WinObj

WinObj is an essential utility for security-conscious system administrators and developers who need to inspect the Windows NT Object Manager namespace. The tool employs the native Windows API (NTDLL.DLL) to access and display detailed information about system objects, offering an accurate and comprehensive view that surpasses other similar utilities.

★★★★★

5.0(1 ratings)

• Hierarchical namespace view. WinObj presents the Object Manager namespace in a familiar tree interface, similar to Windows Explorer. This allows users to navigate directories such as \BaseNamedObjects, \Device, \Callback, and \GLOBAL?? to examine the structure and organization of system objects.
• Object type inspection. The tool lists all object types managed by the operating system, such as Directories, Events, Mutants, Sections, Semaphores, Timers, Files, Devices, ALPC ports, and Registry Keys. Each type is displayed with a distinctive icon for easy identification.
• Object property querying. When selecting a specific object, WinObj displays a panel with its fundamental properties. This includes the object's name, type, reference count, handle count, and associated security permissions.
• Security permission viewing. WinObj integrates the functionality to view the security descriptor of any object. Users can open a standard Windows security settings window to inspect the Access Control Lists (ACLs) and understand which users or groups have specific permissions on the object.
• Device object opening. Unlike previous versions or other tools, WinObj can open and display properties of device objects (\Device), which is essential for diagnosing driver and hardware issues.
• Object searching and filtering. The utility incorporates search functions that allow locating objects by name within the namespace tree. It also offers filtering options to display only objects of a certain type, simplifying analysis on systems with thousands of objects.
• Dynamic view update. WinObj can refresh its view in real-time, reflecting the creation and destruction of objects as they occur in the system. This is useful for monitoring the activity of applications or services that create transient objects.
• System theme support. WinObj version 3.0 and later include user interface improvements, such as support for light and dark themes, integrating with the operating system's personalization settings.
• Symbolic link name identification. WinObj clearly displays symbolic links within the namespace, such as those in the \GLOBAL?? directory (formerly \??) that connect DOS names (like C:) with their corresponding device objects in \Device.
• Process information with open handles. For certain objects, WinObj can provide information about which processes have open handles to them, helping to track resource usage and potential handle leaks.

WinObj is a creation of Mark Russinovich and Bryce Cogswell, the founders of Sysinternals. The earliest versions of the tool date back to the early days of Sysinternals in the late 1990s, making it one of the veteran utilities in the collection. Its development continues to this day under the maintenance of Microsoft, which acquired Sysinternals in 2006. The modern version (3.x) is primarily written in C++ and utilizes the Windows API, leveraging native Windows functions to interact with the Object Manager without the need for kernel drivers.

Alternatives to WinObj: