Need to update Process Explorer

@Narendra kala The version information for the PROCEXP152.SYS driver associated with version 17.1 of Process Explorer is as shown here -

The driver should be located in the %windir%\System32\drivers directory.

If the PROCEXP152.SYS driver is not present on the system Process Explorer will install it when it is run with elevated privileges as an Administrator. Consequently, the driver is loaded by the system and cannot be replaced by a newer version without restarting the system. For example, the driver cannot be deleted by an Administrator as shown here -

Once the driver has been loaded by a running system installing the most current version of Process Explorer and running it with elevated privileges as an Administrator will NOT update the driver unless the system has been restarted.

Process Explorer is updated by replacing the old executable with the latest version from Sysinternals. The driver procexp152.sys is the kernel driver used by an older Process Explorer build (v15.2); updating Process Explorer will also update the driver it uses.

Steps to update Process Explorer:

1. Download the latest Process Explorer
   • Go to the Process Explorer page and download the current ZIP package: ProcessExplorer.zip.
   • The current version listed is Process Explorer v17.1.
   • Alternatively, it can be run directly from Sysinternals Live as procexp.exe.
2. Close any running instance of Process Explorer
   • Ensure procexp.exe (or procexp64.exe) is not running on the system where the alerts are generated.
3. Replace the old binaries
   • Locate the folder where the current Process Explorer executable is stored (for example, a tools or admin utilities folder).
   • Extract the contents of the new ProcessExplorer.zip to a temporary location.
   • Copy the new procexp.exe (and procexp64.exe if used) over the old files in the tools folder, replacing them.
4. Verify the new version
   • Launch Process Explorer from the updated location.
   • In the UI, check Help → About to confirm the version is now the latest (e.g., v17.1).
   • After this, the old driver procexp152.sys should no longer be loaded; the updated executable will use its corresponding driver.
5. Update deployment (if used enterprise-wide)
   • If Process Explorer is deployed via a central share, software distribution tool, or script, update that source location with the new ZIP contents so all users run the updated version.

If alerts continue to reference procexp152.sys after updating, check for any other copies of the old Process Explorer executable on the system or in logon scripts and remove or replace them.

References:

• Process Explorer v17.1