System Informer overview: a deep Windows process and resource explorer
What System Informer is
System Informer, long known as Process Hacker, is a free and open source monitoring application for Windows. It replaces and extends the built-in Task Manager with a process tree that exposes what each process actually holds: loaded modules, open handles, threads, tokens, environment variables and the network connections it owns. Resource graphs for CPU, memory, disk and network run continuously, so you can watch a machine while you reproduce a problem instead of reasoning about it afterwards. The project is MIT licensed, so the source may be reused and redistributed with attribution.
How a typical session works
Most people start in the Processes tab, sort by CPU or private bytes, then right-click a suspect entry to inspect its properties. The Properties dialog is where the tool earns its keep: the Handles tab answers which process is holding a file or folder open, the Network tab maps connections back to a process, and the Services and Modules tabs show what will be affected if you terminate something. A highlight action keeps a chosen process visually marked while you work, and the search box filters the tree by name, PID or path. Priority, affinity, suspend and end are available from the same context menu.
Settings, elevation and practical limits
System Informer is far more useful when it runs elevated, because many details are visible only to an administrator. On first launch it offers to install a signed kernel-mode driver that extends the information available about file handles and threads; the driver is optional and can be turned off again from the settings. The program is Windows-only, and the installer published here targets 64-bit systems, so other architectures need a different package from the same release page. Configuration sits behind Options and covers update checks, the tray icon, graph intervals, highlight colours and the kernel driver. Because it can terminate processes, close handles and edit services, a careless action can destabilise a running system; treat it as an administrative instrument rather than a toy.
When to choose something else
If all you need is to end an unresponsive program once in a while, the Task Manager that ships with Windows is enough and needs no installation. If you are doing reverse engineering or malware triage, a debugger and dedicated tracing tools give call-level detail that a live monitor cannot. If your machines are not Windows, this tool does not apply at all. And if the real goal is a long-term performance baseline rather than live inspection, a dedicated monitoring agent answers that question better.
- Best for
- Windows power users, support engineers and administrators who need handle-level detail about running processes.
- Good to know
- Full detail requires running the app as administrator, and the optional kernel-mode driver is offered on first launch and can be removed later.
How to get started
- Download the setup executable and run it, accepting the UAC prompt so the installer can register the kernel driver service.
- Launch System Informer and allow elevation when asked; without it, handle and token details stay hidden.
- Press Ctrl+F to find a process by name or PID, then double-click it to open the Properties window.
- Use the Handles tab to see which files and registry keys the process holds, and the Network tab for its connections.
- Open Options to set update checks, tray behaviour and graph refresh, then close the window to leave it running in the tray.
Questions & answers
Does System Informer replace Task Manager?
It covers what Task Manager does and adds handles, tokens, modules, services and full network views. Many people keep both and reach for System Informer when the built-in tool is not detailed enough.
Why can I not see every handle?
Handle and token detail needs administrator rights, and some file handle information comes from the optional kernel-mode driver. Restart the app elevated and enable the driver in settings.
Is it safe to end processes here?
The same care as Task Manager applies, but the extra power makes mistakes costlier: suspending a critical service or closing a handle can freeze the session. Save your work before experimenting.