You can then use this to select a process to filter the ProcMon trace.ĭata was collected and we opened the Process Monitor trace and using TOOLS / PROCESS TREE (with no filtering) we were able to see a script that ran during startup installing a product key. The image below is not from this case, but is here to show where this option is. If you have a ProcMon trace, click on TOOLS then PROCESS TREE and you will be happy with what you find. Using Process Tree, all the processes that ran during data collection from ProcMon are visible in a format similar to process explorer (another tool). In our case the ProcMon wrote a little over 1GB of data from that short trace.įeature 2: Process Tree (off of the Tools menu) If you use this feature be sure to stop trace as soon as the repro happens to minimize the size of the collected data. Since this issue was occurring at reboot that was the path we followed. From the menu click OPTIONS then ENABLE BOOT LOGGING and ProcMon will monitor on reboot. You can collect boot traces with ProcMon to collect data during a boot of a machine.

Here is a closer look at the two features I would like to bring out. Specifically we relied on two features in ProcMon (boot logging and process tree view) that I want to show you that helped pin point this issue. With that piece of information we decided to leverage a monitoring tool (ProcMon) from SysInternals to trace what is happening on reboot. This issue appeared to happen sometime after reboot of the KMS server and once fixed never reverted until it was rebooted. We had one piece of information that turned out to be very helpful. Review great blogs such as this one on how to ramp up on KMS. Try slmgr.exe (this is the command line tool to manage Site Licenses) to output KMS key information. So where to start troubleshooting… Do you have the right key? Recently I helped discover an odd issue with some KMS servers losing their KMS Server Key and becoming a KMS Client. I wanted to share an issue that was resolved using tools from SysInternals. First published on TechNet on Sep 08, 2014ĭougga here with a short and simple post.

Microsoft procmon