Ask Learn
Preview
Ask Learn is an AI assistant that can answer questions, clarify concepts, and define terms using trusted Microsoft documentation.
Please sign in to use Ask Learn.
Sign inThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Boot logging is one of my favorite features in procmon. But after upgrading to windows 10, I found this function does not always work out.
Unable to write PROCMON23.sys.
Make sure that you have permission to write to the %%SystemRoot%%\System32\Drivers directory.
To work this out, we need to:
1. Delete %%SystemRoot%%\System32\Drivers\PROCMON23.sys. You may not delete this file from current running OS, but you can do this in WinPE.
2. Importent! Please start procmon with the following command:
C:\procmon\Procmon /BackingFile C:\procmon\log.pml /AcceptEula /Quiet /noconnect
3. Now, it works!
Ask Learn is an AI assistant that can answer questions, clarify concepts, and define terms using trusted Microsoft documentation.
Please sign in to use Ask Learn.
Sign in