same release under the package ID Microsoft.Sysinternals.ProcessMonitor.
How do I install Process Monitor with winget?
Open Terminal and run winget install Microsoft.Sysinternals.ProcessMonitor. Winget downloads the ZIP, picks the right program for your processor and adds a procmon command you can type to launch it.
How do I capture a Process Monitor trace from the command line?
Run procmon64.exe -accepteula -backingfile C:\ProcessMonitor\Recording.pml -quiet -minimized. Reproduce the problem, then stop and save the trace with procmon64.exe -terminate -quiet.
Why does Process Monitor show no events?
A filter saved from an earlier session is the usual cause. Open Filter then Reset Filter, and press Ctrl + E to confirm the capture is running. Start the program as administrator as well.
What is the difference between Process Monitor and Process Explorer?
Process Monitor records file, Registry and process events over time, so you can see what happened before a failure. Process Explorer shows the current state of every process, with its open handles and loaded DLLs.
