Every sysadmin keeps a drawer of tools they trust more than the vendor ever will. Here are five that are genuinely free and still maintained, each with a current release, and the only links are official or project pages (all checked 2026-10-18). Plain names, concrete jobs, honest limits. No paid tiers, no affiliate.
1. Sysinternals Suite (Windows)
What it is: Microsoft’s collection of free utilities for managing and diagnosing Windows: Process Explorer, Autoruns, Sysmon, and dozens more, all in one suite (free at Sysinternals; Microsoft acquired the original team, Winternals, in 2006 per its press release). The current release includes October 2026 updates. (checked 2026-10-18)
The job it does: A box is slow and nobody owns the mystery: open Process Explorer, Microsoft’s advanced process, DLL, and handle viewing utility, and the top CPU and memory offenders are two clicks away. Something starts at boot and nobody remembers installing it: Autoruns lists the startup applications Windows is letting run. You need OS-level evidence for an incident: Sysmon logs system events to the Windows Event Log for security analysis. (checked 2026-10-18)
Honest limitation: Windows is the home base: ProcMon requires Windows 11 and later (Windows Server 2019 and higher), and ProcDump requires Windows 11 and later (Server 2016 and higher). Only a few tools leave Windows: ProcDump and Process Monitor have Linux builds, Junction 1.0.1 (October 13, 2025) targets Linux and macOS, and ProcDump ships a Mac build too (per the Sysinternals download pages, checked 2026-10-18). It shows you what is happening; it will not tell you why.
Who it’s for: Anyone who manages Windows boxes and wants Microsoft’s own deep diagnostics for free.
2. Wireshark (Windows, macOS, Linux)
What it is: The leading packet analyzer: free and open source (GPLv2), a GUI over pcap capture, plus TShark for the terminal (free at wireshark.org; Wireshark docs). In continuous use since 1997, when Gerald Combs started writing it under the name Ethereal (per the history page). (checked 2026-10-18)
The job it does: "VPN is up, Teams works, but the SaaS app cannot reach the internet." Capture on the interface, apply a display filter for the app’s hostname or port, and you see exactly where the connection dies: a handshake that never completes, an authentication error, or a DNS answer pointing somewhere else entirely.
Honest limitation: It shows you everything, including the 99% you did not ask for. A busy interface is a wall of packets, and display filters are the only mercy. Encrypted traffic is the one wall it cannot break: inside a TLS session you get the handshake and connection metadata, not the payload bytes. And on many platforms, capturing requires elevated privileges (see the Wireshark docs). (checked 2026-10-18)
Who it’s for: Network and identity troubleshooters. Anyone tired of "works on my machine" across the LAN.
3. Nmap (Linux, Windows, macOS)
What it is: The open-source network scanner: it discovers hosts and services on a network by sending packets and analyzing the responses (free at nmap.org). In continuous use since 1997, and it turned 20 on September 1, 2017. It ships in many operating systems: "Thousands of people download Nmap every day," the site notes. (checked 2026-10-18)
The job it does: A host you do not recognize appears on the VLAN. Run a version scan and Nmap hands back the open ports with service names and version numbers, plus an OS fingerprint, so you can decide in about a minute whether that is a sanctioned printer or a laptop someone has been parking on the network.
Honest limitation: Scans are active: they generate traffic your IDS will flag, so you scan networks you own or have explicit permission for. Not the internet. And OS and version results are fingerprints, not proof.
Who it’s for: Security-minded admins, asset inventory, and anyone doing pen-test-adjacent work on their own estate.
4. PowerToys (Windows 10/11)
What it is: Microsoft’s official, open-source set of system utilities for power users, on GitHub (free at PowerToys, with install methods on the install page). The current stable release, v0.101.2362, is from August 25, 2026 (per the GitHub releases). (checked 2026-10-18)
The job it does: A 2 a.m. patch window is scheduled and your laptop wants to sleep on its own: Awake keeps the machine awake without touching your power settings. Eight hundred files need renaming to a convention? PowerRename does bulk search-and-replace with regular expressions and undo. PowerToys Run opens your apps with a quick launcher, and Text Extractor copies text off the screen. (checked 2026-10-18)
Honest limitation: It is a comfort layer, not a diagnostic. It polishes the desktop, not the network, and the install page requires Windows 11 or Windows 10 version 2004 (build 19041) or newer on 64-bit, so Windows 7, 8, and 8.1 users are out. The version number is still 0.x, so check the release notes before you build a workflow on any single utility. (checked 2026-10-18)
Who it’s for: You, at your own desk: a daily-driver ergonomics pack, not a server-room tool.
5. WinDirStat (Windows)
What it is: A free and open-source (GPLv3-or-later) disk space analyzer for Windows: a directory tree, statistics grouped by file extension, and a treemap where each rectangle’s area is proportional to the file’s size (free at windirstat.net). (checked 2026-10-18)
The job it does: C: hits 95% on a Tuesday and the OS storage page tells you the drive is full, but not what is eating it. Point WinDirStat at the drive and the treemap immediately shows which folder is eating the drive: unrotated logs, an abandoned installer cache, the 120 GB VM disk you forgot existed. (checked 2026-10-18)
Honest limitation: The classic you remember is the 1.x line (2003 to 2007 in the release archive); the current 2.x line is the revival: 2.9.3 is latest, out October 2026, and some new features do not match your muscle memory (per the project release page and GitHub releases, checked 2026-10-18). The accelerated full-volume NTFS scan requires administrator rights. (checked 2026-10-18)
Who it’s for: Anyone with a red disk on Windows. (checked 2026-10-18)
The pattern
None of these fixes a problem by itself; each one makes the next question visible. Install the two that match the tickets you actually get, and keep the rest in your pocket for the day the other kind lands.
Get the TechLunch newsletter (one click in, one click out).