{"id":1938,"date":"2017-01-03T00:38:14","date_gmt":"2017-01-02T23:38:14","guid":{"rendered":"http:\/\/borncity.com\/win\/?p=1938"},"modified":"2022-06-23T20:58:12","modified_gmt":"2022-06-23T18:58:12","slug":"process-monitor-how-to-enable-windows-10-boot-logging","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2017\/01\/03\/process-monitor-how-to-enable-windows-10-boot-logging\/","title":{"rendered":"Process Monitor: How to enable Windows 10 boot logging"},"content":{"rendered":"

Recently I stumbled upon an error: In Windows 10 I wasn't able to use Sysinternals Process Monitor for boot logging. The feature just dropped an error message. Here are the details and a how to cure this issue and enable boot logging.<\/p>\n

<\/p>\n

What we are talking about?\"\"<\/h3>\n

Currently I'm writing a book about Windows 10 insides \u2013 and within a chapter I intended to introduce boot logging with Sysinternals Process Monitor<\/a>. In previous Windows version it was possible, to launch Process Monitor, open Options<\/em> menu and select Enable Boot Logging <\/em>(see screenshot below).<\/p>\n

\"Boot<\/p>\n

But in Windows 10 I was greeted with the following error dialog box. I've tested Windows 10 Version 1607, but it seems that all Windows 10 versions are causing this error.<\/p>\n

\"Error<\/p>\n

The dialog box reporting, that Process Monitor was not able to write to a file ProcMon23.sys<\/em>. I checked Windows 7, but this file wasn't available. Then I checked Windows 10 and I found such a file. <\/p>\n

How to solve this issue<\/h3>\n

Searching the web, I came across this MSDN article (link broken), where deleting this file in Windows PE was suggested. I tried a different approach (never believe, what Microsoft writes): I fired up Windows explorer and navigated to <\/p>\n

%SystemRoot%\\System32\\Drivers\\<\/em><\/p>\n

and found a file PROCMON23.sys<\/em>. Then I tried to rename this file to _PROCMON23.sys<\/em>. It required administrator privileges, but I was able to process this renaming operation successfully. Microsoft's MSDN article also requires to launch Process Monitor using a command:<\/p>\n

C:\\procmon\\Procmon \/BackingFile C:\\procmon\\log.pml \/AcceptEula \/Quiet \/noconnect<\/em><\/p>\n

I also ignored this advice and launched Process Explorer via a double click. And voil\u00e1, it came up with the window shown above \u2013 and I was able to enable the boot logging option. Inspecting the folder %SystemRoot%\\System32\\Drivers\\ <\/em>showed me, that a new file PROCMON23.sys <\/em>was created \u2013 beside the old file _PROCMON23.sys<\/em>. <\/p>\n

Similar articles:
<\/strong>Windows 10 Wiki<\/a>
Windows 10: Open command prompt window as administrator<\/a>
Check and repair Windows system files and component store<\/a>
Windows 10: How to fix update error 0x80080008<\/a>
How to block Windows 10 updates<\/a>
Windows 10: Hibernation causes error 0xC0000411<\/a>
Windows 7\/8.1: Optional INTEL System driver updates<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Recently I stumbled upon an error: In Windows 10 I wasn't able to use Sysinternals Process Monitor for boot logging. The feature just dropped an error message. Here are the details and a how to cure this issue and enable … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[463,2],"tags":[606,47,605,607,76],"class_list":["post-1938","post","type-post","status-publish","format-standard","hentry","category-issue","category-windows","tag-boot-logging","tag-issue","tag-process-monitor","tag-procmon23-sys","tag-windows-10"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=1938"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/1938\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=1938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=1938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=1938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}