What program is this window from?
Hi everyone.
Leo Notenboom here for Ask Leo.com. Here's an example question.
There's a window on my screen and I can't tell what program it's from.
Is there a way?
Well, yeah, actually there is. It's a very quick way.
It's a very easy way and it's accurate.
I'll call it about 90% of the time.
It's very useful.
I've actually been known to do this myself all the time.
Let's flip over to my Windows Ten machine here.
The very first thing we're going to do is actually go to the Microsoft Store
and what we're going to do is install the Sysinternals utilities.
I'm going to search for Sysinternals.
There it is, the Sysinternals Suite.
This has a number of different programs associated with it.
The one that I use almost all the time is
Process Explorer, which is what you'll see here.
The example that they're showing while it downloads.
There are a number of other utilities that are part of this package.
There's Process Explorer. Auto runs is another one
that I've been known to recommend from time to time.
It's a useful set of utilities if
you're interested in looking a little bit deeper under the hood of Windows.
So it's been installed.
I'm going to go ahead and close the Microsoft Store real quick.
So you'll see, Sysinternal Suite here has been added, but in fact,
what we really care about are the individual programs that have been added.
AccessEnum, ADExplorer.
Those are examples of those programs.
The Sysinternal Suite link will only take
you to the Web page that describes this internal suite.
What we're interested here is Process Explorer.
Process Monitor is something else, also a useful tool.
But Process Explorer is what we want to play with here today.
So we've got it running.
It looks like Task Manager,
and I've actually referred to it before as Task Manager on steroids.
A little bit more colorful, a little bit more interesting,
showing you different things that are going on with your system.
For this example, what I'm going to do is I'm going to fire up the mail program just
because and you can see that it's running here.
It's an application.
Let's say we had no idea what program brought up this window.
We have no idea.
This little sonar or radar icon is our tool.
I'm going to click and hold on that tool
and now drag it over on top of the inbox window as soon as I release it.
What happens here is that this
program got highlighted, HX Outlook Exe, whatever that is.
But that's telling me that the program
that I'm looking at right here is managed by this HX Outlook.
Exe. Now, if I do this with a different
program, I will fire up let's see, let's fire up Chrome.
Of course, it has the usual what's new in Chrome kind of thing.
I'm going to move it over, bring Process Explorer to the foreground.
Same thing.
Grab and hold on that radar or sonar icon.
You can see in this case that I've got
a little highlight that's moving around as I move the sonar icon around.
If I now release it back here, you'll see that Chrome.exe got highlighted.
Now, this is an example of a program
that actually has many instances, but it's telling you that this window
ultimately is something that came from Google Chrome.
Now, these are obvious examples.
Clearly, we already knew which application
was running when we dropped the icon on there.
But it is kind of interesting
to understand that you can do this to any window that shows up on your screen.
For example, I'm going to with nothing
running, take the icon drag and drop it and drop it onto the taskbar.
And you can see right away that the highlight went to Explorer Etsy.
That's because it is Explorer.exe that's responsible for displaying the taskbar.
Anyway, I hope that's useful.
This is a very, very useful tool.
Whenever you get a pop up message.
Box, a dialog box that you don't.
Understand that hasn't properly identified itself, this.
Will actually give you a very important.
Clue as to where that thing came from.
Now, there is one last caveat that I want to show you, and that is this.
You'll notice that there are a bunch
of instances of this thing called Service host.
Service host is a Windows workhorse.
It literally hosts various services that Windows itself is running.
Things like Windows Update is implemented by service host backups,
and a bunch of other things are all implemented as part of Service host.
The problem is that sometimes when you drag and drop the radar onto a message
box, it may direct you to a Service host instance.
So let's say we were looking at this one.
What I can do is just Hover over it and you can see there
that under Services, this is providing the function discovery Provider host.
I have no idea what that is,
but in this case, if a message box came from this instance of Service host,
you would know that it was related to that specific service.
The confusing part is that Service host a single instance of Service host can
actually be responsible for multiple services.
So if Process Explorer were to point.
You at this instance of Service host, you could see that it could be either
the Windows Defender Firewall or the Base filtering engine.
Again, whatever that is that are causing
whatever message box you're looking at, that's the 10%.
That's why I say it's 90% useful.
The 10% case is where it becomes a little bit ambiguous.
You're not really sure which service is actually displaying the message,
but that then gives you really good fodder for your next door Google search.
As I said, I hope that was helpful.
For updates, for comments, for related links and more, visit Askleo.com/19818.
I'm Leo Notenboom and this is Ask Leo.com. Thanks for watching.