Collection of system internals tools for PowerShell.

This module will run the cmdlet "Enable-PSRemoting" on the remote computer using a third party tool (PsExec).

Run SysInternals in memory. Use the -List flag to list all tools as they are mapped or the -DriveLetter flag to change the defaul from the Z: drive. Cleans itself upon close of PS session.

Microsoft Defender for Endpoint troubleshooting: prove a file sharing-violation collision between the EDR sensor (MsSense.exe) and a line-of-business app, for a Defender for Endpoint EDR exclusion request. Crash/hang event harvest, Process Monitor filter files written natively, capture, automated collision analysis, and a JSON hand-back. Windows Po... More info