Complete monitoring of applications in windows 10

[Marcipicus]

Hi there,

I was hoping to find out if there is a feature in windows 10 where you can completely monitor the actions of a program step by step as it executes.

i.e.

Instead of giving an installation program free reign over your system can you put it in a "baby sitting" mode where it tells you which files it is accessing, when/where it connects to the internet and anything else that would be suspicious.

If they don't already have it I think they should.

P.S. I have tried process explorer but I would prefer something easier to understand.

Cheers

[jonathonscott]

Hope this is a helpful distinction - have you tried process monitor ( https://docs.microsoft.com/en-us/sysinternals/downloads/procmon ) vs process explorer ?

[dcontesti]

---

@Marcipicus wrote:

Hi there,

I was hoping to find out if there is a feature in windows 10 where you can completely monitor the actions of a program step by step as it executes.

i.e.

Instead of giving an installation program free reign over your system can you put it in a "baby sitting" mode where it tells you which files it is accessing, when/where it connects to the internet and anything else that would be suspicious.

If they don't already have it I think they should.

P.S. I have tried process explorer but I would prefer something easier to understand.

Cheers

---

So i have resorted to external tools for this (typically free....you know that budgeting thing).

Had some success with AppsTracker ( ReviverSoft).  

Hope that helps

d

[JKWiniger]

Just a comment on process explorer, I find it very helpful in malware / virus tracing. If you have a process spawned off of say Internet Explorer then things like Task Manager will only show the parent process and hide the spawned bad process, whereas process explorer shows everything and what process spawned other processes. Knowing this help to trace point of entry and kill things...

In case people did know..

John-

[Shannon]

@Marcipicus, from what described, I've understood that you want to be able to control the application as well as find out what it's doing, so in addition to monitoring, consider using a virtualized environment for isolation.

I would prefer virtualizing the OS, but for the app itself, Windows 10 offers a Sandbox feature with the Proessional & Enterprise versions. (I've not tried this myself given that I don't know what level of isolation it offers, so do so at your own risk)