Deploy Process Monitor to Microsoft Intune
SysinternalsWindowsversion 4.11, 10 September 2026
Process Monitor is in the PatchBee catalog as a Windows app from Sysinternals, synced from the Windows Package Manager community repository (winget). Pick it in the App Library and PatchBee writes the deployment plan below, builds the package, publishes it to your Intune tenant and assigns it to the Entra groups you choose. New versions then follow through your update rings.
The plan PatchBee writes
Process Monitor as an Intune app
The standard form for a Zip archive (x64, scope decided at plan time). The real plan is generated from the installer when you package, and shown in full before anything is published; every field can be changed.
- Intune app type
- Windows app (Win32), .intunewin (wrapped)
- Install
- Wrapped: extracted into Program Files, a Start menu shortcut created, by PatchBee's silent-install wrapper.
- Uninstall
- The wrapper removes the install folder and the shortcut.
- Detection
- File: the main executable. The main executable in the install folder, version 4.11 or newer.
- Requirements
- x86 (32-bit), x64, ARM64
Installers in version 4.11
| Architecture | Type | Scope | Hash |
|---|---|---|---|
| x86 (32-bit) | Zip archive | scope decided at plan time | SHA-256 published |
| x64 | Zip archive | scope decided at plan time | SHA-256 published |
| ARM64 | Zip archive | scope decided at plan time | SHA-256 published |
PatchBee downloads the installer from the publisher's own URL and verifies its SHA-256 against the catalog before packaging. "None published" means the source carries no hash for this download, so that check has nothing to compare against; packaging still works.
About Process Monitor
Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.
Process Monitor includes powerful monitoring and filtering capabilities, including:
- More data captured for operation input and output parameters
- Non-destructive filters allow you to set filters without losing data
- Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation
- Reliable capture of process details, including image path, command line, user and session ID
- Publisher
- Sysinternals
- License
- Proprietary
- Source
- winget · Microsoft.Sysinternals.ProcessMonitor
- Versions in catalog
- 4
How this becomes an app in your tenant
Sign in with your Microsoft work account and connect your Intune tenant once. Find Process Monitor in the App Library, open its plan (the commands, detection rule and requirements above, editable) and publish: PatchBee downloads and verifies the installer, builds the package, creates the Intune app and assigns your groups. When Sysinternals ships a new version, PatchBee detects it and rolls it out through your rings, with supersedence and rollback.
Read the step-by-step guideMore Windows apps
Catalog data as of 11 October 2026, from the Windows Package Manager community repository (winget). The product re-reads the source every night and plans against the live catalog, so the version here may already be one behind. Nothing is published to a tenant without an administrator approving the plan.