Where Does Process Monitor Store Captures and Settings?
Where Process Monitor keeps its .pml captures, filters, and symbol cache outside the single exe.
Last updated
Process Monitor is one exe with no installer, so everything persistent sits elsewhere. Captures go wherever you save them as .pml files, settings live in the registry under HKCU\Software\Sysinternals\Process Monitor, and debug symbols cache beside the configured path.
The workflow that works is deliberate saving. Backing files and paging file usage grow while capturing, so save early, filter in the saved copy, and keep the live session lean. A capture saved today opens identically years later, symbols permitting.
Where Process Monitor stores this, by platform
HKCU\Software\Sysinternals\Process Monitor
Filters, columns, and highlight rules under this key; EulaAccepted sits one level up with the other Sysinternals tools. .pml captures go wherever File > Save points, so keep a dated folder. Backing files in TEMP can grow large during long captures.
Frequently asked questions
where do process monitor captures go
Wherever you choose in File > Save (native .pml keeps every event, CSV and XML export subsets). There is no autosave location; unsaved captures live in RAM and vanish on close. Name captures with dates and hostnames or they blur together.
where are process monitor settings stored
In the registry under HKCU\Software\Sysinternals\Process Monitor (columns, filters, highlighting). Export that key to migrate a tuned setup. Deleting it resets the UI without touching any capture file.
where does process monitor put symbols
In the dbghelp symbol path setting, defaulting to the Microsoft public server with a local cache beside it. Point the cache at a fast local folder; first resolutions are slow and every later one is instant. Wrong symbols make stacks lie.
Notice an outdated path? Let us know.